Questions tagged [tor]

Tor (short for The onion router) is a system intended to enable online anonymity. Tor client software routes Internet traffic through a worldwide volunteer network of servers in order to conceal a user's location or usage from anyone conducting network surveillance or traffic analysis. For non-security questions about Tor, see our sister site Tor Stack Exchange.

Filter by
Sorted by
Tagged with
0
votes
0answers
9 views

How to connect to TOR and then a SOCKS proxy? [migrated]

I would like to connect to TOR first, and then utilize a SOCKS proxy at the end of the connection. This way, I can access websites that have banned TOR exit nodes. I was following the guide here: ...
1
vote
1answer
99 views

Onion Routing Network: Analyzing the size of the encrypted message to determine distance along a circuit

I am teaching Anonymous Networks in a Cybersecurity class. I am understanding (what I think) is a good deal about the process TORproject uses for its network by using this as a guide. https://skerritt....
1
vote
0answers
28 views

VPS for Tor & I2P - which other services can I safely run on same?

I'm toying with the idea of setting-up a Tor node (middle/guard) and an I2P node on the same VPS. I think that should be safe(ish)... But I'm wondering what other services I could run without it/them ...
14
votes
3answers
5k views

Why is Tor over HTTPS insecure?

I don't get how a HTTPS connection over Tor can be insecure. Where's the difference between a normal HTTPS connection and a Tor -> HTTP connection? Many sites recommend to use the Onion-URL instead of ...
0
votes
0answers
50 views

Allow for login through TOR while preventing brute force/distributed password attacks?

I am making a website with the goal of blocking bots that are trying to login from different IP addresses constantly... while still allowing regular users to login via TOR. One of the approaches to ...
0
votes
1answer
58 views

If Tor does diffe-hellman with each node how do they all not know the sender

bit confused by something regarding Tor. As per what I have read and confirmed in this answer Tor: Is a diffie-helman key exchange being done over reciepient of traffic? the client does a DH key ...
2
votes
1answer
204 views

Seems my CNAMEs got "curled". Somebody please explain this to me

According to my CloudFlare firewall logs, somebody went through each of my subdomains. My website is not advertised, it doesn't even show on Google unless typing the exact domain name into it. I think ...
0
votes
1answer
1k views

Whonix with Remmina to Connect on RDP - Is it safe?

My question is based on 2 things. I do not want my ISP logging any of my data, and do not trust my VPN either. Is it a safe measure to use Whonix in a VirtualBox, connecting over VPN. Then using ...
19
votes
5answers
38k views

Tor and regular browser side by side. Does that make sense?

Can I use a Tor browser session and a regular Firefox session side by side without corrupting the security of the Tor session? E.g. when I download a new Eclipse version or when I'm searching for ...
1
vote
0answers
46 views

Are there any known SSH (protocol or implementation) vulnerabilities which can be performed on a tor hidden service?

The last couple of weeks I have been researching possible attacks that can be performed on a Tor hidden service using SSH from a location different from that of the server, assuming the .onion address ...
0
votes
0answers
63 views

Using compromised tor bridge

If a malicious user creates a tor bridge, does that compromise the entire connection? I don't think so, because I thought they have to control both the entry and exit nodes. However, my friend is ...
2
votes
1answer
120 views

Does using IP address over Tor with a one essential website expose me to any attack surface?

I routinely access www.email-provider-of-my-choice.com via browser over Tor. My browser enforces https-only mode and I opt for never saving my credentials with this provider. I tend to use the domain ...
0
votes
1answer
202 views

Anonymous video uploading on an internet host

How much video uploading could be trackable for some person who uses the Tor Browser for uploading video on YouTube or other video hosting services with low authorization and sign-up processing, like ...
1
vote
1answer
205 views

Is saving a dark web page locally and reloading it in another browser a security risk?

Say I have Tor running and am browsing the dark web with the Tor browser. If I were to save a local copy of a web page and render it into another browser, like Chrome (with JS enabled), would I then ...
0
votes
1answer
122 views

Tor relay access

I want to do a project on onion routing for my school graduation test. I want to show how onion routing could be compromised if the end and start relay within the network are both accessible by a ...
2
votes
1answer
120 views

What is extra 3 relays in .onion in Tor connection

When I visit any website in Tor browser and if I see the diagram of the circuit that Tor Browser is using for the current tab in the site information menu in the URL bar, it shows 3 relays: Guard, ...
0
votes
1answer
219 views

How to set up the Tor browser on Linux Mint in a VM with a VPN on the Host

(Forgive me, I don't know whether to post this here for in the "Tor" community) I'm brand new to Tor, I understand the basics of how it works and the Do's & Don'ts. I have a Windows 10 computer (...
1
vote
2answers
316 views

How is Tor's exit node safe?

If I use Tor over VPN (User -> VPN -> Tor -> Destination), then VPN first encrypts my data and hides my original IP address, and then it goes to Tor's Entry Node. So that Tor's Entry Node can'...
0
votes
2answers
220 views

Any known SSH attacks/vulnerabilities other than brute force, dictionary attacks and compromising keys?

I am looking for attacks over Tor that can be applied to a server running SSH. I have been looking at SSH.com, IEEE papers, SpringerLink papers/books, etc. but so far I have only found that the ...
0
votes
0answers
23 views

How client and server exchanges keys over Tor network using HTTPS? [duplicate]

When someone uses a browser to connect to https://google.com via Tor network, the client needs to exchange a key with Google in order to keep all the data hidden from the exit node, right? Otherwise, ...
-1
votes
1answer
79 views

tor traffic routing within tor network

I understand there is entry node, middle node and exit node when a user accesses an internet resource like https://www.google.com while coeected to the tor network. Is the concept the same if the user,...
9
votes
1answer
4k views

Meterpreter (Metasploit) anonymous reverse connection over Tor2web

The general consensus seems to be that one sets up a listener on a server accessible by a public IP and some port forwarding. For anonymity this should be a throw-away server or a hacked box. I've ...
1
vote
1answer
379 views

Difference between tor over VPN and VPN over tor

I saw many posts here saying that tor over VPN is different from VPN over tor, and one is better than other, but I was unable to find any explanation over it. There were some speculations that you ...
3
votes
1answer
278 views

Is using email (protonmail with Tor Browser / obfs4 bridges) to contact embassy in potentially hostile foreign countries safe?

Suppose one wants to use email (say using protonmail with Tor Browser / obfs4 bridges) to discuss sensitive matters (such as asylum seeking / embassy protection) with embassy in potentially hostile ...
8
votes
3answers
33k views

Difference between X-Forwarded-For IP, X-Real-IP, VPNs and TOR

I have this Google Chrome Privacy Preserving Extension that I am working on. Where I can spoof the header information e.g user agents and else. When I spoof X-Forwarded-For IP and go to http://...
-1
votes
1answer
134 views

IP hiding attempts are detected [closed]

So I am using Tor and I try to log into a certain web site. It gives me a message saying that my IP address was used for spamming and does not let me log in. I think ok, probably the exit node is ...
0
votes
2answers
420 views

Tor exit node inside the website server to prevent anything in the clear over the wire?

Here's the problem: Can you trust Tor’s exit nodes? Excerpt: Chloe set up a fake website with a Bitcoin theme, downloaded a complete list of exit nodes and then logged in to the honeypot site ...
0
votes
2answers
135 views

How are data breach lists sourced and distributed?

I understand at an elementary level how data breaches tend to be distributed, starting with friends of the attacker/discoverer and then being distributed via forums, paste bins, etc. However I was ...
2
votes
2answers
865 views

Revealing IP of an email recipient using remote PHP script or pixel tracking

I read through the search items and similar threads but my query is rather specific. I know it's possible to reveal IP of an email recipient if we can get the person to click on an attached image or ...
2
votes
1answer
182 views

Tor for confidentiality on corporate network

I work in gov organization and recently I learned they set up a MITM, by installing some certificates - so when I visit any web site and then check the certificate info it shows the certificate ...
47
votes
7answers
6k views

How does Tor protect against an attacker just running thousands of nodes?

Does Tor have any protection against an adversary simply running a very large number of nodes? Someone with the necessary resources could just run thousands of relay nodes (including exit nodes). If ...
-1
votes
1answer
382 views

What’s the point in using proxychains for an nmap scan when you could use Tor?

I always hear on YouTube and other places on the internet that Tor is the best option to stay anonymous. Tor is used by many activists, journalists etc. hiding from oppressive governments and so on. ...
1
vote
1answer
183 views

Protect IP Address and location from Twitter

Is there a way to protect IP Address and location from Twitter after having logged in ? All I want Twitter to know is my email and password and nothing else. No IP Address, no location. Is that ...
12
votes
4answers
4k views

Can someone use WiFi snooping to see data I send through Tor Browser when I'm not using SSL?

(NOTE: I've read other similar questions, but I'm not at all certain about this, therefore I'm asking.) I travel a lot, and I generally use public WiFi spots and hotels/hostels/boarding houses etc. ...
2
votes
2answers
13k views

How to route all traffic through Tor?

I have Tor setup on my MacBook and I configured my WiFi connection to use Tor's SOCKS Proxy that is running on port 9050. When I check my connection it confirms I am browsing through Tor. However, ...
3
votes
2answers
10k views

What is the pitfall to connecting with Tor on a public wifi hotspot?

I often use public wifi hotspots to connect to the Internet. Is my data encrypted right before it leaves my system and so protected from network observers/snooping if I use tor?
2
votes
0answers
245 views

How to harden portable Tor Browser installation (SELinux, sandbox)?

tldr How can I define a SELinux policy, that limits filesystem access of portable Tor Browser to its installation directory, say /home/user/.local/opt/tor-browser_en-US? How might Tor Browser be ...
4
votes
3answers
3k views

How to increase anonymity of Tor

I need some system to gain a high level anonymity - nobody should have the possibility to figure out my IP. I can use Tor, but I do not completely trust to it. So I have an idea for a system with high ...
0
votes
1answer
167 views

Torrent sites on the onion network being served over http

I've noticed that torrent websites like the Pirate Bay are served over http. This means that when using a network like the Tor onion network, where the first server in the response chain receives the ...
0
votes
1answer
335 views

is metasploit under whonix anonymous?

If I run an exploit like EternalBlue with Metasploit on whonix to a remote machine, do I remain anonymous? I think I do because it goes over tor but I am not sure. Am I right?
1
vote
1answer
330 views

Secure to run a tor bridge as current user?

It is secure to run a tor bridge node from my current user, have in mind that I can use sudo? Here is the torrc: ORPort 9001 Nickname somenick ExitRelay 0 ExitPolicy reject *:* # no exits allowed ...
-2
votes
2answers
305 views

Is Tor Private/Secure?

I have had Tor for a bit, I do not use it that often. But I am wondering if anyone knows if it is secure. How safe are onion connections?
1
vote
1answer
415 views

How to configure VPN + Tor + linux as a proxy server? [closed]

Goal To hide the IP address using Tor, which goes through a proxy server to make HTTP/FTP requests look like they came from a regular user, not one who uses Tor. Example A user requests the website. ...
0
votes
2answers
2k views

VPN - Tor: can VPN provider see the data?

If I switch VPN on, then use Tor browser, can the VPN provider still see what is passing through Tor? I am thinking it can't, right? Because the Tor browser encrypts the data into the Onion layer ...
1
vote
2answers
928 views

Is this a viable defense against correlation attacks?

So, I guess most of you know that the true identity can be revealed if somebody controls the entry and the exit node of your Tor-connection. Let´s say I´m connecting first to an encrypted VPN Server ...
2
votes
3answers
695 views

Can using torrent help me obfuscate Tor-over-VPN traffic?

There is tremendous misinformation about Tor in my country's mainstream media so, even though i use Tor for everyday surfing, I'd like to hide it from my ISP. Currently, I use a VPN whenever I am ...
1
vote
1answer
216 views

What are the security implications of connecting to Tor through an SSH SOCKS proxy?

Suppose I have a user account on a remote server run by a friend. I create a SOCKS tunnel on my computer that forwards connections from a local port to the remote server: ssh -N -D 12345 john@10.1.1....
0
votes
0answers
152 views

Can Tor browser protect me from being found out? [duplicate]

I am using my computer, but am connected to my work's WiFi. Can my company see what websites I visit when am using Tor browser?
11
votes
1answer
4k views

wget: what security issues am I not considering?

Questions: based on the details provided below, (a) what potential security vulnerabilities and threats might I face in my use of wget and (b) what recommendations would you give for mitigating those ...
6
votes
1answer
238 views

Can an attacker who has gained control over my router compromise anonymity through Tor?

If an attacker manages to infect my router with malware and sets up an entry node, can they force my computer to connect to their entry node? If my computer does connect to their entry node, can they ...

1
2 3 4 5
10