Using OnionScan to Audit Hidden Service Security

OnionScan is an open-source tool designed to audit Tor hidden services for common security misconfigurations that could deanonymize operators or leak sensitive information.

What OnionScan Checks

Server headers leaking software versions. SSH fingerprints matching clearnet servers. EXIF data in hosted images revealing camera GPS coordinates. Apache mod_status pages exposing real IP addresses. Open directories listing sensitive files. Bitcoin addresses reused across identities. Related onion services through shared infrastructure.

Common Findings

In audits of darknet services, OnionScan commonly finds: server version strings (Apache/2.4.41, PHP/8.1), default error pages revealing OS information, unsecured phpMyAdmin interfaces, exposed .git directories, and images with EXIF GPS data pointing to the operator's location.

Running a Scan

Install from github.com/s-rah/onionscan. Run: onionscan --verbose yoursite.onion. Review the JSON report for any findings. Fix identified issues immediately. Rescan after changes. Schedule regular audits — new deployments can introduce regressions.