Can the attacker's malicious node see the full link of .onion sites users have access to?

Question

If we talk about .onion sites only, can the bad nodes see the part of site's link? Like "example.onion/" or full link like "example.onion/user404/data/page/example123.txt"?

I don't talk about IP of site, cause I know that find IP itself is very difficult for attackers.

In Tor documentation indicated, .onion traffic always stays inside the Tor network and protected from attackers. But I still have some doubts about it. So, if 2 nodes like bridge and exit are bad, .onion V2/V3 user /user404/ is theoretically de-anonymised, right?

Answer 1

Let's say a bad node is actively scanning sites. If you have a link to example.onion/user404/data/page/example123.txt then yes they can see that because you linked to it. Also, if you turn on directory browsing in your web server and the node sees example.onion/user404 and can browse into those files and subdirectories then yes they could see that.

If you don't link to a file and you don't have a way to browse to a file, then it's very unlikely that someone will find that file.

This all comes down to your responsibility to harden your web server and if you are using a CMS, make sure you keep it patched and follow all security guidelines.

One more thing, and I will use Wordpress as an example because I know it best. I know that somewhere there is probably a example.onion/wp-admin page. I also know that there is a wp-content directory and a wp-config directory, etc. and if you haven't set up your security sufficiently these are all places where I can try to hack you and steal your data. This really has nothing to do with an onion service, but all about being a good webserver admin.

Answer 2

Usually - no, but in rare insecure cases - yes. The service hardening is basically the service owner's sole task. For Tor the website, SSH, VPN or anything else is basically a tunnel. So - use latest TLS and if you need more security - a client and server certificates served separately and off the Tor network: EmerCoin is a great alternative to do so easily, but it can be done in a numerous ways.