4

Having seen Tor via Python - can the real IP address leak? I am no longer sure whether or not using

curl -L --insecure -C - --socks5 localhost:9150 -H "User-Agent: " check.torproject.org

is as secure as the python version in the linked post

where
-L is to follow redirects
--insecure is to allow "invalid" HTTPS certificates
-C - is to continue downloading from where it left off (in case the download breaks)
--socks5 localhost:9150 is where the Tor service is running (default port)
-H "User-Agent: " is set the user-agent string to {blank}
check.torproject.org is the page to download

The IP contained in the response is that of the exit node, but I do not know whether or not rdns (reverse DNS? - mentioned in linked post) is relevant to curl

The question is: Is the command above as secure as that in the linked post?

|improve this question
7

--socks5 will use the SOCKS5 protocol for the HTTP connections but the name lookup will still be done using the normal DNS which means that your public IP address can be seen by the external name server you use. To do name lookup through the proxy too you need to use --socks5-hostname option.

From the documentation of curl

--socks5
Use the specified SOCKS5 proxy - but resolve the host name locally.

--socks5-hostname
Use the specified SOCKS5 proxy (and let the proxy resolve the host name)

|improve this answer
  • 2
    So I should use --socks5-hostname localhost:9150 instead? – FtDUh7dGg8 Jul 3 '17 at 18:19
  • @FtDUh7dGg8: exactly – Steffen Ullrich Jul 3 '17 at 18:21
  • Do you know if there is any simple way to check if it is actually letting the proxy resolve the host name on a Linux-based OS? – FtDUh7dGg8 Jul 3 '17 at 18:25
  • 1
    @FtDUh7dGg8: For one *.onion domains should only be resolvable through the proxy. Also, you could use a DNS leak test. Or you could use a packet sniffer like tcpdump and watch for DNS queries. – Steffen Ullrich Jul 3 '17 at 18:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.