Locked Pentesting with Termux targeting TOR protocol .onion domain by dEEpEst

[dEEpEst]

Pentesting with Termux targeting TOR protocol .onion domain by dEEpEst 

 

For this manual we will use:

Termux

TOR

Proxychain 

nmap

nikto2

 

The main objective of this manual is to show how to do a penetration test on a server hosted on the TOR network (domain.onion).

I will assume that you already have your target .Onion server and that the target is owned by you, if it is not owned by you you should not continue because it would be illegal. So I am not responsible for the use you give to this manual.

 

First we update Termux

This is the hidden content, please

• Sign In
• or
• Sign Up

We install Tor , nmap and proxychain

This is the hidden content, please

• Sign In
• or
• Sign Up

We started Tor

This is the hidden content, please

• Sign In
• or
• Sign Up

We modified Proxychain so that it accepted socks

This is the hidden content, please

• Sign In
• or
• Sign Up

We make sure that this line is uncommented (without the #)

This is the hidden content, please

• Sign In
• or
• Sign Up

 

After this we already have configured our Termux terminal to start any test to our Tor server (domain.onion)

For example we can start with nmap:

This is the hidden content, please

• Sign In
• or
• Sign Up

Where TARGET.onion is the domain of your server 

This will give us information such as the service that is running and the version.

 

To do a more exhaustive test we will use nikto2 

We installed perl before using nikto

This is the hidden content, please

• Sign In
• or
• Sign Up

We cloned the nikto repository

This is the hidden content, please

• Sign In
• or
• Sign Up

We position ourselves in the nikto folder

This is the hidden content, please

• Sign In
• or
• Sign Up

Finally we run 

This is the hidden content, please

• Sign In
• or
• Sign Up

 

Nikto2 is a very powerful tool and it will give us a lot of information about possible breaches.

 

Remember that this is just an example of how to test for possible breaches in your Tor server and that you should not test a server that you do not own. So I am not responsible for the use you give it to this manual.