OWASP Hunting
Network & Anonymity

Tor-Based Attacks

Testing techniques for applications that interact with or expose Tor hidden services, and identifying deanonymization vulnerabilities.

These payloads are for authorized testing only — systems you own, authorized bug bounty programs, or controlled lab environments. Unauthorized testing is illegal.

What it is

Tor-based attack testing covers vulnerabilities in applications that interact with the Tor anonymity network, expose .onion services, or attempt to deanonymize Tor users. This includes testing for Tor exit node enumeration, hidden service fingerprinting, deanonymization through side channels, and security misconfigurations in .onion-hosted applications.

Attack Vectors

  • Applications with Tor proxy support
  • .onion-hosted web services
  • Applications that detect or block Tor exit nodes
  • VPN services with Tor integration

Testing Methodology

  1. Obtain current Tor exit node list and test IP-based detection
  2. Test .onion services for standard web vulnerabilities (SQLi, XSS, etc.)
  3. Check if .onion services leak clearnet identifiers in responses
  4. Test for deanonymization through JavaScript or WebRTC fingerprinting

Payloads

Reference payloads for authorized testing. Always verify you have permission before use.

Exit Node Detection
https://check.torproject.org/torbulkexitlist (current exit nodes)Use Tor exit node list with geolocation comparison
Deanonymization Probes
<img src='https://clearnet-server.com/track.png'> (embedded clearnet resource)WebRTC STUN request leaking real IPDNS leak test via custom DNS resolver
.onion Service Testing
Standard web vuln payloads applied to .onion servicesTest for clearnet links in .onion site content

Indicators of Vulnerability

  • Clearnet resources loaded from .onion service (deanonymization risk)
  • Application reveals server IP through DNS or WebRTC
  • Standard web vulnerabilities (SQLi, XSS) present on .onion services

Detection Guidance

For applications blocking Tor: regularly update exit node lists. For .onion services: audit for clearnet resource loading and ensure no identifying information leaks.

Mitigation & Remediation

  • For .onion services: disable JavaScript or use strict Content Security Policy to prevent clearnet resource loading
  • Ensure DNS resolves only through Tor when using hidden services
  • Disable WebRTC in .onion-accessed applications
  • Apply all standard web security hardening to .onion services

References

Responsible Use

All content in this reference is for authorized security testing only. Use only on systems you own or have explicit written permission to test.

  • Systems and applications you own
  • Authorized penetration testing engagements
  • Bug bounty programs with defined scope
  • Educational lab environments (DVWA, WebGoat, HackTheBox)