OnionAudit

Simple Reconnaissance & Security Scanner for Tor Hidden Services

A lightweight tool for auditing onion sites. Checks for common misconfigurations, information leaks, and security issues.

Features

• Availability monitoring and response timing
• Technology fingerprinting via headers and favicon hashing
• HTTP security header analysis
• Content scanning for sensitive data leaks (emails, IPs, credentials)
• Path enumeration with customizable wordlists
• Image EXIF metadata extraction
• Basic injection vector testing

Requirements

• Python 3.10+
• Tor running locally with Control Port enabled

Installation

chmod +x run.sh
./run.sh

The script handles virtualenv setup and dependencies automatically.

Usage

Interactive Mode

./run.sh

Direct Scan

./run.sh -t http://example.onion

Options

# Select specific modules
./run.sh -t http://example.onion -m headers,leaks

# Exclude modules
./run.sh -t http://example.onion -e images

# Use custom wordlist (50 paths by default, use paths_full.json for 700+)
./run.sh -t http://example.onion -p paths_full.json

# Custom log output
./run.sh -t http://example.onion -o my_scan.log

# Show all options
./run.sh --help

Configuration

Most settings can be tweaked via environment variables. Check .env.example for available options or peek at config.py for defaults.

Tor Setup

For circuit rotation, you need Tor control port access:

# Generate password hash
tor --hash-password "your_password"

# Add to /etc/tor/torrc
HashedControlPassword 16:....

# Set in .env
TOR_PASSWORD=your_password

Optional: Shodan Integration

If you have a Shodan API key, add it to check how many hosts share the same favicon:

SHODAN_API_KEY=your_key_here

The tool works fine without it.

Notes

Use this responsibly. Only scan services you have permission to test. Don't be that person.