The developers of OnionScan aim to make finding vulnerabilities as simple as possible.

OnionScan can also be used to help researchers and investigators monitor and track sites on the dark web. OnionScan's primary goal is to help operators of onion services identify and fix operational security (OPSEC) issues with their services. Its written in Go, a programming language created by Google in 2009. OnionScan is a free and open-source tool designed for investigating onion services. And that's where OnionScan comes into play. System administrators need to take better precautions to prevent their websites from being vulnerable to server fingerprinting and enumeration. He utilized software such as cURL, a command-line tool used for transferring data using various protocols, to collect HTTP response headers for later Shodan queries.ĭon't Miss: How to Find Vulnerable Targets Using ShodanĪll of the methods x0rz used to de-anonymize the onion services should have been ineffective if basic safeguards were taken by the site owners. OnionScan is a tool designed to identify common misconfigurations in onion services and aid us in understanding how to fix them.Īs security researcher demonstrated in an article on securing onion services, websites are often de-anonymized all too easily.

A surprising number of system administrators make seemingly trivial mistakes that ultimately lead to catastrophic cases of de-anonymizing supposedly anonymous sites on the dark web.

Configuring onion services for the first time can be tricky.

Tor onion toolkit