Pentest Tools

Published on April 13th, 2016 📆 | 5730 Views ⚑


OnionScan — Onion Services Security Scan

Text to Speech Voices

The purpose OnionScan is to make you a better onion service provider.

You owe it to yourself and your users to ensure that attackers cannot easily deanonymize your service.

Looking at dark web markets where people buy and sell drugs, fake IDs, and other illegal content one would expect that these sites have a strong interest in maintaining top-level security. However, often many of the issues that are or can be problematic on the surface web are prevalent throughout the dark web too.


While a hidden service within Tor is not vulnerable in the way a regular website is, the operators can still make mistakes. Frequent misconfigurations in the servers usually leave important administrator pages accessible. This can reveal the tools used to build a site, as well as other services run by the same party.Administrators can make many mistakes in setting up websites on the Dark Web which could potentially expose the administrator and way too many of the sites on Tor network fail to implement even the basic security practices. It’s also common to see images that have not been stripped of EXIF data, which can include the device they were taken with and even the location [GPS coordinates ] where they were taken. That would make it quite easy for someone to identify the owner of such a hidden service, and that could lead to problems for the users.

OnionScan checks a hidden service for all these potential issues so they can be solved. OnionScan is not a quiet tool — It will ping a service repeatedly and make a lot of noise while trying to download various images and files on which the it performs tests. If you use it to test someone else’s service, they will most definitely see you.

The dark web is accessible only from within the encrypted Tor network. Tor was originally just an anonymization tool that routed you to different parts of the open internet. When you connect to Tor, your packets are bounced to multiple encrypted relays (also called nodes). Since each relay only knows the IP address of the last hop and the next one, after a few layers your real IP address and location are obscured.

Go Dependencies

  • – For the Tor SOCKS Proxy connection.
  • – For EXIF data extraction.

OS Package Dependencies

  • libexif-dev on Debian based OS
  • libexif-devel on Fedora



Install OS dependencies

  • On Debian based operating systems: sudo apt-get install libexif-dev
  • On Fedora based operating systems: sudo dnf install libexif-devel


Grab with go get

go get


Compile/Run from git cloned source

go install and then run the program in ./bin/onionscan.

Or, you can just do go run to execute without compiling.

[adsense size='1']


For a simple report detailing the high, medium and low risk areas found:

./bin/onionscan blahblahblah.onion

The most interesting output comes from the verbose option:

./bin/onionscan --verbose blahblahblah.onion

There is also a JSON output, if you want to integrate with something else:

./bin/onionscan --jsonReport blahblahblah.onion

If you would like to use a proxy server listening on something other that, then you can use the –torProxyAddress flag:

./bin/onionscan --torProxyAddress= blahblahblah.onion


Apache mod_status Protection

This should not be news, you should not have it enabled. If you do have it enabled, attacks can:

  • Build a better fingerprint of your server, including php and other software versions.
  • Determine client IP addresses if you are co-hosting a clearnet site.
  • Determine your IP address if your setup allows.
  • Determine other sites you are co-hosting.
  • Determine how active your site it.
  • Find secret or hiddenn areas of your site
  • and much, much more.

Seriously, don’t even run the tool, go to your site and check if you have /server-status reachable. If you do, turn it off!


Open Directories

Basic web security 101, if you leave directories open then people are going to scan them, and find interesting things – old versions of images, temp files etc. Many sites use common structures style/, images/ etc. The tool checks for common variations, and allows the user to submit others for testing.



Whether you create them yourself or allow users to upload images, you need to ensure the metadata associated with the image is stripped.  Many, many websites still do not properly sanitise image data, leaving themselves or their users at risk of de-anonymization.


Server Fingerprint

Sometimes, even without mod_status we can determine if two sites are hosted on the sam infrastructure. We can use the following attributes to make this distinction:

  • Server HTTP Header
  • Technology Stack (e.g. php, jquery version etc.)
  • Website folder layout e.g. do you use /style or /css or do you use wordpress.
  • Fingerprints of images
  • GPG Versions being used.


Source && Download

Leave a Reply

Your email address will not be published.