How to Detect Misconfigurations in 'Anonymous' Dark Web Sites with OnionScan « Null Byte :: WonderHowTo

Configuring onion services for the first time can be tricky. A surprising number of system administrators make seemingly trivial mistakes that ultimately lead to catastrophic cases of de-anonymizing supposedlyanonymoussites on the dark web.OnionScanis a tool designed to identify common misconfigurations in onion services and aid us in understanding how to fix them.As security researcher@x0rzdemonstrated in anarticle on securing onion services, websites are often de-anonymized all too easily. He utilized software such ascURL, a command-line tool used for transferring data using various protocols, to collect HTTP response headers for laterShodanqueries.Don't Miss:How to Find Vulnerable Targets Using ShodanAll of the methods x0rz used to de-anonymize the onion services should have been ineffective if basic safeguards were taken by the site owners. System administrators need to take better precautions to prevent their websites from being vulnerable to server fingerprinting and enumeration. And that's where OnionScan comes into play.What Is OnionScan?OnionScan is a free and open-source tool designed for investigating onion services. Its written inGo, a programming language created by Google in 2009. OnionScan's primary goal is to help operators of onion services identify and fix operational security (OPSEC) issues with their services. OnionScan can also be used to help researchers and investigators monitor and track sites on the dark web.The developers of OnionScan aim to make finding vulnerabilities as simple as possible. Not because they agree with the motives of every investigation force in the world, but because they believe that by making these kinds of audits easy, they will create a powerful incentive for new and improved anonymity technologies.Step 1: Installing OnionScanLet's dive in and take a look at how to run OnionScan on aKalibox. You can run this in a virtual machine, on a laptop, or on aRaspberry Pi. Before starting, make sure your system is up to date by typingapt-getupdateinto a terminal window.Don't Miss:How to Install Kali Linux as a Virtual Machine on a MacThen, let's make sure we have Go installed. This dependency is required to install OnionScan, so open a terminal and type the following.sudo apt-get install golangWhen that's done installing, we'll need to clone the OnionScan repository fromthe developer's GitHub page. In the same terminal window, type the following.go get github.com/s-rah/onionscanThen compile it by running this command:go install github.com/s-rah/onionscanChange into the/root/go/bindirectory to by typingcd/root/go/bininto the terminal. Then list the directory contents withls.That's it for installing OnionScan. Simply executing./onionscanfrom the/root/go/bindirectory will invoke the help page and provide all the available options.Step 2: Using OnionScanFor this demo, I'll be anonymizing my Kali box withWhonix. Doing this will route all of my network traffic through theTornetwork. To do this, you can refer to our tutorial linked below.Don't Miss:How to Fully Anonymize Kali with Tor, Whonix & PIA VPNThis is primarily for convenience, as OnionScan only works against onion sites. To use OnionScan, type the command below into a terminal window../onionscan --torProxyAddress=10.152.152.10:9050 youronionservice.onionThe--torProxyAddresspart tells OnionScan to use a proxy, while10.152.152.10:9050is a Tor proxy port in the Whonix gateway. This argument will tell OnionScan to proxy requests through the Whonix gateway.For non-Whonix setups, we would use127.0.0.1:9050as ourtorProxyAddress../onionscan --torProxyAddress=127.0.0.1:9050 youronionservice.onionOnionScan also offers an alternate JSON output format for integration with other applications likeCensysand programming languages such as Python and JavaScript../onionscan --torProxyAddress=10.152.152.10:9050 --jsonReport youronionservice.onion > /path/to/save/destination/filename.jsonStep 3: Protecting Yourself & Your Onion ServicesDid OnionScan report a "High Risk" vulnerability with your onion service? Don't be alarmed. There are steps we can take to resolve these issues. Below, I'll cover how to fix and prevent some of the most common vulnerabilities discovered by OnionScan.1. Apache mod_status LeakThe Apache status module allows a server admin to actively monitor how well their server is performing. An HTML page is presented that provides the current server statistics in an easily readable form. With this information, attackers can:Build a fingerprint of your server, including version information for PHP and other software.Determine client IP addresses if you are co-hosting a clearnet site.Determine your IP address if your setup allows.Determine other sites you are co-hosting.Determine how active your site is.Find secret or hidden areas of your site.By default, this module is enabled and accessed by appending/server-statusto the website URL. This is still one of the biggest issues we find with dark web sites today.How to Fix ThisComment out or completely remove the<Location /server-status>brackets in the status.conf file. Open a terminal and type the command below to access it.nano /etc/apache2/mods-enabled/status.confAfter modifying the status.conf and saving the configuration, restart Apache by typing the command below into a terminal.sudo apachectl restartYou'll notice visiting http://youronionservice.onion/server-status now returns HTTP status code 404. This means you've successfully disabled mod_status.2. Open DirectoriesBy default, appending a trailing slash to a URL will instruct Apache to return the contents of a given directory. For example, I added a/hidden_folder/to my website. The image below shows the directory structure of my website.In the /images directory, we can see the hidden_folder, which would not normally be discovered by an attacker. With directories openly accessible, visiting http://youronionservice.onion/uploads/images/ will disclose the contents of the entire directory. The image below is an example of that.OnionScan will list every directory it was able to access. The image below is an example of OnionScan reporting open directories.How to Fix ThisWe'll need to modify theapache2.conf. Open a terminal and type the following command.nano /etc/apache2/apache2.confFind the<Directory /var/www/>brackets. Notice theIndexesbetween Options and FollowSymLinks. Here is how the brackets look by default:<Directory /var/www/>OptionsIndexesFollowSymLinksAllowOverride NoneRequire all granted</Directory>RemoveIndexesentirely, and it should look like this when we're done:<Directory /var/www/>Options FollowSymLinksAllowOverride NoneRequire all granted</Directory>Save and close the file, then restart Apache by typing the following command into a terminal.sudo apachectl restart3. EXIF TagsEXIF stands forExchangeableImageFile and is stored in JPEG, PNG, and PDF file types. This embedded data can sometimes reveal interesting information, including timestamps, device information, and GPS coordinates. Most websites still do not properly sanitize EXIF data from images, leaving themselves or their users at risk of de-anonymization.A perfect example of the dangers of EXIF data is the arrest ofHiginio Ochoa. FBI agents extrapolated his girlfriend's geographic location using the GPS data found in a photo Higinio uploaded to Twitter.OnionScan will list every photo which may contain sensitive EXIF metadata. The following screenshot is an example of OnionScan reporting harmful EXIF metadata discovered in JPGs found on an onion website.How to Fix ThisWe need to manually remove EXIF metadata from our images. Below are several recommended metadata wiping tools.ExifTool, a Perl application for editing metadata in a wide variety of files.Exiv2, a C++ application to manage image metadata.Jhead, a JPEG header manipulation tool.Pdfparanoia, a tool to remove watermark from academic papers.I'll be usingMAT(Metadata Anonymization Toolkit), a command-line tool used to remove metadata from images, which can be found in most popularLinuxdistribution repositories. To install MAT, open a terminal and type the command below.sudo apt-get install matAfter MAT is installed, we can display harmful EXIF metadata by typing the following command into a terminal.mat -d image.jpgThe-dwill instruct MAT to list all harmful metadata of a file without removing it. This is useful for viewing EXIF metadata without wiping it. To completely remove all the EXIF metadata, type the following command.mat image.jpg4. SSH, FTP & SMTPOnionScan collects SSH public key fingerprints, SMTP banners, and other FTP, IRC, Ricochet, and MongoDB server information. These banners are often misconfigured to reveal information about the target server, including OS versions, hostnames, and IP addresses. This information can be compared to other onion and clearnet servers in order to try and identify the actual server location.This image is an example of OnionScan revealing SSH and SMTP banners:How to Fix ThisBy default, SSH will try to listen on 0.0.0.0. This means your SSH server will attempt to broadcast on every interface, making your SSH server accessible to search engines like Shodan. Modify the SSH config file by typing the following command into a terminal.nano /etc/ssh/sshd_configNotice the "ListenAddress" line is set to0.0.0.0.ListenAddress 0.0.0.0ListenAddress ::We'll need to modify that to127.0.0.1so it looks like the following text.ListenAddress 127.0.0.1#ListenAddress 0.0.0.0#ListenAddress ::Save and close the sshd_config file, then restart your SSH server by typing the following command into a terminal.sudo systemctl restart ssh5. Cryptocurrency ClientsOnionScan scans for common cryptocurrency clients including Bitcoin and Litecoin. From these, it extracts other connected onion services as well as the user agent.How to Fix ThisIf it's not absolutely necessary, don't publicly share currency information on your websites. Unfortunately, there's not much we can do to "fix" website scanners and crawlers from collecting your cryptocurrency addresses.Looking Deeper into the Dark WebOnionScan is a powerful tool. The image below is a graphical representationthe developers created using OnionScanwhich depicts connections made between a vast majority of sites on the dark web. These connections were established using Bitcoin addresses, Apache mod_status leaks, SSH fingerprints, and other types of identifiers.Image by OnionScan/Mascherari PressWhile many people may think dark web sites are anonymous by design, the reality is that they require attention like any other site to truly protect the identity of the administrator. Here, we've covered the common ways the owner of an onion service can improve their security, as the most useful methods for de-anonymizing a poorly configured onion service.I hope that you enjoyed this OnionScan tutorial. If you have any questions, feel free to leave a comment below.Don't Miss:Host Your Own Tor Hidden Service with a Custom Onion AddressFollow Null Byte onTwitter,Flipboard, andYouTubeFollow WonderHowTo onFacebook,Twitter,Pinterest, andFlipboardWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image viaWallup.net; Screenshots by tokyoneon/Null ByteRelatedHow To:Use export plug-ins in ApertureDark Side of the Prism:Get Alerted Whenever You Visit a Website Owned by a PRISM-Targeted CompanyHow To:Access the Dark Web While Staying Anonymous with TorHow To:Stay Anonymous on Your Nexus 7Android for Hackers:How to Scan Websites for Vulnerabilities Using an Android Phone Without RootHow To:Become Anonymous & Browse the Internet SafelySpraffl:A New Location-Based Social Network That's Completely AnonymousTypoGuy Explaining Anonymity:Who Is Anonymous?Advanced Nmap:Top 5 Intrusive Nmap Scripts Hackers & Pentesters Should KnowSPLOIT:How to Make a Proxy Server in PythonHow To:Enable Dark Mode in Google Maps on iPhone & AndroidHow To:Perform Directory Traversal & Extract Sensitive InformationAnonymous Texting 101:How to Block Your Cell Phone Number While Sending Text MessagesHow To:Stay as Anonymous as Possible OnlineHow To:Who Is Anonymous? How the Wall Street Journal and the NSA Got It WrongHow To:Chain Proxies to Mask Your IP Address and Remain Anonymous on the WebNews:Anonymous Hackers Replace Police Supplier Website With ‘Tribute to Jeremy HammHow To:Use I2P to Host and Share Your Secret Goods on the Dark Web—AnonymouslyNews:FBI holds teleconference regarding Anonymous - but they were listening!Lockdown:The InfoSecurity Guide to Securing Your Computer, Part IINews:AnonymousNews:The Basics Of Website MarketingNews:Anonymity, Darknets and Staying Out of Federal Custody, Part One: Deep WebHow To:How Hackers Steal Your Cash on Trusted Sites & How to Prevent Against ItHow To:Search for Google+ Posts & Profiles with GoogleIPsec Tools of the Trade:Don't Bring a Knife to a GunfightNews:MegaUpload goes down - Anon retaliates.How To:Detect hackers on your network with EttercapDon't Get Doxed:5 Steps to Protecting Your Private Information on the WebNews:The Dark KnightNews:VMware source code leaked by Anonymous under the banner of The Pirate BayNews:Symantec Source Code Released by Anon After Failed NegotiationsNews:Call to Webmasters EverywhereNews:Side by Side of Arri's Alexa and RED's Mysterium XEditor Picks:The Top 10 Secret Resources Hiding in the Tor NetworkNews:IGNNews:Anonymity, Darknets and Staying Out of Federal Custody, Part Three: Hidden ServicesNews:3 Unique Alternative Web Browsers for Your iOS DeviceNews:Indie and Mainstream Online Games Shut Down by LulzSecNews:Dark Souls - Mørke Sjeler