starius / onion2web

Access .onion sites without Tor Browser

onion2web

Access .onion sites without Tor Browser

Homepage.

Dependency: lua-resty-socks5.

Paper (in Russian).

Installation

$ sudo luarocks install onion2web

Reference

This module contains the following functions:

• onion2web.handle_onion2web(onion_replacement, torhost='127.0.0.1', torport=9050, confirmation=true) - accept request to onion2web site. onion_replacement is part of gateway domain name, which replaces .onion (e.g., .onion.gq). torhost and torport are Tor address and SocksPort. If confirmation is true (the default), then the confirmation page is shown instead of contents of a hidden service until a user accepts the terms.

How to use this module to forward requests from xxx.onion.gq to xxx.onion:

server {
    listen 80;
    server_name *.onion.gq;
    location / {
        default_type text/html;
        content_by_lua '
            require("onion2web").handle_onion2web(".onion.gq");
        ';
    }
}

To blacklist some .onion sites:

server {
        listen   80;
        server_name
.badonion12345678.onion.gq
.anotherbadonion1.onion.gq
;
        return 403;
}

onion2web's Issues

Not always working

Sometimes, when my clients connect, it shows "500 Internal Server Error." I know it's connecting because your "agree to terms" page shows up, but it won't connect to the actual site (which shows up on Tor).

let user to view content without Cookie and Javascript

http://hss3uro2hsxfogfq.onion.gq/

When I click the button below "THIS SERVER IS A PROXY AND IT'S NOT HOSTING THE TOR HIDDEN SERVICE SITE hss3uro2hsxfogfq.onion", I got nothing.

Can't you make this work without Cookie and Javascript?

if _test==time, then allow access from this IP

login to https onion sites

Test: https://facebookcorewwwi.onion/

https.facebookcorewwwi.onion.gq ?

antivirus companies consider the service to be a botnet

Some botnet owners seem to use onion gates like onion.gq to connect infected machines to the master of the botnet which is located in onion. Some other people report this:

• http://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/troj_crypctb.sme
• https://malwaretips.com/threads/connects-to-tor-hidden-services-through-tor2web.42274/

That is why my server serving service onion.gq was suspended again yesterday.

Does somebody know abuse resistant ISP to host it?

Another approach I want to try is adding JavaScript puzzle on confirmation page to make it harder to connect from non-browser HTTP agents (like botnet agents).

onion.gp & onion.lt and others: Web Radio stream not delivered

Can not listen to web-radios from 76qugh5bey5gum7l.onion in particular 76qugh5bey5gum7l.onion/BaroqueRadio . I suspect the server tries to download the stream fully before start sending it to me, which is a pointless/dangerous/stupid behavior with a never ending web-radio-stream. May exploitable for DOS.

early EOF

$ torsocks wget -O normal.woff 'http://tetatl6umgbmtv27.onion/resources/font-awesome/fonts/fontawesome-webfont.woff?v=4.0.3'
$ curl -H 'Cookie: onion2web_confirmed=true' 'http://tetatl6umgbmtv27.onion.gq/resources/font-awesome/fonts/fontawesome-webfont.woff?v=4.0.3' > gq.woff
$ wc --bytes gq.woff normal.woff 
44032 gq.woff
44432 normal.woff

confirmation=false doesn't work

[problem of onion.gq] enable access through https

We need SSL certificate for *.onion.gq

[problem of onion.gq] enable Tor's option Tor2webMode

Please block pedo sites from .Gq

Block pedo sites from onion.Gq

I agree please block child porn on onion.gq

Reading the last post on the issue page a guy mentioned that onion.gq needs to start blocking the child porn sites. I stopped using onion.gq for a while because you could accidentally enter these sick and depraved sites EASLY!. I started using .rip .Cab and .Link. But they run like garbage but atleast they block such sites. I would love to see onion.gq have a ''report page'' button. I have hopes for onion.gq to be successful and be used more. But they need to block child pornography sites.

subdomains doesn't work

http://www.stariusluxrdfjch.onion.gq/