EvilZone

Hosting a .onion site is not going to make you anonymous.  Not in the slightest.  I believe that the .onion TLD is part of a DNS root hosted by Tor and only accessible through Tor or maybe though using their DNS server.  I don't know what the process for registering a .onion domain is.  There might be less requirements to turn over information for .onion than with other TLDs, but that's not going to make you anonymous.


Use of a specific TLD will not make you anonymous.  Where you're going to run into trouble staying anonymous is with the server.  You're going to need to have a server hosted somewhere that people won't be able to hunt for you.  In most cases, a hosting provider's privacy policy will be enough, as long as you don't host sites with domains that are known to be owned by you or anything like that.  If you're trying to evade the law, which I do not support, you're going to need to host the server in a country that won't cooperate with your country's law enforcement agencies.  Even then, the NSA might try to do things like hack your server to install spyware and catch you that way, depending on how popular your server is.  Staying anonymous from governments is very difficult.

Domain names go to IP addresses.  These IP addresses identify the device connected to the internet.  If you host a server for publishing a drug market website, it doesn't matter if you use .onion for your domain name; it will lead to your IP address if you host the server in your house, which will lead to the police breaking down your door.

Not true.
Domain names used for tor hidden services aren't actually domain names. You don't register them the way you would with a normal domain name. It works using key pairs, just like bitcoin. When you are creating a hidden service (a .onion service), you generate a key pair (private key + public key). The public key his hashed and halved, and this is the "domain name" for the hidden service. That's why they are generally random looking strings and hard to remember. Having the private key is what gives you ownership of that "domain".

As for finding the ip address of the server, that isn't as simple as you think it is. With tor hidden services, domains don't map back to server ip addresses. You cannot find a servers ip address when only given the hidden service url. The whole point of the hidden service is to mask the location of the server hosting the content. However, it is still possible for the server to be hacked over tor, and this could expose the servers real ip address.

The risks associated depend on what your plans are. You mentioned bitcoin wallets, if you plan on starting up and wallet service or marketplace over tor I would refrain from doing so. In order to safely run either of those services securely a great deal of technological skill and experience is required. With bitcoins being so valuable right now, anything which stores them is a huge target. So unless you are confident in your ability to protect your server from a hoard of cyber criminals looking for bitcoins, and potentially law enforcement depending on what it is you're setting up I'd stay away.

But to answer your question, it is extremely hard to trace a .onion domain to a person, unless you hack the server.

You should check you have disabled directory listing on your server. Although it shouldn't allow someone to read the source code, it makes it easy to map the web application and may expose some sensitive files.

If the login/register pages are just refreshing when you attempt to submit data it is possible that you've been linked to a phishing page.

I'm on the silkroad just now and everything's working fine for me.
Here is the correct link to the silkroad, make sure that the one you're visiting is the same. http://silkroadvb5piz3r.onion/

If you have the noscript plugin you might want to try enabling javascript for the silkroad, but be warned that could endanger your anonymity if the site was compromised, but unless you're buying things you don't really need to worry about that   (If enabling javascript works I'd recommend disabling it once you've created your account)

Dual-booting BackTrack is unnecessary. I'd recommend just running it in a virtual machine. It's simpler and safer (any damage done by running as root can easily be reversed). It's also more flexible for setting up networks to test.

BackTrack is good for bug research and penetration testing. It comes pre-installed with lots of useful tools which could take a long time to install and configure manually on a normal Linux distro.

As mentioned by WirelessDesert, Kali Linux is the successor to BackTrack. One of the noticeable differences is that all the pre-installed programs are either located or linked in /etc/bin meaning that you can run them directly from the terminal window without having to cd down the /pentest directory which you would have to do in BackTrack. Not a major improvement, but it does save a bit of time.

Even if you're innocent it's best to stay silent. Cops are good at tricking you and twisting your words.

Just remember that anything you say can ONLY be used AGAINST YOU.

Have a look at this site: http://www.lowendbox.com/

They post lots of deals for vps servers. For example, for $10 per YEAR you can get a low end vps with 500gb bandwidth limit (limit per month). Use it as a vpn when torrenting.

Automation, special characters and buffer limitations....


@OP:

Might I suggest you do argument count fuzzing as well. No arguments, the correct amount of arguments, hell of a lot of arguments and fuzz the arguments themselves with a mix of valid and invalid arguments etc. The idea here is to get past some input checks to fuzz the most amount of code.

Thanks for the feedback.

What you're talking about is already possible with this, however the user would have to enter each argument individually in the tests.txt file which isn't ideal, and I agree it should be automated or else it defeats the purpose of using this. I'll get on it eventually