What is .Onion ?

.onion is a special-use top level

domain suffix designating an
anonymous hidden service
reachable via the Tor network.
 How to access .onion sites
 Internet programs such as Web browser can access sites with
.onion addresses by sending the request through the TOR
network.
 Components of Tor network

Client: the user of the Tor network

Server: the target TCP applications such as web servers
Tor (onion) router: the special proxy relays the application data
Directory server: servers holding Tor router information
How Tor works ?-Onion routing

•A circuit is built incrementally one hop by one hop

•Onion-like encryption
Alice negotiates an AES key with each router
Messages are divided into equal sized cells
Each router knows only its predecessor and
successor
Only the Exit router (OR3) can see the message,
however it does not know where the message is from
 Tor hidden services -.onion urls
 http://3g2upl4pq6kufc4m.onion/ –
DuckDuckGo Search Engine
 http://kpvz7ki2v5agwt35.onion –
The Hidden Wiki
 http://matrixtxri745dfw.onion/ –
Image Uploader
 http://npdaaf3s3f2xrmlo.onion/ –
Twitter clone
 http://kpmp444tubeirwan.onion/ –
DeepWeb
 http://365u4txyqfy72nul.onion/ –
Anonymous E-mail sevice.
 http://6w6vcynl6dumn67c.onion/ – Tor Market Board –
Anonymous Marketplace Forums
 Dark Web Markets
 sell legal prescription drugs
 Stolen information
 Malware, ransomware and
hacking services
 Hitman-for-hire services
Top markets
 Dream Market-
http://6khhxwj7viwe5xjm.onion/?ai=552713
 Silk Road 3 Market-
http://silkroad7rn2puhj.onion/?register&ref=bVehnOXR
 DrugMarket- http://4yjes6zfucnh7vcj.onion/
Etc….
Tor : Onion Service protocol
Tor : Onion Service protocol
Tor : Onion Service protocol
Tor : Onion Service protocol
Tor : Onion Service protocol
Tor : Onion Service protocol
Traditional threats to Tor security
DNS Leaks
 DNS requests not sent through
Tor network by default
 Attacker could see what
websites are being visited
 external software such as
Foxyproxy and Privoxy can
be used to route DNS requests
through tor network, but this
is _not_ default behavior
 Traditional threats to Tor security
Traffic Analysis
 "Traffic-analysis is
extracting and inferring
information from network
meta-data, including the
volumes and timing of
network packets, as well
as the visible network
addresses they are originating
from and destined for."
 Tor is a low latency network,
and thus is vulnerable to an
attacker who can see both ends of a connection
 Further reading: Low Cost Traffic Analysis of
Tor:
(http://www.cl.cam.ac.uk/~sjm217/papers/oakland05torta
.pdf
 References
 https://en.wikipedia.org/wiki/.onion
 https://www.deepdotweb.com/how-to-access-onion-sites/
 https://jordan-wright.com/blog/2015/02/28/how-tor-
works-part-one/
 https://en.wikipedia.org/wiki/Onion_routing
 https://darkwebnews.com/deep-web/
 https://www.torproject.org/docs/onion-services.html.en
 https://slideplayer.com/slide/5045794/