Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am a newbie to the field of security. As I was trying to explore more about HTTP request and response headers, I came across this website which provides a detailed analysis of the request header that is sent by our system to its server. According to the website, by examining the Via or X-Forwarded-For header, one can conclude whether the client is using a proxy or not. When I visited the website without using any proxy, it showed both of these headers as not present (which was expected). But, when I visited this website again, this time using the Tor Browser, still the two headers were not present! No sign of proxy at all.

I have a very vague idea about the working of Tor, but I am not sure why the headers are unable to detect the proxy when using the Tor Browser! Can anyone explain the reason for the same in layman's terms? Also, if Tor offers this level of anonymity, is there any other way to detect a Tor proxy?

share|improve this question
1  
for a discussion on how tor works you may want to see security.stackexchange.com/q/36571/21234 –  Shurmajee Jul 6 '13 at 11:35
    
Thanks @MayankSharma –  Rahil Arora Jul 6 '13 at 12:26
3  
@qbi - I appreciate the edit to change "TOR" with "Tor", but to be fair it used to be written as an acronym TOR of The Onion Router, however, according to Wiki: "...the current project no longer considers the name to be an acronym, and therefore does not use capital letters". Just thought to mention this, as I couldn't comment on your suggested edit I was approving (only possible on rejection). We see the old acronym still being used by many. ;) –  Noordung Jul 7 '13 at 20:21
    
Well, the FAQ entry makes it perfectly clear: »Tor is not spelled "TOR".« –  qbi Jul 7 '13 at 22:18
    
Yeah. It's clear now. Thanks! Man, there's a lot more out there to learn about Tor. :P –  Rahil Arora Jul 7 '13 at 23:09

3 Answers 3

up vote 6 down vote accepted

Tor simply repeats requests as an anonymous transparent HTTP proxy, meaning it does not attach typical proxy headers (such as Via or X-Forwarded-For), or in any other way modify HTTP requests or responses (besides being "onion routed, encrypted and decrypted" through the Tor network).

As for identifying clients connecting through Tor network, the easiest to detect such clients on the web server end is to query the public TorDNSEL service that publishes Tor exit nodes:

TorDNSEL is an active testing, DNS-based list of Tor exit nodes. Since Tor supports exit policies, a network service's Tor exit list is a function of its IP address and port. Unlike with traditional DNSxLs, services need to provide that information in their queries.

Previous DNSELs scraped Tor's network directory for exit node IP addresses, but this method fails to list nodes that don't advertise their exit address in the directory. TorDNSEL actively tests through these nodes to provide a more accurate list.

This TorDNSEL querying can be automated e.g. in your web application, and example code in many programming languages can be found on the Internet. For example, here is some sample code demonstrating how to do that in PHP.

If you're going to implement this Tor checking in your web application, then I recommend you cache query results locally for some time it's reasonable to expect the exit nodes didn't change in the meantime, not to constantly repeat same queries and add an additional lag to your responses.


Edit to add: One more way to optimize this Tor exit node querying and avoid using TorDNSEL all the time is to do a reverse DNS lookup beforehand, and try and match it against a list of major known Tor exit node hosts. This can be actually quite effective, as a lot of major exit node hosts never change and they can operate a large number of exit nodes all using same or similar rDNS names. For example, you could try matching rDNS names to your list using regular expressions, LIKE SQL operator, or similar. Some of the known Tor exit node hosts (real examples) will match these names:

tor[0-9].*
tor-exit*
*.torservers.*
*.torland.is

This is the list that I'm using. As you see, it's far from being complete, but it is a start and you can always add more entries as you detect them to follow an easily matched pattern. As it is meant to merely optimize querying, it doesn't really need to be complete, but each match will most certainly speed things up. Hope this helps!

share|improve this answer
    
If the exit nodes don't change and are well known, how long until web services which choose to block proxies (for legal or whatever reasons) start blocking Tor traffic? I was under the impression Tor usage didn't advertised itself so blatantly... –  Gaia Oct 3 '13 at 3:16
1  
@Gaia - Tough to judge, since they do change, but majority of traffic actually goes through large hosts that might use clearly identifiable DNS names, like in those few examples listed. It would depend greatly on the ability of individual services to query TorDNSEL, but my guess would be you can filter out roughly 3/4 of Tor clients cheaply by doing faster rDNS lookups, and the rest then through querying TorDNSEL. Implementations will vary in effectiveness and reaction time, though. It is however possible to do it real-time, with some smart local caching in place. –  Noordung Oct 3 '13 at 3:31

The X-Foreward-For-header is sent optionally (and purposefully) by proxies. If a proxy tries to hide the identity of its user, it won't sent this header.

The Onion Network is specifically designed for the purpose of keeping the users identity hidden. It will never reveal the IP address or any other data that could show the users identity.

share|improve this answer

A small note here:

While going through the Wikipedia article on Proxy Servers, I found out that even if the proxy servers are not using the header lines such as HTTP_VIA, HTTP_X_FORWARDED_FOR, or HTTP_FORWARDED, it is still possible for a website to suspect a proxy if the packets sent by the client include a cookie from a previous visit that did not use the high-anonymity proxy server.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.