1

Say there's a tor site running on 5.4.3.2:443. As an outsider, would I be able to visit 5.4.3.2:443 in my normal browser and see the tor service? Or would I still need it's onion address in a tor browser? If I can't visit 5.4.3.2:443 directly in a normal browser, why is that?

If I suspect that an IP is running various services such as ssh through tor, would I be able to tell? Are there any useful tor enumeration tools other than tortazo?

I'm sorry, I'm still a huge noob in this area -.- Thank you so much!!

Improve this question

1 Answer 1

Reset to default
2

Yes, if it's listening on an external interface then you would be able to visit the IP and talk to the service.

For this reason, you should make services you wish to be anonymous bind to the local loopback interface, or a unix socket to avoid them being deanonymized by attackers running zmap/masscan.

If some client or server is running some service over Tor and has configured them properly then you wouldn't be able to tell, as an outside observer. That's the point.

Improve this answer
1
  • Thank you for for answering! I have a couple more questions: if an nmap scan shows that a server is running ssh (or whatever service), is there any enumeration or tip-offs that might tell me it's running through tor? Ex: if I ran ssh2-enum-algos NSE script against ssh/tor would it give me different/unique results than if I ran it against a normal ssh? Not just that NSE script specifically, but any other type of enumeration like that? What kind of misconfigurations could I look for that would give it away? Are there any good resources for tor enumeration?
    – megmay
    Dec 6, 2016 at 21:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .