|Sarah Jamie Lewis 7068ce8442 Don't Crash When Tor Proxy is Not Up||3 years ago|
|config||3 years ago|
|protocol||3 years ago|
|report||3 years ago|
|scans||3 years ago|
|utils||3 years ago|
|.gitignore||3 years ago|
|LICENSE||4 years ago|
|README.md||3 years ago|
|main.go||3 years ago|
|onionscan.go||3 years ago|
|onionscan.png||4 years ago|
The purpose of this tool is to make you a better onion service provider. You owe it to yourself and your users to ensure that attackers cannot easily exploit and deanonymize.
sudo apt-get install libexif-dev
sudo dnf install libexif-devel
go get github.com/s-rah/onionscan
go install github.com/s-rah/onionscan and then run the program in
Or, you can just do
go run github.com/s-rah/onionscan.go to execute without compiling.
For a simple report detailing the high, medium and low risk areas found:
The most interesting output comes from the verbose option:
./bin/onionscan --verbose blahblahblah.onion
There is also a JSON output, if you want to integrate with something else:
./bin/onionscan --jsonReport blahblahblah.onion
If you would like to use a proxy server listening on something other that
127.0.0.1:9050, then you can use the --torProxyAddress flag:
./bin/onionscan --torProxyAddress=127.0.0.1:9150 blahblahblah.onion
This should not be news, you should not have it enabled. If you do have it enabled, attacks can:
Seriously, don’t even run the tool, go to your site and check if you have
reachable. If you do, turn it off!
Basic web security 101, if you leave directories open then people are going to scan them, and find interesting things - old versions of images, temp files etc.
Many sites use common structures
images/ etc. The tool checks for
common variations, and allows the user to submit others for testing.
Whether you create them yourself or allow users to upload images, you need to ensure the metadata associated with the image is stripped.
Many, many websites still do not properly sanitise image data, leaving themselves or their users at risk of deanonymization.
Sometimes, even without mod_status we can determine if two sites are hosted on the same infrastructure. We can use the following attributes to make this distinction:
/cssor do you use wordpress.