Is creating a darkweb server as a noob a good idea ?

first of all hackers will be there if you want it or not, on darknet and on clearnet.

second just investigate and learn how you can be attacked and how you can protect against it, its best practice to also learn defense as a developer and not only development.

generally just make sure you know what you are doing and by knowing i don't mean have experience in, i mean investigate, question and test.

things i think you must learn/do(if you don't already know):

1. tor website usually equals no js at all, which means 99% server side rendered, this will affect what you can and cannot do in your websites and also features you can use.

2. reverse proxy, ddos protection and nginx.

3. i don't know if you use laravel but it will make your life easier(at east this is how i feel).

4. understand tor and hidden services.

if you want to ask questions feel free to dm me :)

This. LOL.

You figure out pretty quickly when you run an onion service that you're attacked basically right away.

Thanx , idk im just looking to get experience in server end sites anyways , my prototype site is built on php and uses ubuntu should i use vps to try and test securiy that way ?

ill suggest taking something lighter for a server, like debian (should be 100% compatible with ubunthu as its based on debian, just some extra package installation).

security is a big subject i think you can start with cleaning sqli and xss from your inputs and using orm for database stuff, this will remove any human errors almost completely(usually), learn about nginx and reverse proxy

I suppose you could look at it as a learning experience. If someone very dedicated decides that they want to hack you they, probably will, though again, look at it as a challenge, have fun and get the most of it.

When someone tries DDOSing you for example, start researching on how to prevent that, ask for help on the forums, etc.

Besides if you dont intend to allow anything illegal there, from what i know using tor itself is not illegal? Not sure about hosting a webapp though.

TLDR: in my opinion: go for it.

Edit: There are hackers on the clearnet too btw.

This may not be a good example but one time someone i know IRL hit my site with a shitty DDOS attack and he just started refreshing my homepage.

Basically i could see his home IP in the logs, it was funny.

the site is almost ready but i dont if i should use vps or home server , but i dont know to what extent someone can exploit my server, like DDOS attack would sure be bad but what if someone planted CSAM and called police ?

thanx

That is why you need to maintain proper opsec, protect your server from getting hacked in the first place.

You can do all of that by using the search bar here on tforum and/or google.

[removed]

Just reading the first line of your post is enough to tell you not to even think about doing it. There are so many things you're not considering...

2 years of PHP + JS is not even near for what you need, what the fuck.

PGP integration, 2FA, messaging, message auto-encryption, the complete backend, admin panel, disputes—I could go on all day.

Do you even have any cybersecurity knowledge? How are you going to limit brute-force directory attacks? Brute-force attacks on login, applying rate-limiting/PoW... Do you even know the basics of web/backend vulnerabilities?

Will you be using Nginx? Do you know how to configure it to avoid exposing headers?

Before using PHP, do you even heared of Go? At least the market will be built and they won't have access to the source code (which won't save you from the feds).

PHP

Will you use "native" PHP or frameworks like Laravel? Are you aware of the vulnerabilities of the libraries you plan to use?

Two years of experience against dedicated agencies/department teams trying to capture you, with five times your experience. You are so damn fucking crazy...

If that weren't enough, have you thought about the money you'll spend on servers? You also have to promote your site and obviously pay for it, do marketing in general...

And even if you had all the necessary requirements, the market would most likely die like many others due to lack of marketing or other things.

Forget about this idea, you will be prison's candy. Get a job and focus on growing your knowledge, make a career as a full stack developer and get cybersecurity knowledge too. Then, and only then, you can start considering the idea, but still, you will struggle with the marketing. Good luck.