Hostname Hacking

Question

How do I protect against this vulnerability?

https://mascherari.press/dark-web-diaries-hostname-hacking/

> torify curl -H 'Host: localhost' http://myonionaddress.onion

It reveals another onion hosted on my server. I'm using nginx in Debian/whonix.

Answer 1

A simple method, for nginx at least, is to just set the onion services to listen on different addresses in your server stanzas, and likewise configure your torrc to also do that

server {
    servername _; #Default/catch-all server, stock "nginx" index.html
    listen 80;
    #... Config Crap Here ...
}

server {
    servername oniona.onion;
    listen 127.0.0.2;
    #... Config Crap Here ...
}

server {
    servername onionb.onion;
    listen 127.0.0.3;
    #... Config Crap Here ...
}

#... Repeat as required ...

And edit your torrc to reflect this, e.g.

HiddenServiceDir /var/lib/tor/oniona
HiddenServicePort 80 127.0.0.2:80
HiddenServiceDir /var/lib/tor/onionb
HiddenServicePort 80 127.0.0.3:80
# Repeat as required