Discovering hidden services with OSINT tools

Discovering hidden services (onion services) on the Tor network involves using Open Source Intelligence (OSINT) tools and techniques. Keep in mind that accessing and interacting with hidden services must be done with caution and in compliance with legal and ethical standards. Here’s a general guide on using OSINT tools for discovering hidden services:

1. Start with Search Engines:
   • Use specialized search engines that index content on the Tor network. Examples include:
     • notEvil
     • Ahmia
   • Perform searches to find relevant onion links.
2. Use Tor Directories:
   • Explore Tor directories that categorize and list various hidden services.
     • The Hidden Wiki
     • Daniel’s Onion Link List
   • These directories can provide links to a wide range of hidden services.
3. OSINT Tools:
   • Leverage OSINT tools that focus on discovering hidden services.
     • OnionScan: A tool designed to identify and analyze the metadata of Tor hidden services. It can provide information about the security and anonymity of a site.
     • Scallion: A tool for generating vanity .onion addresses (customized onion addresses).
4. Explore Forums and Communities:
   • Participate in Tor-related forums and communities where users may share information about hidden services.
     • Reddit /r/onions
     • Tor Forum
5. Investigate Pastebin and Similar Platforms:
   • Check platforms like Pastebin for any leaked or shared onion links.
     • Pastebin
6. Use Tor Browser and Dark Web Search Engines:
   • Navigate the Tor network using the Tor Browser and explore dark web search engines.
     • DuckDuckGo on Tor
     • Torch
   • Manually searching and browsing may reveal hidden services.
7. Monitor Social Media and Forums:
   • Keep an eye on social media platforms and forums where users may share onion links or discuss hidden services.
8. GitHub Repositories:
   • Explore GitHub repositories that focus on collecting and sharing information about hidden services.

Remember to exercise caution and ensure that your activities comply with legal and ethical standards. Accessing certain content on the Tor network may be illegal, and privacy and security precautions should be taken seriously. Additionally, always respect the privacy and anonymity of users on the Tor network.

Inspecting onion address with onioff

Onioff is a tool designed for inspecting and analyzing .onion addresses (Tor hidden services). It helps in gathering information about onion services by extracting data from their web pages and providing insights into their structure.

1. Install Onioff:

git clone https://github.com/k4m4/onioff.git
cd onioff
sudo pip3 install -r requirements.txt

2. Inspect an Onion Address:

python3 onioff.py -u http://example.onion

3. Explore Onioff Options:

To get information without screenshots:

bash python3 onioff.py -u http://example.onion -n

To get screenshots of the onion service:

python3 onioff.py -u http://example.onion -s

4. Interpret Results:

• Review the information provided by Onioff, including the title, IP address, server type, headers, and any captured screenshots.

5. Review Output:

• After running Onioff, examine the generated output to gain insights into the structure and potential characteristics of the inspected onion service.

Always use tools responsibly and in accordance with legal and ethical standards. Additionally, be mindful of the privacy and anonymity of users on the Tor network.

OnionScan is a security tool designed for investigating and analyzing the security and anonymity of Tor hidden services (onion services) on the deep web. It is often used by researchers, security professionals, and individuals interested in understanding the characteristics of onion services. Here’s a brief guide on using OnionScan as a research tool:

Using OnionScan for Deep Web Research

1. Installation:

• Clone the OnionScan repository and install the required dependencies:

git clone https://github.com/s-rah/onionscan
cd onionscan
go get .

2. Running OnionScan:

• Run OnionScan against a specific onion service. Replace example.onion with the actual onion address you want to analyze: ./onionscan --webport 8080 example.onion
• The --webport option specifies the port where OnionScan will host its web interface.

3. Web Interface:

• Open a web browser and navigate to http://localhost:8080 (or the specified port) to access the OnionScan web interface.

4. Reviewing Results:

• The web interface provides detailed information about the analyzed onion service, including security-related details.
• Explore the various tabs and sections to view information such as HTTP headers, SSL certificate details, security headers, and potential vulnerabilities.

5. Command-Line Output:

• OnionScan also provides command-line output with detailed information about the onion service. Review the terminal output for additional insights.

6. Interpreting Results:

• Understand the implications of the results. OnionScan can reveal potential security issues, misconfigurations, or information that may impact the anonymity of the onion service.

7. Considerations:

• Keep in mind that OnionScan is a tool for security assessment and research, and it should be used responsibly and ethically.
• Respect the privacy and anonymity of onion service operators.
• Regularly check for updates to OnionScan, as the tool may receive improvements and new features.

Important Note:

OnionScan and similar tools should be used in compliance with legal and ethical standards. Unauthorized scanning or probing of onion services may be against the law or violate the terms of service of the Tor network. Always ensure that your research activities are conducted responsibly and with respect for privacy and security.

Additional resources for researchers who are interested in using OnionScan:

• OnionScan GitHub repository: https://github.com/s-rah/onionscan
• OnionScan documentation: https://docs.rs/
• OnionScan paper: https://arxiv.org/abs/2206.10469

If you’re interested in using Docker to run nmap on the Tor network (onion services), you can achieve this by leveraging the onion-nmap project. This project integrates nmap with Tor, allowing you to scan onion services anonymously. Here’s a guide on how to use Docker with onion-nmap:

Using Docker with onion-nmap

Onion-nmap is a tool that allows you to scan onion services on the Tor network. It is a wrapper around the Nmap tool, which is a popular network scanner.

You can use Docker to run onion-nmap by following these steps:

Prerequisites:

• Docker installed on your system
• A Tor client installed and running on your system

Clone onion-nmap Repository:

git clone https://github.com/ReFirmLabs/onion-nmap.git

Build Docker Image:

cd onion-nmap
docker build -t onion-nmap .

Steps:

1. Pull the onion-nmap Docker image:

docker pull milesrichardson/docker-onion-nmap

2. Run the onion-nmap Docker image:

docker run -it milesrichardson/docker-onion-nmap [options] <onion address>

Options:

• -i: Interactive mode
• -t: Allocate a pseudo-TTY
• : The onion address of the service you want to scan

For example, to scan the onion address of the Hidden Wiki:

docker run --rm -it onion-nmap -p 80,443 example.onion

The --rm flag removes the container after it exits, and -it allows interactive mode.

This will scan the Hidden Wiki for open ports and services. The results of the scan will be displayed in the terminal window.

You can also use Docker Compose to define and run multiple Docker containers. This can be useful for running onion-nmap in conjunction with other tools, such as a web server or a database.

Docker Compose file for running onion-nmap and a web server:

version: "3"

services:
  onion-nmap:
    image: milesrichardson/docker-onion-nmap
    volumes:
      - ./data:/data
    environment:
      - TOR_SOCKS_PROXY=localhost:9050

  web:
    image: nginx:alpine
    ports:
      - "80:80"
    volumes:
      - ./data:/data

This Docker Compose file will create two containers. The first container is the onion-nmap container. The second container is the web server container. The volumes directive is used to mount the ./data directory from the host machine into the containers. This allows the containers to share data. The environment directive is used to set the TOR_SOCKS_PROXY environment variable to localhost:9050. This tells the onion-nmap container to use the Tor Socks proxy on port 9050.

To run this Docker Compose file, execute the following command:

docker-compose up -d

This will start the onion-nmap and web server containers in the background. You can then access the web server at http://localhost.

Using Docker with onion-nmap can be a great way to run onion-nmap in a safe and isolated environment. It can also be useful for running onion-nmap in conjunction with other tools.