Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm looking at the results from the following URL and would like to know how does the TOR website "know" that TOR is being used or not.

https://check.torproject.org/?lang=en-US&small=1&uptodate=1

I would set up a packet sniffer, but since I'm not an exit node I'm not sure if that would make much of a difference.

share|improve this question
    
i don't know if this helps but the exit adresses are here [ check.torproject.org/exit-addresses ](check.torproject.org/exit-addresses) – user157947 Apr 1 at 6:25
    
@user157947, He's asking how does Tor Project know if you're using Tor. – Pacerier yesterday
up vote 19 down vote accepted

In one line: they have a list of all the exit nodes (something like that).

more detailed:

I have seen this post demonstrates how to detect a Tor connection in php

function IsTorExitPoint(){
    if (gethostbyname(ReverseIPOctets($_SERVER['REMOTE_ADDR']).".".$_SERVER['SERVER_PORT'].".".ReverseIPOctets($_SERVER['SERVER_ADDR']).".ip-port.exitlist.torproject.org")=="127.0.0.2") {
        return true;
    } else {
       return false;
    } 
}

function ReverseIPOctets($inputip){
    $ipoc = explode(".",$inputip);
    return $ipoc[3].".".$ipoc[2].".".$ipoc[1].".".$ipoc[0];
}

A good references explain what it does are available here:

Update:

From Tor offical doc that descirbes the TorDNSEL method that mitigates the drawbacks of the old method of testing exitnodes ip list:

It is useful for a variety of reasons to determine if a connection is coming from a Tor node. Early attempts to determine if a given IP address was a Tor exit used the directory to match IP addresses and exit policies. This approach had a number of drawbacks, including false negatives when a Tor router exits traffic from a different IP address than its OR port listens on. The ​Tor DNS-based Exit List was designed to overcome these problems and provide a simple interface for answering the question: is this a Tor exit?

In ruby you have there is a cool Tor.rb gem that implements this technique:

Tor::DNSEL.include?("208.75.57.100")               #=> true
Tor::DNSEL.include?("1.2.3.4")                     #=> false
share|improve this answer
3  
Could you update your php function to support IPv6? – matt Dec 22 '14 at 12:54
    
If you are not using Tor AND are not running a Tor exit node, it knows you are not using Tor. If your traffic comes from an exit node, it doesn't know whether you are using Tor or not. – WGroleau Dec 5 '15 at 0:09
    
Does this work for all addresses in the Tor Network? Is it possible for someone to "avoid detection" by Tor? – Pacerier yesterday
    
@Pacerier I believe that everything's possible :) – 0x90 yesterday

They know what are the TOR exit nodes addresses. So they just check your address and see if it matches with one of the exit nodes.

Exit nodes are known to the whole TOR network, if you decide to run one exit node, then you should advertise it right? Or else no one will use it. Then people will know your IP is a ToR exit node. Simple.

share|improve this answer
4  
You have to advertise your Tor relay IP address, but Tor users have no need to know your exit IP address. – curiousguy Jun 17 '12 at 21:46
    
@Aki What about NAT'ed addresses? Or can TOR exit nodes not be NAT'ed? – Eugene Beresovsky Oct 24 '12 at 4:47
1  
Yup I just tried this: When running an exit node myself, I can go to check.torproject.org in any unconfigured browser and it will happily report I'm using Tor. – Luc Aug 15 '13 at 23:24
    
@Aki, When you say "Exit nodes are known to the whole TOR network", do you mean that it is technically impossible for a node to avoid detection by Tor Project's IP listing? – Pacerier yesterday

You can check if a connection is a tor exit point by using TorDNSEL; Thus a script can be coded to check every connection.

"TorDNSEL is an implementation of the active testing, DNS-based exit list for Tor exit nodes. "

share|improve this answer
1  
Can you translate the implementation notes in the TorDNSEL README file? "TorDNSEL can perform active exit testing by launching an HTTP request to itself through every exit node with a suitable exit policy. This allows it to detect exit nodes configured to send outbound connections through a different IP address from the one they advertise in their descriptors. When configured to run exit tests, it tests through a particular exit node each time the node publishes a new descriptor. All running nodes are tested periodically between descriptor uploads." – logicalscope Mar 4 '12 at 6:24
    
@logicalscope - Well yes, it makes sense. TorDNSEL, being a TOR node itself (part of TOR network), issues a HTTP request to other available TOR nodes that targets it's public IP HTTP server. Exit nodes accept this request as outbound traffic, forward it on TorDNSEL's behalf, and all TorDNSEL needs to do is collect IPs that forwarded that request. The list it ends up with is public IPs of current TOR exit nodes. – TildalWave Jan 30 '13 at 2:30
    
@TildalWave, I don't get why this method is foolproof. Why must Exit nodes forward the request? Can't they be modified to ignore it? – Pacerier yesterday

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.