- tor-onions - lists.torproject.org

Dark Web OSINT With Python and OnionScan: Part One
by Muri Nicanor 29 Jul '16

29 Jul '16

FYI: someone scanned around 8000 onion services with onionscan and published the results: http://www.automatingosint.com/blog/2016/07/dark-web-osint-with-python-and-… cheers, -- muri

2 1

Hidden Service "Generic SOCKS Error"
by Darcy Marshall 22 Jul '16

22 Jul '16

I recently set up a hidden service. The address for this hidden service is spydaroo7gtsipwm.onion. When I first start Tor on the server, it will work fine. Then after a while, maybe after a few visits or a few hours, it stops working. Both apache2 and Tor continue to run, but Tor Browser just acts as though it doesn't exist (cannot connect). Logs show errors of "general socks error". Tor2web services like onion.to also stop working and give generic SOCKS error. The way to fix this is to restart Tor on the server. It then works, but eventually will return to having a socks error. Does anyone know a reason for why this is happening or how to fix it? — Spydar007 http://spydar007.com PGP Key ID: D3364A0B

4 4

hiddenserviceauthorizeclient stealth vs basic techinal details
by Joy 19 Jul '16

19 Jul '16

Hey everyone, The Tor manual has some basic information about the difference between the stealth and basic authorization options, but can anyone point me to the actual technical differences between these options? What exactly does the stealth mode do to hide service activity from unauthorized clients and why is this less scalable? Thanks, Joy

2 1

Automatically redirecting to hidden service
by laethust＠nonkly.com 08 Jul '16

08 Jul '16

Are there any security risks in using PHP to automatically redirect a user to the hidden service URL of your site? So if someone went to my site, example.com, using the Tor Browser, I would automatically redirect them to the onion address for example.com.

1 0

Re: [tor-onions] tor-onions Digest, Vol 7, Issue 2
by Kevin Froman 04 Jul '16

04 Jul '16

You could use Whonix as well. (Not supported or created by the Tor Project) https://whonix.org/ There is still opportunity for info leakage, so its best to not store identifying info inside the workstation if you are running a hidden service. You can also set Tor-level cookie authentication if your service is private. See the Tor manual for that. On Jul 4, 2016 7:00 AM, <tor-onions-request(a)lists.torproject.org> wrote: Send tor-onions mailing list submissions to tor-onions(a)lists.torproject.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-onions or, via email, send a message with subject or body 'help' to tor-onions-request(a)lists.torproject.org You can reach the person managing the list at tor-onions-owner(a)lists.torproject.org When replying, please edit your Subject line so it is more specific than "Re: Contents of tor-onions digest..." Today's Topics: 1. Re: Hidden Service IP Addresses (ncl(a)cock.li) ---------------------------------------------------------------------- Message: 1 Date: Sun, 3 Jul 2016 19:47:28 +0000 From: "ncl(a)cock.li" <ncl(a)cock.li> To: tor-onions(a)lists.torproject.org Subject: Re: [tor-onions] Hidden Service IP Addresses Message-ID: <57796BD0.6000002(a)cock.li> Content-Type: text/plain; charset=utf-8 Flipchan: > Most Common is that an attacker gets root access or finds an rce bug > on ur system and useage that to login to ur sys and by that gettin > the ip,u can ofc run the site with a usr account and proxy all > connections through tor with ip tables What ------------------------------ Subject: Digest Footer _______________________________________________ tor-onions mailing list tor-onions(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-onions ------------------------------ End of tor-onions Digest, Vol 7, Issue 2 ****************************************

1 0

Hidden Service IP Addresses
by phiaslai＠nonkly.com 03 Jul '16

03 Jul '16

Can a hidden service expose it's IP address? Can I run a hidden service from a server that has DNS pointing to it for a domain? Can I run a hidden service from the same server as a tor relay (which openly exposes the IP address)?

7 7

Criteria for intro point, rendezvous point selection?
by Paul Syverson 18 Jun '16

18 Jun '16

We were trying to figure out some criteria for selecting intro points and rendezous points as well as circuits to connect to them and had some questions we couldn't determine from our poking around for answers. Does anyone know for current stable code (and, e.g., post 224 etc. if any of this is expected to change) the following? Are guards ever selected for intro points? Are exits ever selected for intro points? Are guards ever selected for rendezous points? Are exits ever selected for rendezvous points? Are client circuits to intro points selected from prebuilt circuits? If so, is the third hop an exit relay? Or is a prebuilt circuit cannibalized in some way to avoid using an exit? Are client circuits to rendezvous points selected from prebuilt circuits? If so, is the third hop an exit relay? Or is a prebuilt circuit cannibalized in some way to avoid using an exit? Fuller answers (e.g., 'Yes. guards can be selected as intro points, but only in accord with their chance of being selected as a middle relay.') and/or where to find these in documentation appreciated. If someone knowledgeable feels this is better directed at tor-dev, please let me know (or simply reply there rather than here). aloha, Paul

2 1

domain socket as HiddenServicePort target -- permissions!?
by Johannes 16 Jun '16

16 Jun '16

Hello gents, I'd like to use a unix domain socket as HiddenServicePort target so I can remove networking capabilities from my hidden service's server process. Tor does not connect to my socket, though. Tor's debug level logging does not show any (comprehensible) errors. This is very frustrating to debug! Because of the documentation of unix domain sockets in *other* parts of Tor, like ControlPort, SocksPort et. al., I suspect it is about permissions. How *exactly* are the requirements of ownership and permissions of the socket and its directory and why? This is totally under-documented! I've tried to look at the sources (https://trac.torproject.org/projects/tor/ticket/11485) but I could not make much sense of it. I've manage to somehow create a socket that worked, but firstly there are so many variables so for the love of gods I was not able reproduce it and secondly as far as I can recall that were perms that required elevated privileges to get them set, which is totally out of the question for production. I'd like to elaborate more on what did work, but I am truly lost! Version: Tor 0.2.7.6 (git-605ae665009853bd) TIA, Johannes

3 5

nunca tube asceso a nada
by jesús gonzález 09 May '16

09 May '16

no tube enlace

2 1

Tor, HS, Library
by cippalippa 08 May '16

08 May '16

Dear folks, we'll have the opportunity to talk and leverage HS/Tor at one of the most ancient University & Library in Europe. We'd propose to start something like "libraryfreedomproject.org" use to do in US but with a special focus on Onion Services. I'd ask to you if you'd share your list of case histories about using Websites & Hidden Services in the Facebook way, bloggers, artists and so on. But by common entity (persons or company), not by crypto movements or real anonymous HS. Cases of websites who think Tor users like an important audience for their contents and/or services. That's why I supposed the ML tor-onions could be the right starting point. I'll appreciate any feedback in contributing sharing cases of HS like these. If you prefer, or don't want to spam the ML, you'd reach me directly. I'll release the case histories list hoping it'd be useful for others too. Just to say, we experimented lots of HS on related projects. By example one on many, last year we shared content data/social mining on HS about the International Festival of Journalism '15. Knowing guest's contents could be censored somewhere. And it happened on the clearnet, mainly by far-east, so this year we opened an HS to permit access to the entire Festival's contents b/c lots more guests were coming from censored countries. Thank you for your time and patience in reading this, [TW] @Gilda35

4 3