3

Currently working on a Tor study, I would have a question regarding the tor hidden services.

I read lot of technicals papers to better understand the tor working on this point, like these good articles: The Tor dark net: https://www.cigionline.org/sites/default/files/no20_0.pdf Content and popularity analysis of Tor hidden services: http://arxiv.org/pdf/1308.6768.pdf

But I couldn't get a clear answer to my interogations.

So the question is simple, I would like to know if it's possible, from a relay node, to sniff the traffic to get the onions address accessed through this node ?

In this case, the traffic is fully end to end encrypted, but is it only the data that are encrypted, or the onions address also ? For me, the onion address is a metadata, and not usefull information, so maybe it's not encrypted and we could get these metadatas ?

Thanks in advance for your explanations.

Improve this question
1
  • In others words, is it possible to dump the Tor HSDir from a relay ?
    – bdes31
    Commented Mar 26, 2016 at 12:38

2 Answers 2

Reset to default
2

I have worked on finding ALL Onion Addresses in TOR service and as I found, there is no clear way of finding all the Onions. Actually in the next generation of Onion Addresses, HSDirs can not see the Onion Addresses. You may see the full question HERE. As Alexey Vesnin said, you may get a portion of addresses not all of them, because the addresses are put inside a Distributed Hash Table. Check the TOR description on the TOR project's page.

Step two: the onion service assembles an onion service descriptor, containing its public key and a summary of each introduction point, and signs this descriptor with its private key. It uploads that descriptor to a distributed hash table. The descriptor will be found by clients requesting XYZ.onion where XYZ is a 16 character name derived from the service's public key. After this step, the onion service is set up.

TOR Hidden Service DHT

Therefore I started a project named Onion Harvester. The aim of the project is to find all Onion addresses and update the list by contribution of volunteer clients. The project main site is OnionHarvester.com

I'll release the project on second week of Jan 2018, but you may visit the source and the repository and how it works. Feel free if you have any question about it.

Improve this answer
2
  • It is against the Tor Ethical guidelines to harvest onion addresses. Your HSDir will be banned once they find it out. TorProject possesses a weapon to detect malicious HSDir who harvests onion addresses.
    – defalt
    Commented Jan 6, 2018 at 16:58
  • You're right but I do not use HSdir. I just ask clients to harvest as a bruteforce. I did not sniff inside HSDir.
    – Mir Saman
    Commented Jan 6, 2018 at 17:04
1

Yes, you even don't need to dump it, but become a *HSDir** flagged relay, I.e. a hidden services directory. However, there's not much use of it,because you will see a rendezvous points and maybe some HS onions, but they are easy to change. What is your purpose of doing it?

Improve this answer
3
  • Hi Alexey, thanks for your answer.Just because I'm interesting on a general ways by all security topics related to encryption or all others subjets like tor. Ok, so following your statement it's possible, but technically and concretely, how to do that ? With specific tools, by changing the source code ? Regarding the second assumption, an existing research already exist related to this discussion: github.com/DonnchaC/tor-hsdir-research . But I doubt this tor version is still functionnal theses days...
    – bdes31
    Commented Mar 28, 2016 at 21:37
  • @bdes31 the most deep and effective way is to use a source code insertion in event of receiving a HS descriptor. And then use command-line protocol to issue "hs/client/desc/id/<ADDR>" or "hs/service/desc/id/<ADDR>". You can try dumping a very verbose logs also for HS names/<ADDR>
    – Alexey Vesnin ♦
    Commented Mar 28, 2016 at 21:45
  • You won't see a rendezvous point. Only after a HS circuit to an introduction point is build will a rendezvous point be determined.
    – nobody
    Commented Jan 6, 2018 at 15:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .