Could somebody explain step-by-step?
A good starting point on the entire process is here.
Why nobody can extract all onion domains from Tor network?
The Tor network is deliberately decentralized so that no one has a complete list of the .onion addresses available. A distributed hash table (DHT) is used in the process of connecting a server and client, but it is unlikely to contain a complete list of all hidden services that are available.
Furthermore, assuming you attempted to try random .onion addresses, there is the simple issue of possible number of characters in a .onion. It would be very computationally cumbersome to attempt to simply iterate through all the possible combinations of characters that make up a .onion and reliably verify if a hidden service was available or not -- much like the difficulty of going through every possible IPv4 addresses on the regular internet.
How my browser's Tor instance find my HS's instance, if nobody know
its name? Is there broadcast to all rendezvous? Can it be
eavesdropped?
A distributed hash table (DHT) is used to correlate your hidden service's communications within the Tor network to the clients.
Imagine that you are the client and you want to talk to a hidden service called Walter.
- You learn about a hidden service called Walter. Since the Tor network doesn't keep a centralized list of services, you found out about this hidden service somewhere else (e.g. the regular Internet).
- You connect to the Tor network and ask for a phone book page (DHT) and check to see if there is a hidden service called Walter. There is, so you move on to step 3.
- From the phone book page, you know that the hidden service Walter has a friend (introduction point) named Peter (Walter published this information to the DHT when the hidden service was created).
- You send a message to Peter, asking to speak with the hidden service Walter. Furthermore, you tell Peter you don't wish to talk through him -- you want to go through a random relay (rendezvous point) called Olivia to talk with Walter.
- Peter relays your message to Walter. Walter agrees and sends a message to Olivia saying so. Olivia sends a message to you, the client, saying the hidden service Walter has agreed to speak with you. You and Walter now send all your messages through Olivia.
Rendezvous points are not set, so there is no definitive list of them to broadcast to. I'm not sure what the technical limitations of rendezvous eavesdropping are, but if it were possible to capture .onion addresses handled by a rendezvous point, it would likely take a long time to build up any sort of directory of hidden services since rendezvous points are chosen at random.