ATTACKING TOR NETWORK

Exploiting
User avatar
ltx_Lazzarus
Posts: 55
Joined: Tue Apr 09, 2024 8:05 pm

ATTACKING TOR NETWORK

Postby ltx_Lazzarus » Sun Apr 21, 2024 12:27 am

The Tor network works by routing your traffic through 3 different relays if you're connected to a regular website, or 6 relays if you're on a .onion site.

Now, don't go mixing up the Tor network, the Tor binary, and the Tor browser - they're all different things that work together, but they're not the same.

The Tor binary is a program written in C that follows the rules set out by the Tor project. The Tor network is made up of all those Tor binaries running in relay mode. And the Tor browser is a modified version of Firefox that connects to the Tor binary's local SOCKS5 proxy, so it can access those .onion sites (called hidden services).

The Tor network has all sorts of different nodes - relays, guard nodes, middle nodes, exit nodes, and even some other fancy ones like introduction points, consensus servers, and rendezvous points. The directory authorities are the first relays you connect to to download the info on all the other relays. Without them, you wouldn't know what relays to use and couldn't connect to Tor at all.

To stop the directory authorities from getting overloaded, the official Tor binary caches the relay data when it first starts up.
Now, if you wanted to take down the Tor network, going after those directory authorities would be the easiest way to do it. You can find a list of 'em at https://consensus-health.torproject.org/

From there, you could try some different tactics:
Outdated server:
The directory authorities are just regular web servers, so you could look for common server vulnerabilities and give 'em a crack.

DDoS - slow loris:
Hitting 'em with a slow loris DDoS attack could block others from downloading the relay info.

DDoS - spam download info:
If you've got a decent-sized botnet, you could just make 'em all spam download the relay info through a simple GET request, that'd knock the servers offline.

WiFi - fake Tor network:
The directory authorities download the relay info over plain old HTTP, not HTTPS. So if you're on the same LAN as your target, you could spoof the relay info with your own "fake" Tor network.
stopthe4ttack.box

Return to “Exploits”