18

Hidden Services usually have a long-ish string of alphanumeric characters for their .onion address, and this is generated by Tor as part of the Hidden Service Configuration.

How did some Hidden Services get 'memorable' .onion addresses such as

  • Tor Wiki - torwikignoueupfm.onion
  • A mirror of The Hidden Wiki - wikitjerrta4qgz4.onion (notice it starts with wiki)
  • 1
    They are random. They just keep generating the random addresses until they start with something they want. – Ry- Sep 25 '13 at 19:12
  • 1
    @minitech - answers go in the answers section. The comments are for discussion about improving the question, or clarifying what the question is asking. – Megan Walker Sep 25 '13 at 19:16
  • 1
    I know, but I don’t have any good resources yet. – Ry- Sep 25 '13 at 19:17
  • 2
    see also: security.stackexchange.com/questions/29772/… – user517 Apr 20 '14 at 3:37
23

They use a tool like Shallot to brute-force the onion address.

What Shallot does is to generate a private key in the same way that the Tor software does when generating a new hidden service address. It then manipulates the public key portion of the key to create new versions of the .onion address and checks through those to see if they match the desired address.

It generates a new private key periodically. The keys generated by Shallot and other methods of brute forcing an onion address have a larger than average public key component but are syntactically fine and pass all tests ensuring that they are good keys.

Shallot is run like this:

$ ./shallot ^test
----------------------------------------------------------------
Found matching pattern after 99133 tries: testvztz3tfoiofv.onion
----------------------------------------------------------------
-----BEGIN RSA PRIVATE KEY-----
MIICXgIBAAKBgQC3R85m6NQaA1ZjaYqvz1hvFIjbL4RtKdJbG8hlC9xEBkvfr/BG
8Z5vDiUzdbDt8mEBuZUDanx80uGJvbXTgmczX0UlkEOgGiZ8RKpnsbKaf/EJNrIw
T7MSXQmWNcm22nDeViV7fwy+Usyal2RE5cdVCFsPtEbVZqCumlKkEgCyFwIDBAZ7
AoGBAJSa2cGuru/XhzJAEAIwHZbgPDnum9T/srOYxUKW6afHZeOu5S4Cclwb+xb/
pGOtzn71XZfCKMfiVdxB/f3XTcRrYB2VnBoNToTD7WfH6DksdDf4zunqiEjvxi9K
R+tKhxmF7OedrRt8wIhUmFd1E2Q9nbTHI6icdB4kR4QkYKZzAkEA5M6samK7+495
6SWpRXiePIs7sHKWuxdCrG7kW5RNJrv2CcGYwK46TPcaXBcRfM4eq9+9PGoKi0IO
gSpOZ5vRYQJBAM0QAZYTZ6ApD014x372MX1ZNofuYL/+XF8ZPZV6Sh4+9MUBuNPb
yL7BENDr6pX4Zm6OepvAphhCa4vGno2pHncCQQCQnfhUCHANU4bjtX4EOoI63WDq
UwBOeIWxu0YvGt7Z25Dg9CNz/aX8UZIoj6VyKxLRbR9+K3mNrNgaopW+ZDKzAkEA
ttgTK1ALe+3v+5H+Ez1SvFPREDFcHihrfD1Ipc5zicY9ixTArgdyZvk+Pi+AMBVV
sL2HWvjRLEAgRclvKfkwWwJAFtM+BIGRM5me+fMALuBBEtKnbJ6maflsyucErEb0
pIIBkovF5oyWO3lSBmtStJIANNkHOg8aXqjcgPKusDN7CQ==
-----END RSA PRIVATE KEY-----

By passing it a regular expression, you can describe what you want your .onion address to look like. Using this hostname and private key you can create the hostname and private_key files that tor expects to find in the hidden service directory.

  • // , @minitech I'd love to see an example of this, if you'd be willing to add a short answer with screenshots. – Nathan Basanese Jun 8 '15 at 7:43
  • I'm the one who wrote the post :) – IceyEC Jun 8 '15 at 10:53
5

I also saw this project called scallion, which is GPU based hashing, unlike shallot, it is a lot faster. One disadvantage of this: it is coded for windows.

Anyway, for shallot, I entered php as the phrase, and it went with a fancy name...

--------------------------------------------------------------
Found matching domain after 3874 tries: saticzeff4ygphpr.onion
--------------------------------------------------------------
-----BEGIN RSA PRIVATE KEY-----
MIICXAIBAAKBgQDALlbUF2ME4GofkL3PNg8/6nO+1osV5/cxlNCS6MkwvsLhwpK7
dPU9qZpDolTdYqBLZjywpX/eQKlGb2T4831RxBTuNd5xu80Z04Wb3Szl+HZNxbUV
br6yd8psm18DScpxzbgMvYQKr3lhnUt7mkrhGxku0EYeP6z7HgOBYCG4cQIDAR5D
AoGAGcaBDN7yLFz5gCLLcPmEA/j85jaOl2zo7u5iXFRTKcGhaSRxSqvxZLEWa/qW
gwQCETfNxn1wJHF69vPNcdVTxy38d6Y2kNMfuFu8KmLrkYoEETFnO8voDXzWC7gl
OKlHm8J19QvjmsUeO1Vs1ZPZhmOByoegl3rIpugxoJJQhmcCQQDeJMuOtJmF9fm0
akKRKmunTM1JtBtbkQEAlgn149xL0uCWb+2CKltsY4XciDr08K8hbSqH/p3lZgpG
oLvRDo9lAkEA3XiDNJuDlGo9WHX625SOnNWnEQukDXiyrvRwe3Yp03IMc9CPiBJk
B1vdbxIaxDzH7S6FVvpq95MHPRpkmlbyHQJAakWTb5NfhL1gU9tY+mnS4fire9My
lp2xh9+CWleV8CV26pv9dKoVkVRn7ME8cbZJRCZFnb8jZtCyZL2S5GWrQwJBAI/4
o+DHghxJga5n2h9R31x4DZHC/YApf9PiVzop0mc5JeV1J7Uj9vl2QmgGLvQXMOr0
BYtjmvxabQa5M+lBVZcCQCzSefXcOIhShJnmgm02GDcZCaLFMHLWNXHxfeVulqTr
62NQY9SxBQK3xuXHwx0JKgXInc7iQKs+md7UdIEn2Tc=
-----END RSA PRIVATE KEY-----

Sometimes random isn't really random, expect for an awkward name.

  • 2
    // , Actually, it is coded for Linux, too, it just needs to be built, as follows: git clone https://github.com/lachesis/scallion.git cd scallion xbuild scallion.sln – Nathan Basanese Jun 8 '15 at 7:41
  • // , Way to add a cogent example. Care to post a screenshot? – Nathan Basanese Jun 8 '15 at 7:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.