1

I found this on StackOverflow and I found it interesting... If this is possible wouldn't this be so useful to the feds?

It asks can you get the server ip address from a mysql database for a login system, https://stackoverflow.com/q/19338858/2177766

I'm saying that if a hidden service is running say WordPress for an example would it be possible to SQL Inject the MySQL Server into giving you the public IP Address. How badly could this affect your anonymity of your hidden service?

closed as unclear what you're asking by Jens Kubieziel, pabouk, mrphs, weasel - Peter Palfrader, Sam Whited Oct 13 '13 at 18:12

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • I do not get the idea how is the poorly written Stack Overflow question related to cracking hidden services. Could you please explain how would you like to crack a hidden service? I suppose you want to find its IP address. What is the MySQL database you are mentioning? Where is it supposed to run? On the hidden server? How would you access it? Why do you think it will give you an IP address? – pabouk Oct 12 '13 at 22:06
  • I mean if you can exploit the MySQL Software into giving you the real IP Address (it's another user on Stack Overflow me) then you could get the location of a hidden service and DDOS it, right? – Nathan Suchy Oct 13 '13 at 1:04
  • In the comments below the question on Stack Overflow it showed up that the OP just did not know how to connect to the database. He knew the address of the database. In the reply the connection is made to the known IP of local loopback --- localhost 127.0.0.1. It seems that the question was just very confusingly written. – pabouk Oct 13 '13 at 1:41
  • In your question here it is unclear what are you exactly asking. If you do not want your question to be closed please edit it and try to include answers to my questions and/or other information which will make your question more clear. – pabouk Oct 13 '13 at 1:44
  • 1
    A properly configured hidden service won't know any public IP addresses, just its .onion hostname. – mirimir Oct 13 '13 at 2:39
2

Whenever one sets up a hidden service, he/she has to be aware of the configuration of the software he/she uses and if that software is trustworthy or has any known vulnerabilities.

For example Apache's server status can reveal information.

SQL injections can happen on websites that a vulnerable to such attacks and hidden-services are no exception. If any component, an adversary can talk to, either directly or indirectly, knows the hidden-service's IP address it can reveal it, either by sending it over Tor or by bypassing Tor.

Any software in use can have vulnerabilities that could be exploited by someone crack a hidden-service's anonymity.

Not the answer you're looking for? Browse other questions tagged or ask your own question.