So the TOR works basically by sending a encrypted packet across multiple computers. The packet is encrypted such that only the first computer on the relay knows the user's IP, and the last computer knows the destination IP (i.e the requested website).

Would it be possible to find the IP of .onion websites by intercepting the packets at the end node?( Its possible to see the first destination from the packets being sent out by the computer) And since the TOR Browser is F.O.S.S, could it be possible to configure TOR to use 3 local servers to act as relay nodes, and intercept the packets sent to the last one, thus exposing the destination IP?

  • No. I'm not sure of exactly what you're asking but I'm pretty sure the answer is no. If this was possible .onion would be very, very broken and it's not (it's not perfect but it's not broken certainly not in the way you're suggesting). Please clarify your question. Also cite where you read that Tor works like this, I'm curious.
    – cacahuatl
    Commented Aug 6, 2016 at 23:22
  • If I understand the Tor network correctly, the last computer (exit relay) doesn't know the source of the traffic. It should only know the content being sent through it, and the middle relay that sent it. Otherwise this would be a HUGE security flaw. Commented Aug 6, 2016 at 23:55

2 Answers 2


The details of how exactly hidden services work are a bit complicated, but the important part for this question is that both the client and the server build their own 3-node circuit to a meeting point in the middle. Thus, even if you altered your client code to connect to a known compromised exit node, the only thing that node knows is the "exit node" of the server's connection. Under the same principles that normally protect websites from reversing the circuit to know who you are, you similarly cannot reverse that circuit to know who the hidden service is.

The most dangerous node for a hidden service is its guard node, which is why the tor project made it harder to become one after the CMU attack was made public.


There is an attack called end-to-end confirmation attack. The idea is very simple. An attack tries to get into the both ends of the communication channel. There the attacker tries to find a pattern on outgoing and incoming traffic. Amount of data generated and the timings between them are observed for this purpose.

Tor website explains it this way:

Suppose the attacker controls, or can observe, C relays. Suppose there is N relays total. If you select new entry and exit relays each time you use the network, the attacker will be able to correlate all traffic you send with probability around (c/n)2.

If your entry guard node is an attacker and he controls or watches the website you visit; in that case, you can easily implement this attack.
Link to a very good blog on this topic.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .