9

I'd like to find out the IP address of a given .onion address.

Is it possible for me to simply assign an exit node (that I control) to my client and just monitor it to determine what IP address that exit node uses?

  • If no, what are other solutions in determining what the IP address of the .onion is?

  • If none of this is possible, why is that?

Improve this question
4
  • A TOR hidden service sits behind multiple relays, just like a client is behind multiple relays. It's similarly difficult to find its IP. You'd essentially learn only the service's exit node's IP, not it's real IP. (There are some subtleties and the terminology is a bit different for hidden services, but this should capture the basic idea)
    – CodesInChaos
    Jun 29, 2013 at 19:24
  • 1
    @CodesInChaos So there is an exit node defined for my client, and the HSP adds additional hops to my exit node?
    – makerofthings7
    Jun 29, 2013 at 19:38
  • 1
    Both sides have their own circuit with several hops which they chose themselves, and the two exit nodes (one chosen by client, one by server) talk to each other. (Though they're not called exit-nodes and behave slightly differently from that)
    – CodesInChaos
    Jun 29, 2013 at 20:10
  • If you could get the IP address of a Tor hidden service there would be no point in having a Tor hidden service.
    – user253751
    Nov 20, 2018 at 21:23

1 Answer 1

Reset to default
15

It is not possible to get the IP address of a Tor hidden service.

For a normal Tor circuit, the client knows the IP of the server, but the server does not know the IP of the client.

The idea behind hidden services is that when both a client and a server are Tor-enabled, it's possible to build Tor circuits in both directions and hide both the client and server IP (by using intermediate nodes).

The protocol

Setup

  • The hidden service picks N introduction points, builds a Tor circuit to each, and communicates its public key
  • The hidden service advertises these introduction points and its public key

Connecting

  • The client chooses an entirely new relay called a "rendezvous point", builds a Tor circuit to it, and tells it a newly-generated one-time secret
  • The client contacts an advertised introduction point over a Tor circuit and tells it the rendezvous point's IP and the one-time secret, encrypted by the hidden service's public key
  • The introduction point relays this encrypted rendezvous point and one-time secret to the hidden service over the existing Tor circuit
  • The hidden service decrypts this data, builds a Tor circuit to the rendezvous point, and tells it the one-time secret
  • The rendezvous point now relays information between these two Tor circuits

Information

This is what IPs each actor knows after this process:

  • The hidden service knows the IPs of its introduction points
  • The client knows the IPs of the hidden service's introduction points
  • The client knows the IP of the rendezvous point
  • The hidden service knows the IP of the rendezvous point

Essentially, at no point is a Tor circuit built directly to the hidden service, the hidden service always builds its circuits outwards. Therefore, its IP is never revealed.

References: a high-level description of the protocol can be found in Tor: Hidden Service Protocol, while a more detailed description can be found in the original design paper Tor: The Second-Generation Onion Router.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .