I was wondering if it is possible to find the IPs of introduction points used by a hidden service. Specifically I was looking at facebook's hidden service.
You can find these in the service's hidden service descriptor document. Tor clients download these documents when a user wants to connect to a specific onion service, but you can also download these manually using the
HSFETCH command with Tor's control port. The Stem library provides a Python interface to do this, but claims that only v2 services are supported (I'm not sure if the documentation is just out of date). After sending this
HSFETCH command, tor will return a
HS_DESC_CONTENT event containing the introduction points.