hope this question has not been asked like this before - I've seen something simillar but could not understand the process. So my question is regarding TOR communication: origin -> destination and destination -> origin.
From what I understand when I as a source (lets say IP ABCDE) send a package to twitter (lets say IP 12345) via the tor network, I connect to an entry point in the tor network. When the package leaves the entry point to some other tor server, the origin of the package (my IP ABCDE) is gone, either decrypted or deleted. The tor nodes only know the target (twitter) and route the package via node connection tables, where only the next and the previous step in the chain are known to one node. Even if that's not fully correct, from my understanding twitter will recieve a package with the content I sent, but from the IP of the tor exit node (lets say IP 67890). At this point twitter has no knowledge of the origin.
Now here is the question - if twitter (or to be more precise, the twitter server that sends the package response) does not know the destination, how does the package end up back in my client browser? At some point in the tor network, the real origin (my IP) has to be stored and if so, at which point is it stored? Because if that is true, when I get access to the entry point and can see all network traffic, it should be possible to identify the origin and target of a package. What part do I not (or not fully) understand, since I must be overlooking something....
I'd be glad about a fairly simple explanation with an example if possible as I'm quite new to the subject (pretty obvious I think).
Edit: I've read this thread, but it does not answer my particular question. Quote:
The webserver sends the packet to the exit node, because the exit node was the computer that connected to the webserver. The exit node uses a table (seems like the NAT table, but with more information) to decide where to send the response. So it will encrypt the packet again, and send it to the next node, which will do the same, until the packet reaches your computer, are decrypted locally, and sent to the application.
Here it's not specified where the original sender of the package (me) is stored and how I am identified within the tor network. I get that the navigation from original tor exit (now entry for twitter) knows how to get back to the initial entry point where I sent my package to. But how does this node know that I am the original sender? And if the entry node has this information, isn't the tor network easily compromised by hacking into the entry node (if it's "labeled" as such)?