Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am interested in exploring a bit of the darknet, and I was wondering about the feasibility of running a Tor exit node from behind a local proxy like Burp Suite so that I could ID the destination URLs and look for hidden services, this could let me essentially develop the seed list for a "search engine" for the darknet. The only problem I'm having is that although I can route my own browsing through Burp Suite I can't get the traffic from the node running through it. Any ideas?

Edit: Also of interest is the same question for the general internet. I know there was the case where a guy was questioned for doing it. And disclaimer: I don't want to actually steal people's info or release it, more of a curiosity.

share|improve this question

That's normal since your traffic is already encapsulated with several layers of encryption (a layer per node through which your traffic travels). You can only analyze Tor before the traffic enters the network or you could set up an exit node and find all traffic which is coming out of the Tor network (this would be less valuable in your case).

Have a read at this blog post I wrote a few months ago to see how Tor works.

share|improve this answer
Is this true even if my only goal would be to identify that a hidden service exists? Wouldn't my computer have to know the identity of the service to pass a connection to? I couldn't forward something to Silk Road without knowing that's where it was destined. Since I'm not concerned about the contents, just the destination, shouldn't I be able to make this work? – BSpiros May 6 '13 at 17:47
You would need to know the endpoint the problem is that there are no exit nodes in the tor network and nodes only know the previous and next hop. – Lucas Kauffman May 6 '13 at 17:52
If the layout is like this: User->Node->Node->Me->HiddenService, then I should know the ID of the service, just not the user right? – BSpiros May 6 '13 at 17:57
Nope, that's the whole point of tor, you don't know that. you only know the node which comes before you and the hidden service, but you don't know if there is a service on that machine, all you know is that you are handing of a packet to a nod. – Lucas Kauffman May 6 '13 at 20:07

You aren't understanding the concept of the darnket properly. There is no exit traffic for the darnket (as applied to TOR). All you would see is the encrypted traffic. Analysis of the sites on the general internet being hit through your exit node would be another story.

share|improve this answer
Comment below addresses this answer too. – BSpiros May 6 '13 at 17:48
Also, what would the story be for non-darknet sites? (as a matter of curiosity, question will be amended to ask this as well) – BSpiros May 6 '13 at 18:12

Have a look at this:

Not tried it myself, but it looks like it could be what you want :)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.