Questions tagged [tor]

Tor (short for The onion router) is a system intended to enable online anonymity. Tor client software routes Internet traffic through a worldwide volunteer network of servers in order to conceal a user's location or usage from anyone conducting network surveillance or traffic analysis. For non-security questions about Tor, see our sister site Tor Stack Exchange.

Filter by
Sorted by
Tagged with
1 vote
1 answer
26 views

Passing traffic from a script through proxy / tor network [closed]

I am applying for a job that involves creating unit tests and end to end tests for a website. Right now, i am assigned with a task, in order to test my skills. However, my country has blocked access ...
user avatar
-2 votes
2 answers
158 views

Why do people claim Tails is more secure than Windows?

Why do some people say that using Tor within my normal operating system will not be safe? What differentiates Windows and Tails in this regard? I believe that running Windows together with a VM, VPN ...
user avatar
-2 votes
1 answer
99 views

Steganographically hide encrypted packets for VPN, Tor, etc?

We all know about different encryption methods used today in secured connections like VPN, Tor, etc. However, there is an issue with usage of those. Even if the outsider can not decrypt the message, ...
user avatar
0 votes
0 answers
17 views

How does the --os-shell parameter in Sqlmap work? Is it still anonymous over Tor?

How does the --os-shell parameter in Sqlmap work? I know its uploading a backdoor, but how is sqlmap uploading it and is the file just a normal reverse shell trojan? And is it still anonymous when ...
user avatar
6 votes
2 answers
143 views

What's the advantage of connecting to an onion address over a regular domain through Tor?

Many websites offer both standard domains that you can access through any browser and onion addresses only accessible via Tor. I wonder what is the privacy advantage (if any) for the end user when ...
user avatar
  • 221
0 votes
2 answers
68 views

Can my ISP know that I am using Tor if I am connecting to Tor via an SSH SOCKS5 proxy?

I created an SSH SOCKS tunnel that forwards connections from a local port to a remote server: ssh -N -D 127.0.0.1:1234 me@example.com (i.e. all connections to 127.0.0.1:1234 get forwarded to the ...
user avatar
  • 583
1 vote
1 answer
68 views

How secure and anonymous is the --tor parameter in Sqlmap?

How secure and anonymous is the --tor parameter in Sqlmap? Does it really send every request over Tor and does it have any IP/DNS/STUN requests leak loopholes?
user avatar
1 vote
0 answers
60 views

How does Tor's second node know the key to decrypt the second layer?

I was watching this video explaining how tor works: https://youtu.be/QRYzre4bf7I It explains it with the example of 3 intermediate nodes between client and server. It says that each of the nodes can ...
user avatar
1 vote
1 answer
59 views

MITM in Tor: Authentication when an Entry node is sending data back to the Client

Diagram: Server -> Exit Node -> Middle Node -> Entry Node -> Client In Entry Node -> Client, how does the entry node authenticate that the receiver is a real client but not a MITM?
user avatar
1 vote
1 answer
131 views

How insecure are self-signed certificates? Why does Tor still use them?

How insecure are self-signed certificates? Why does Tor still use them?
user avatar
1 vote
1 answer
57 views

Android- ads in applications are in local language even when using proxy

I have noticed some weird behavior on my smartphone that I can't explain myself. I'm using Orbot application as proxy to route all of the phone's internet traffic through the Tor network. When I ...
user avatar
1 vote
1 answer
65 views

Tor: How does entry nodes communicate with middle nodes? How does middle nodes communicate with exit nodes?

In Tor, when a client communicates with an entry node, they exchange the parameters such as the prime number and the generator with each other through DH. What about when an entry node communicating ...
user avatar
1 vote
2 answers
258 views

Can Tor bridges really prevent ISPs from knowing the fact that you are using Tor?

Using Tor bridges for censorship circumvention routes your traffic to a bridge before an entry node. If the IP of the bridge is constant, isn't it abnormal that you are always connecting to the same ...
user avatar
1 vote
2 answers
86 views

Which type of Diffie-Hellman does Tor use?

Does Tor use Ephemeral DH, Static DH or Anonymous DH? I have heard that the latter two are not secure so I am worried if Tor uses them.
user avatar
-1 votes
2 answers
193 views

How would routing DDoS attacks over Tor increase effectiveness?

In recent days, stackexchange has been hit by a series of DDoS attacks , leading to the blocking of Tor exit nodes. I'm curious how a DDoS attack would be more effective when routed over Tor. From ...
user avatar
2 votes
2 answers
126 views

Before Tor, VPNs and proxy services, how did cybercrimals remain anonymous?

I have read that they used previously breached machines, but to try to gain access to those machines they also needed some kind of protection right? How did they do it then?
user avatar
  • 21
0 votes
0 answers
40 views

Anonymity setup criticism

My current setup up is for pseudonymous communication on a smartphone. I need help to know if I am doing anything wrong. GrapheneOS all traffic over tor using (orbot) using Signal with anonymous ...
user avatar
1 vote
1 answer
91 views

Why don't the security problems with torrenting over tor, at least partly apply to VPNs as well?

So understand that torrenting over tor isn't generally a good idea, mainly because the speeds aren't high and it strains the network. Also that it doesn't support UDP. But if we look at the old paper ...
user avatar
1 vote
0 answers
63 views

VPS for Tor & I2P - which other services can I safely run on same?

I'm toying with the idea of setting-up a Tor node (middle/guard) and an I2P node on the same VPS. I think that should be safe(ish)... But I'm wondering what other services I could run without it/them ...
user avatar
0 votes
0 answers
69 views

Allow for login through Tor while preventing brute force/distributed password attacks?

I am making a website with the goal of blocking bots that are trying to login from different IP addresses constantly... while still allowing regular users to login via Tor. One of the approaches to ...
user avatar
1 vote
1 answer
134 views

If Tor does Diffie-Hellman with each node how do they all not know the sender

I'm a bit confused by something regarding Tor. As per what I have read and confirmed in this answer Tor: Is a Diffie-Hellman key exchange being done over recipient of traffic? the client does a DH key ...
user avatar
1 vote
1 answer
98 views

Are there any known SSH (protocol or implementation) vulnerabilities which can be performed on a tor hidden service?

The last couple of weeks I have been researching possible attacks that can be performed on a Tor hidden service using SSH from a location different from that of the server, assuming the .onion address ...
user avatar
0 votes
0 answers
98 views

Using compromised tor bridge

If a malicious user creates a tor bridge, does that compromise the entire connection? I don't think so, because I thought they have to control both the entry and exit nodes. However, my friend is ...
user avatar
  • 1
2 votes
1 answer
151 views

Does using IP address over Tor with a one essential website expose me to any attack surface?

I routinely access www.email-provider-of-my-choice.com via browser over Tor. My browser enforces https-only mode and I opt for never saving my credentials with this provider. I tend to use the domain ...
user avatar
0 votes
1 answer
141 views

Tor relay access

I want to do a project on onion routing for my school graduation test. I want to show how onion routing could be compromised if the end and start relay within the network are both accessible by a ...
user avatar
2 votes
1 answer
200 views

What is extra 3 relays in .onion in Tor connection

When I visit any website in Tor browser and if I see the diagram of the circuit that Tor Browser is using for the current tab in the site information menu in the URL bar, it shows 3 relays: Guard, ...
user avatar
  • 33
1 vote
2 answers
399 views

How is Tor's exit node safe?

If I use Tor over VPN (User -> VPN -> Tor -> Destination), then VPN first encrypts my data and hides my original IP address, and then it goes to Tor's Entry Node. So that Tor's Entry Node can'...
user avatar
  • 33
0 votes
2 answers
471 views

Any known SSH attacks/vulnerabilities other than brute force, dictionary attacks and compromising keys?

I am looking for attacks over Tor that can be applied to a server running SSH. I have been looking at SSH.com, IEEE papers, SpringerLink papers/books, etc. but so far I have only found that the ...
user avatar
0 votes
0 answers
23 views

How client and server exchanges keys over Tor network using HTTPS? [duplicate]

When someone uses a browser to connect to https://google.com via Tor network, the client needs to exchange a key with Google in order to keep all the data hidden from the exit node, right? Otherwise, ...
user avatar
-1 votes
1 answer
95 views

tor traffic routing within tor network

I understand there is entry node, middle node and exit node when a user accesses an internet resource like https://www.google.com while coeected to the tor network. Is the concept the same if the user,...
user avatar
  • 101
1 vote
1 answer
431 views

Difference between tor over VPN and VPN over tor

I saw many posts here saying that tor over VPN is different from VPN over tor, and one is better than other, but I was unable to find any explanation over it. There were some speculations that you ...
user avatar
1 vote
1 answer
112 views

Onion Routing Network: Analyzing the size of the encrypted message to determine distance along a circuit

I am teaching Anonymous Networks in a Cybersecurity class. I am understanding (what I think) is a good deal about the process TORproject uses for its network by using this as a guide. https://skerritt....
user avatar
3 votes
1 answer
312 views

Is using email (protonmail with Tor Browser / obfs4 bridges) to contact embassy in potentially hostile foreign countries safe?

Suppose one wants to use email (say using protonmail with Tor Browser / obfs4 bridges) to discuss sensitive matters (such as asylum seeking / embassy protection) with embassy in potentially hostile ...
user avatar
-1 votes
1 answer
150 views

IP hiding attempts are detected [closed]

So I am using Tor and I try to log into a certain web site. It gives me a message saying that my IP address was used for spamming and does not let me log in. I think ok, probably the exit node is ...
user avatar
0 votes
2 answers
147 views

How are data breach lists sourced and distributed?

I understand at an elementary level how data breaches tend to be distributed, starting with friends of the attacker/discoverer and then being distributed via forums, paste bins, etc. However I was ...
user avatar
2 votes
1 answer
198 views

Tor for confidentiality on corporate network

I work in gov organization and recently I learned they set up a MITM, by installing some certificates - so when I visit any web site and then check the certificate info it shows the certificate ...
user avatar
0 votes
1 answer
234 views

Anonymous video uploading on an internet host

How much video uploading could be trackable for some person who uses the Tor Browser for uploading video on YouTube or other video hosting services with low authorization and sign-up processing, like ...
user avatar
2 votes
0 answers
284 views

How to harden portable Tor Browser installation (SELinux, sandbox)?

tldr How can I define a SELinux policy, that limits filesystem access of portable Tor Browser to its installation directory, say /home/user/.local/opt/tor-browser_en-US? How might Tor Browser be ...
user avatar
  • 21
0 votes
1 answer
190 views

Torrent sites on the onion network being served over http

I've noticed that torrent websites like the Pirate Bay are served over http. This means that when using a network like the Tor onion network, where the first server in the response chain receives the ...
user avatar
0 votes
1 answer
434 views

is metasploit under whonix anonymous?

If I run an exploit like EternalBlue with Metasploit on whonix to a remote machine, do I remain anonymous? I think I do because it goes over tor but I am not sure. Am I right?
user avatar
1 vote
1 answer
219 views

Is saving a dark web page locally and reloading it in another browser a security risk?

Say I have Tor running and am browsing the dark web with the Tor browser. If I were to save a local copy of a web page and render it into another browser, like Chrome (with JS enabled), would I then ...
user avatar
  • 13
-2 votes
2 answers
334 views

Is Tor Private/Secure?

I have had Tor for a bit, I do not use it that often. But I am wondering if anyone knows if it is secure. How safe are onion connections?
user avatar
0 votes
0 answers
173 views

Can Tor browser protect me from being found out? [duplicate]

I am using my computer, but am connected to my work's WiFi. Can my company see what websites I visit when am using Tor browser?
user avatar
  • 1
-1 votes
1 answer
478 views

What’s the point in using proxychains for an nmap scan when you could use Tor?

I always hear on YouTube and other places on the internet that Tor is the best option to stay anonymous. Tor is used by many activists, journalists etc. hiding from oppressive governments and so on. ...
user avatar
0 votes
1 answer
137 views

Person tried to login in my website with non-existent username, but not a VPN nor Tor

I am managing a WordPress website. I have installed the plugin "Limit Login Attempts Reloaded". This plugin sent me an email saying that A.B.C.D has tried to login with the non-existent ...
user avatar
2 votes
1 answer
121 views

Timeless timing attacks and response jitter

I've been researching timeless timing attacks, ie: timing attacks using concurrency rather than round trip time. Here is an article by portswigger with links to the original article by Van Goethem. ...
user avatar
  • 123
0 votes
0 answers
47 views

Surfed Darkweb carelessly [duplicate]

A while ago, I installed Tor app on my android (fully updated and Android 10) and with a free Vpn tried to open some sites listed on several blogs (like "best dark sites in 2020" or "...
user avatar
0 votes
2 answers
153 views

Extrapolating home address of a visitor when they click on an e-mail phishing link (Mr Robot)

In Mr Robot season 3, the feds are set up in a safe house spying on Elliot's internet communications (with packet sniffers?) when they intercept an email from Elliot to someone else containing a link ...
user avatar
0 votes
2 answers
297 views

Staying anonymous vs a Five Eyes adversary?

If you were in a Five Eyes country and you wanted to contact someone else anonymously, without this person or the government finding out who you are or your location, how would you do it? The person ...
user avatar
1 vote
1 answer
199 views

Protect IP Address and location from Twitter

Is there a way to protect IP Address and location from Twitter after having logged in ? All I want Twitter to know is my email and password and nothing else. No IP Address, no location. Is that ...
user avatar
  • 11

1
2 3 4 5
11