- [Announcer] The talk going on next is by Ionut.
So let's give him a big Defcon 30 welcome.
Come on!
(Round of applause)
- [Ionut Cernica] Hello everyone.
My name is Ionut Cernica,
and I will be presenting the organization of
TOR HTTP hidden services.
So I will have an introduction about TOR then I will speak
about non, the organization techniques,
then how downgrading the HTTP protocol can leak the IP.
Other techniques developed by me then how to
fix these issues because it's a configuration issues.
Then demo time and closing remarks.
Who am I?
I'm an application security engineer
and I'm working for UAP.
This is my own research, personal research.
CTF player, PhD student, security researcher,
former bug bounty hunter and former entrepreneur.
The Onion Router known as TOR
helps you to anonymize on the internet
and helps you to reach the dark net.
Where you can find the hidden services
and that the URL that ends in onion dot onion.
The hidden service allow users to publish their services
and it hides their identity, on the internet
on the TOR network and the internet.
Configuration a basic configuration is when you
declare a service directory
where the TOR configuration files will go,
then the service port for, for the network.
Then when we start the server service
you'll have a URL like, a long URL dot onion
for your hidden service.
Known Deanonymization Techniques are server status.
Key certificate, another Deanonymization technique is search
for the Onion address or the Gzip deflate.
This is not the Deanonymization it helps you to make a,
I don't know
to make an idea where the server is located in what,
which country.
favicon hash and if you are skilled enough
maybe you can hack the server.
So the server status technique implies to it's,
it's only on a apache way, apache two web servers.
And when you go to server status, maybe they didn't disable
because it's enabled by default on web servers
like on the apache web servers,
and maybe on the virtual host
you'll find a public IP or public domain
which you can visit and see
on the server status of the TOR, hidden service.
The key certificate implies that you can take, parameters
like serial numbers and so on,
and you can look for them on Shodan
which indexes information from the internet
including the TLS information like serial number.
And maybe you can catch the,
maybe the hidden services use the same TLS certificate
on the internet, and you can make a match.
You can also meet, okay,
It's not a big chance of success
but you can search for the onion address on the internet.
And you can search on search engines like Google, Bing
DuckDuckGo, or Shodan, deserve a try.
The Gzip compression,
it's about to gives you an idea where the server is located
and Jose Carlos found it.
And he said that around 10% of the web servers
leak the remote data when compressing HTTP responses.
The favicon is that tiny icon from the URL bar
and it is possible to make a hash
of it and then try to search it on Shodan.
Maybe some other website is using
and an example for this is the Quantum ransomware group
which were Deanonymized on TOR
because they use the favicon on the internet.
And Talos found it equivalent on the internet.
Or hack the server with a remote command execution
local file, or make a research on the server,
maybe you'll find something that leaks IP.
So downgrading the protocol.
How did I find this?
Some strange requests were in my access logs.
Something like get slash not found along
not found, not found, not found exactly like this.
And it ends with HTTP/1.0
the protocol with a 400 bad request, and masscan
and the user agent were, was masscan
and for more information, it gave me a website where to go
and read more information about this scan.
So when I entered in on that website
it was about university from Germany
which they said they scan all the internet
and they tried to find something.
They didn't reveal what they are were looking for
but this behavior keep coming for days on my server.
Also, I was seeing this behavior on my honey pots
and I was thinking to dump the whole request to
see what's going on there because it's strange to
see such request and what they are looking for.
So when I dumped their request, the whole request
I was thinking they have been exploiting
in the header and the access log doesn't have the parameters
in headers in the log file.
I replicated and I saw that one of my virtual host
was publicly revealed in the response server
and this was, I realized that this have a big potential
on TOR or even in the internet,
because you can find unknown
or unplugged, unpublished, domains
virtual domains from one IP.
So why this behavior?
So is not a security problem apache
but based servers like apache two
Nginx or tomcat, it's all about configuration.
The server must choose one
of the domains to forward the request.
So if you downgrade the protocol to 1.0
you don't need the host header anymore
and you can erase it from your request.
So the server will choose the first virtual domain
from the configuration file.
And in the response, you'll find the IP
or maybe something that doesn't help you maybe local host.
So do leak is in the triggered exceptions
like 400 bad request, 403 forbidden
or even in 404, not found sometimes.
But the best way to leak the IP is in server redirect,
you have to trigger redirect
on the server on something else.
And this is working on Nginx, apache two and tomcat,
and it's very easy to trigger or redirect on every server.
Now, I just want to show you how the response
is when we try to go to slash dot HTML.
So it's a 403, forbidden.
We have that server at my onion domain.
It's a big one and dot onion in the end.
And if I remove the host header
and I downgrade the protocol, now I have my IP leaked.
So I just click my IP.
With 400 bad request, long header, via long header,
if you put a long header enough
you trigger the bad request.
And as well, we have the IP address
in the response server at my real IP address.
Again, the result with long URL
like the university from Germany, I said earlier
they did with the long URL, it's triggering a bad request.
Maybe that's why, I don't know,
maybe that's why they are,
they, they were doing this
or a file upload that exceeds the server limits.
There are other ways to do that to trigger a bad request.
You just have to find other ways.
The 403 forbidden is triggered when you visit something
with slash dot ht.
That's because the default configuration file
of apache tries to protect files like htacces or htpasswd,
so you can easily trigger these 403 forbidden
and you downgrade the protocol, remove the host header.
Then you have the server at with something in there
maybe on local host
or something that doesn't help you or the public IP.
Maybe the server directs the best way to
trigger the server directs is the best way to find
out the primary virtual host.
And an example is like, if you have a directory that exists
on the route of the server
you can try to visit it without the last slash.
And the server will auto redirect
to the same directory, but with a slash after the final.
So in most cases you can find a directory
on the first HTML page of the web server.
Maybe you are dealing
with an API server and you don't have directories
but you can use the predefine directories from apache server
like CSS icons js, and these directories are available only
if you visit from the local host IP
and in TOR most of the hidden services are visited
with the local host.
To trigger the redirect.
Look at the, as I said
you look on the source code of the HTML.
You find the directory like CSS in this case
and then you try to trigger the redirect
like get slash CSS without the last slash.
The server tries to correct this,
and tries to put a slash at the end, but redirects
to your virtual hosts, the primary virtual host
because I already downgraded the protocol.
So applying this on internet
maybe you can find important information.
If you are assist admin
you have to be careful how you configure your virtual hosts.
I didn't make a research on this because I don't know,
I I'm at the limit of legality.
It appears that others did this before, but I don't know
if they follow this problem,
with the downgraded of protocol.
So I expect to exfiltrate domains
that normally you cannot get from an IP.
It's kind of DNS reserve, reverse.
Another technique which would be the Etag
from the response header.
You can take its value,
and if the first page is a static page.
Maybe you can look for it on the Shodan search engine.
Another, an example of ITAG, you can see
I make a request on the first page on the slash
and the server respond with Etag and it's a unique value.
You should not find this on other servers only if the same
it's a, I don't know, it's a VMware image or something.
Other techniques, same network techniques implies
that you have an Onion.
You try to deanonymize it.
You didn't find anything
but you have a list of all the onions, all the onions,
a lot of onions from the tour network.
And you try to replace the host
Header with each one at a time with the,
which with every onion address from your list.
And maybe one of them will response
as you would request at that onion.
So this implies,
this can help you to increase the attack surface.
You don't need to attack the first onion.
Maybe you can try to deanonyamize the second one.
So right now put on the demo, at the end of the demo
I have something very, very, an impressive finding.
So right now I'm trying to access an HT anything.
to see if that I can trigger the 403 forbidden,
but I have the HTTP 1.1
which the host header of my onion address on TOR.
Now, if I remove the host header, ah okay, now
I, I'm showing you that I don't want to make a lot of noise.
So I put a h dot html, not really big URL
like not found, not found, not found, like how others did.
And if I remove the host header I downgrade the protocol,
you can find a hidden domain on my web server.
And maybe that domain it's publicly available,
you can come from the internet
on it and you can disclose its IP.
Now I try, I'm trying to trigger a bad request
by putting the long header.
So I put a long, long header to trigger the 400 bad request,
and the response will be the same server at and the address.
So the server at hidden domain dot ml.
Another technique is, as I said, is the redirect technique.
So the CSS directory should be available
by default on apache servers,
but only if you visited from the local host.
And right now, if I visit
with my HTP 1.1 protocol with the host header
it redirects me to the onion address.
So nothing was leaked.
If I remove the line and I downgrade the protocol,
now in the response again, we have the domain leaked.
So hidden domain dot ml.
Right now, what I can do it
I'm going to find out more about this domain.
Let's take it's IP address, make who is on it
and maybe it's public from the internet.
That's what I, I'm trying to do right now.
And after that
I'm trying to see if this public address it's
really hosting the TOR hidden service.
So I'm looking at the ETag.
It responds from the, I came from the internet
and it has an ETag.
If I go, I'm going back to the TOR network,
in the next few seconds,
you'll see that it has the same ETag.
And in the end, I will show that the server status
will show me that there is the same server
for this onion and the IP address I visited.
Okay, I'll go to the,
Last demo it's from here.
So I'm right now I configure the hidden domain dot ml.
So this is another configuration.
I configure the hidden domain, in front of,
so I have the in front of hidden domain, the CloudFlare.
So I'm trying to leak the IP address
of a cloud domain,
of a CloudFlare domain.
So I just try to, even I don't downgrade the protocol
for the long header exception,
just for the long header exception it'll treat will it'll
serve me the first virtual host from the configuration file.
So I can leak the IP address of the server
which is protected by CloudFlare.
This is not a problem
in CloudFlare, it is just a problem on the configuration.
Either is not a problem in apache two server.
It's just a problem
in the way we configure the virtual host of our web servers.
So right now I'm trying to insert a long header,
and we'll see what's happening.
This is a default configuration.
So I installed a apache, I put CloudFlare,
then just,
I put a virtual host and then I just send
a long header and let's see what's happening.
Look, I just leak my IP address.
So now maybe it's open for direct requests.
I don't need the CloudFlare anymore.
No, no.
(Round of applause)
So in conclusion,
triggering bad requests for 403 forbidden and so on,
maybe can leak the IP address of your apache server.
You have to choose very carefully
what virtual host you configure, even on CloudFlare
this doesn't help you.
It's not a problem in CloudFlare,
its a problem in how you configure the virtual host.
Try to not to use the certificates
from other projects and disable the service status.
When you give access
to other persons to access your server from local host.
And thank you,
I'm waiting for your questions.
(Round of applause)