Hey everyone!
I just launched a website that combines legendary posts ( from tforum ) that have made headlines and impacted the dark web and also some posts that really touched my heart as a tforum lover.
"I have an older account on tforum, but I don't want to link my profile to my website."
I would love some help checking for any vulnerabilities on the site , i used my server . I’m new to this and unsure if my IP is leaking or if there are other potential issues. Any tips or feedback would be greatly appreciated!
Please let me know what you think about the website, and feel free to suggest anything to add or improve. All comments are welcome!
this is the link
tforumz3g6qzw6sciun2dxi2numera72vzlerhfcd3w2jaz4zsuvvmcyd.onion
🔍 1. Check for IP Leaks
To ensure your real IP isn't leaking:
✅ Run curl from another machine:
bash
curl --proxy socks5h://127.0.0.1:9050 http://check.torproject.org
If it says "Congratulations. This browser is configured to use Tor.", your site is correctly routed.
If it shows a clearnet IP, your real server IP might be leaking!
✅ Use OnionScan (Tor Hidden Service Security Scanner):
bash
git clone https://github.com/s-rah/onionscan.git
cd onionscan
go build
./onionscan tforumz3g6qzw6sciun2dxi2numera72vzlerhfcd3w2jaz4zsuvvmcyd.onion
This will check for metadata leaks, misconfigured servers, and exposed services.
🛡 2. Secure Your Server
Disable WebRTC (can leak IP in browsers).
Use Tor's HiddenServiceVersion 3 (HiddenServiceVersion 3 in torrc).
Never use default ports (e.g., 80, 443)—change them to custom ports.
Isolate the database (run it locally, not exposed to the internet).
Use Firejail or Qubes for sandboxing your server environment.
📡 3. Check for Open Ports & Misconfigurations
✅ Run an Nmap scan on yourself:
bash
nmap -sT -p- -Pn tforumz3g6qzw6sciun2dxi2numera72vzlerhfcd3w2jaz4zsuvvmcyd.onion
This will reveal any open ports that shouldn't be exposed.
✅ Check for metadata leaks in images:
bash
exiftool image.jpg
Ensure no EXIF data (GPS, author names, etc.) is present in uploaded images.
🔐 4. Secure Your Web Application
Sanitize inputs (to prevent SQL injection & XSS).
Use Content Security Policy (CSP) headers.
Avoid JavaScript-heavy features unless needed.
If using PHP, disable expose_php = Off in php.ini.
📢 5. Community Review & Testing
Ask trusted individuals to test your site using different setups.
Use a sandboxed, isolated environment for testing.
Consider using CSP & Subresource Integrity (SRI) to prevent MITM attacks.
To ensure your real IP isn't leaking:
✅ Run curl from another machine:
bash
curl --proxy socks5h://127.0.0.1:9050 http://check.torproject.org
If it says "Congratulations. This browser is configured to use Tor.", your site is correctly routed.
If it shows a clearnet IP, your real server IP might be leaking!
✅ Use OnionScan (Tor Hidden Service Security Scanner):
bash
git clone https://github.com/s-rah/onionscan.git
cd onionscan
go build
./onionscan tforumz3g6qzw6sciun2dxi2numera72vzlerhfcd3w2jaz4zsuvvmcyd.onion
This will check for metadata leaks, misconfigured servers, and exposed services.
🛡 2. Secure Your Server
Disable WebRTC (can leak IP in browsers).
Use Tor's HiddenServiceVersion 3 (HiddenServiceVersion 3 in torrc).
Never use default ports (e.g., 80, 443)—change them to custom ports.
Isolate the database (run it locally, not exposed to the internet).
Use Firejail or Qubes for sandboxing your server environment.
📡 3. Check for Open Ports & Misconfigurations
✅ Run an Nmap scan on yourself:
bash
nmap -sT -p- -Pn tforumz3g6qzw6sciun2dxi2numera72vzlerhfcd3w2jaz4zsuvvmcyd.onion
This will reveal any open ports that shouldn't be exposed.
✅ Check for metadata leaks in images:
bash
exiftool image.jpg
Ensure no EXIF data (GPS, author names, etc.) is present in uploaded images.
🔐 4. Secure Your Web Application
Sanitize inputs (to prevent SQL injection & XSS).
Use Content Security Policy (CSP) headers.
Avoid JavaScript-heavy features unless needed.
If using PHP, disable expose_php = Off in php.ini.
📢 5. Community Review & Testing
Ask trusted individuals to test your site using different setups.
Use a sandboxed, isolated environment for testing.
Consider using CSP & Subresource Integrity (SRI) to prevent MITM attacks.
Great help, exactly what I needed! Thanks so much. If anyone has the time to try this on my link, I would really appreciate it. I'll try and test everything out, and I hope it's helpful for beginners too.
Directory enumeration can be done. For valid directory you give a 304, but blank page. For not existent you give 404. Give 403 or 404 for both, just to make it harder for attackers.
But this is a static site, so it's pretty much okay.
But this is a static site, so it's pretty much okay.
You don't show up on Censys yet so I don't believe your IP is leaking but it might just be taking a while to show up.
You just copy/pasted some random AI. It's fine to use AI for some stuff, but if you don't understand the question enough to be specific, AI will give you incorrect or irrelevant answers.
🔍 1. Check for IP Leaks
This has nothing to do with stopping leaks on a web server that's hosting a .onion. This command simply checks if Tor's default local SOCKS proxy on port 9050 is working. The webserver's tor might not have a SocksPort defined, since it's not necessary to host a .onion. You only need a webserver listening on localhost. And even if you do have tor's default SOCKS proxy running, this curl command isn't going to tell you about some random PHP/whatever page on the site that's disclosing sensitive information about the system's networking (for example).
✅ Use OnionScan (Tor Hidden Service Security Scanner):
OnionScan's last release was in 2016. There are more updated projects like N4rr34n6's OnionScanner on github, but you could also just use a regular scanner like nikto or whatever, anything that supports SOCKS proxies. Just tell it to use your local tor's SOCKS proxy and point it at a .onion you want to scan.
🛡 2. Secure Your Server
This is for preventing leaks client-side, not server-side. WebRTC requires JS anyways, which most Tor Browser users would have disabled.
v2 Hidden Services were deprecated on October 15th, 2021. v3 has been the default since then.
This has nothing to do with preventing your .onion server's real IP from leaking.
I guess technically this could cause potential leaks, if your .onion uses a database on a remote clearnet server, and some error on your site causes that server's IP to be disclosed.
This is good advice, especially if you setup the jail/namespace/sandbox so that it can only access the internet via Tor.
📡 3. Check for Open Ports & Misconfigurations
✅ Run an Nmap scan on yourself:
This is stupid because if it's your .onion, you can just look in the torrc to see what ports you're serving.
✅ Check for metadata leaks in images:
This is good advice, if you or your website's users are posting arbitrary images.
🔐 4. Secure Your Web Application
Well, duh.
And to OP:
If you're just hosting a simple static webpage, you probably don't have to worry about leaks. Most modern web servers (nginx, Apache, whatever) don't serve pages by default that could disclose the kind of information that a .onion operator would consider sensitive. The web server's banner might be sensitive if the website is also listening on a clearnet address. I.e., if you're not using nginx's "server_tokens off" or Apache's "ServerTokens Prod", then someone could see the exact Apache/nginx version your .onion is using, then use masscan to scan the whole internet for websites using that same version, then just request files they saw on your .onion to confirm that it's the same server. Or if it's unique enough, they could just request the file and ignore the banner completely.
If you ever plan on doing something more complex than a static page, then I would look into either virtualization or namespaces to ensure that no non-Tor internet traffic ever leaves the server hosting the .onion.
🔍 1. Check for IP Leaks
curl --proxy socks5h://127.0.0.1:9050 http://check.torproject.org
This has nothing to do with stopping leaks on a web server that's hosting a .onion. This command simply checks if Tor's default local SOCKS proxy on port 9050 is working. The webserver's tor might not have a SocksPort defined, since it's not necessary to host a .onion. You only need a webserver listening on localhost. And even if you do have tor's default SOCKS proxy running, this curl command isn't going to tell you about some random PHP/whatever page on the site that's disclosing sensitive information about the system's networking (for example).
✅ Use OnionScan (Tor Hidden Service Security Scanner):
OnionScan's last release was in 2016. There are more updated projects like N4rr34n6's OnionScanner on github, but you could also just use a regular scanner like nikto or whatever, anything that supports SOCKS proxies. Just tell it to use your local tor's SOCKS proxy and point it at a .onion you want to scan.
🛡 2. Secure Your Server
Disable WebRTC (can leak IP in browsers).
This is for preventing leaks client-side, not server-side. WebRTC requires JS anyways, which most Tor Browser users would have disabled.
Use Tor's HiddenServiceVersion 3 (HiddenServiceVersion 3 in torrc)
v2 Hidden Services were deprecated on October 15th, 2021. v3 has been the default since then.
Never use default ports (e.g., 80, 443)—change them to custom ports
This has nothing to do with preventing your .onion server's real IP from leaking.
Isolate the database (run it locally, not exposed to the internet).
I guess technically this could cause potential leaks, if your .onion uses a database on a remote clearnet server, and some error on your site causes that server's IP to be disclosed.
Use Firejail or Qubes for sandboxing your server environment.
This is good advice, especially if you setup the jail/namespace/sandbox so that it can only access the internet via Tor.
📡 3. Check for Open Ports & Misconfigurations
✅ Run an Nmap scan on yourself:
This is stupid because if it's your .onion, you can just look in the torrc to see what ports you're serving.
✅ Check for metadata leaks in images:
This is good advice, if you or your website's users are posting arbitrary images.
🔐 4. Secure Your Web Application
Well, duh.
And to OP:
If you're just hosting a simple static webpage, you probably don't have to worry about leaks. Most modern web servers (nginx, Apache, whatever) don't serve pages by default that could disclose the kind of information that a .onion operator would consider sensitive. The web server's banner might be sensitive if the website is also listening on a clearnet address. I.e., if you're not using nginx's "server_tokens off" or Apache's "ServerTokens Prod", then someone could see the exact Apache/nginx version your .onion is using, then use masscan to scan the whole internet for websites using that same version, then just request files they saw on your .onion to confirm that it's the same server. Or if it's unique enough, they could just request the file and ignore the banner completely.
If you ever plan on doing something more complex than a static page, then I would look into either virtualization or namespaces to ensure that no non-Tor internet traffic ever leaves the server hosting the .onion.
I do not use any AI even after having my own version of uncensored custom made AI. All the points are my own, I am OPSE, OSCP certified professional. I am writing from the prospective of a Penetration Tester. I would suggest you to think from multiple prospective running to conclusions.
Website created should be safer for owner as well as for user(clients) to make it a safe place for everyone. Usually most of the breaches/exploits are for clients not server.
V3 is default but it has option to select older. So Suggested is v3.
He asked any other suggestions as well so this was suggested as per basic security parameters.
Prevents Direct External Queries – No one can connect to the database remotely, reducing attack risks.
Stops Accidental External Requests – Misconfigured databases won’t leak IPs via DNS lookups or external logging.
Prevents Proxy/Tor Bypass – Ensures all traffic goes through intended privacy layers (e.g., Tor, VPN).
Eliminates Attack Surface – Blocks bots/scanners from exploiting open database ports.
Enhances Isolation & Security – Binding to 127.0.0.1, using strong authentication, and disabling external logging further protect the server.
This is for preventing leaks client-side, not server-side. WebRTC requires JS anyways, which most Tor Browser users would have disabled.
Website created should be safer for owner as well as for user(clients) to make it a safe place for everyone. Usually most of the breaches/exploits are for clients not server.
v2 Hidden Services were deprecated on October 15th, 2021. v3 has been the default since then.
V3 is default but it has option to select older. So Suggested is v3.
This has nothing to do with preventing your .onion server's real IP from leaking.
He asked any other suggestions as well so this was suggested as per basic security parameters.
This has nothing to do with preventing your .onion server's real IP from leaking.
Prevents Direct External Queries – No one can connect to the database remotely, reducing attack risks.
Stops Accidental External Requests – Misconfigured databases won’t leak IPs via DNS lookups or external logging.
Prevents Proxy/Tor Bypass – Ensures all traffic goes through intended privacy layers (e.g., Tor, VPN).
Eliminates Attack Surface – Blocks bots/scanners from exploiting open database ports.
Enhances Isolation & Security – Binding to 127.0.0.1, using strong authentication, and disabling external logging further protect the server.