1

How do I protect against this vulnerability?

https://mascherari.press/dark-web-diaries-hostname-hacking/

> torify curl -H 'Host: localhost' http://myonionaddress.onion

It reveals another onion hosted on my server. I'm using nginx in Debian/whonix.

0

A simple method, for nginx at least, is to just set the onion services to listen on different addresses in your server stanzas, and likewise configure your torrc to also do that

server {
    servername _; #Default/catch-all server, stock "nginx" index.html
    listen 80;
    #... Config Crap Here ...
}

server {
    servername oniona.onion;
    listen 127.0.0.2;
    #... Config Crap Here ...
}

server {
    servername onionb.onion;
    listen 127.0.0.3;
    #... Config Crap Here ...
}

#... Repeat as required ...

And edit your torrc to reflect this, e.g.

HiddenServiceDir /var/lib/tor/oniona
HiddenServicePort 80 127.0.0.2:80
HiddenServiceDir /var/lib/tor/onionb
HiddenServicePort 80 127.0.0.3:80
# Repeat as required

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.