The researcher analyzed the network accessibility and response behavior of Hysteria2 VPN endpoints using custom NetProbe tools for Windows and Linux. The study focused on how these endpoints react to different types of connection attempts, ranging from simple UDP probes to authenticated Hysteria2 client sessions.
Initial tests showed that Hysteria2 endpoints do not respond to basic UDP probes, resulting in a timeout. However, when initiating a QUIC handshake, the server successfully established a connection using TLS 1.3 and ALPN h3. Despite this, a standard HTTP/3 GET request resulted in the server closing the connection with an H3_NO_ERROR code (256).
Further investigation using an instrumented Hysteria2 client revealed the authentication process. The client sends an HTTP/3 POST request to the /auth path, including headers for authentication data, receive speed limits, and padding. The server confirms successful authentication with a status code 233 and signals support for UDP forwarding.
The experiments were conducted using commercial VPN subscription data, with traffic captured in PCAPNG format for analysis in Wireshark. By utilizing session keys from the client, the researcher was able to decrypt the QUIC traffic and observe the specific HTTP/3 frames that distinguish legitimate VPN traffic from unauthorized connection attempts.
