An extendable tool to Collect, Crawl and Monitor onion sites on tor network and index collected information on Elasticsearch
## Introduction
OnionIngestor is based on ThreatIngestor tool structure to enable modular and extendable access for Cyber Threat Intelligence teams so that they can monitor and collect information on hidden sites over tor network.
The project is at it's early stages of development.
## To-do-list
- [ ] Add multiprocessing to improve analyzing speed
- [ ] Add more sources like reddit, gmail, pastebin, twitter and other hidden sites
- [ ] Add more operators like checking changes of the screenshots for monitoring sites, adding yara rules to eliminate false positives
- [ ] Add more notifiers like slack, smpt, discord
## Basic Implementation Logic
The OnionIngestor runs and managers 3 important type of classes:
Sources - These will collect hidden sites from clear net sources like pastebin, twitter, gist and crawled links
Operators - These will process the onion link. For example get the html, take screenshots and run other scanners like [onionscan](https://github.com/s-rah/onionscan)
Notifiers - These will notify the user - daily with a report and if any new changes has occured to a monitoring hidden site
OnionIngestor is designed to run as a daemon where it collects hidden sites from enabled sources and pass it to the operators and
when finished sleep until user defined time and restart the process from the beginning.
## Kibana Dashboard
Dashboard kibana after 2 days of crawling
## Installation
Install requirements
```
pip install -r requirements.txt
```
After the tor client and the installed libraries use the `--help` command to get details of its use.
```
python3 -m onionscraper --help
OnionScraper
An extendable tool to Collect, Crawl and Monitor onion sites on tor network and index collected information on Elasticsearch
Installation:
This application assumes you have python3 and pip3 installed.
pip3 install -r requirements.txt
This software is provided subject to the MIT license stated below.
--------------------------------------------------
MIT License
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
--------------------------------------------------
optional arguments:
-h, --help show this help message and exit
-c CONFIGFILE, --config CONFIGFILE
Path to config file
--log {DEBUG,INFO,WARNING,ERROR,CRITICAL}
Set the logging level, default is INFO
```
The yaml config file contains all the information for OnionIngestor to work
## How-to-run
`python -m onionscan -c config.yml`
will run source modules to collect onion linkd from internet and run all operators to collect and crawl
`python -m onionscan -c config.yml --monitor thisIsAnOnionSiteLink.onion thisIsAnOnionSiteLink.onion`
monitor mode bypasses all type of blacklists
`python -m onionscan -c config.yml --scan thisIsAnOnionSiteLink.onion`
will run all operators without running any source modules
### Operator [Onionscan](https://github.com/s-rah/onionscan)
onionscan --mode analysis -verbose -webport 8081
To run the webapp by onionscan
## Output
The output of the result is json, and in the same format it is sent to the chosen syslog.
```
{
"_index": "darkweb",
"_type": "_doc",
"_id": "ogIkEHMBlDh8pb-30_2O",
"_score": 1,
"_source": {
"onionscan": {
"hiddenService": "nzxj65x32vh2fkhk.onion",
"dateScanned": "2020-07-02T15:27:18.443234981Z",
"online": false,
"performedScans": [
"web",
"tls",
"ssh",
"irc",
"ricochet",
"ftp",
"smtp",
"mongodb",
"vnc",
"xmpp",
"bitcoin",
"bitcoin_test",
"litecoin",
"dogecoin"
],
"webDetected": true,
"tlsDetected": false,
"sshDetected": false,
"ricochetDetected": false,
"ircDetected": false,
"ftpDetected": false,
"smtpDetected": false,
"bitcoinDetected": false,
"mongodbDetected": false,
"vncDetected": false,
"xmppDetected": false,
"skynetDetected": false,
"pgpKeys": null,
"certificates": null,
"bitcoinServices": {
"bitcoin": {
"detected": false,
"userAgent": "",
"prototocolVersion": 0,
"onionPeers": null
},
"bitcoin_test": {
"detected": false,
"userAgent": "",
"prototocolVersion": 0,
"onionPeers": null
},
"dogecoin": {
"detected": false,
"userAgent": "",
"prototocolVersion": 0,
"onionPeers": null
},
"litecoin": {
"detected": false,
"userAgent": "",
"prototocolVersion": 0,
"onionPeers": null
}
},
"sshKey": "",
"sshBanner": "",
"ftpFingerprint": "",
"ftpBanner": "",
"smtpFingerprint": "",
"smtpBanner": "",
"lastAction": "dogecoin",
"timedOut": false,
"error": null,
"identifierReport": {
"privateKeyDetected": false,
"foundApacheModStatus": false,
"serverVersion": "",
"relatedOnionServices": null,
"relatedOnionDomains": null,
"ipAddresses": null,
"emailAddresses": [
OMMITTED
],
"analyticsIDs": null,
"bitcoinAddresses": [
"1A3usPsRyCRPy9z5zpaQoj59hTATnS799d",
"114LbUUXsLc6QynxsTVLcAgHzEkSBB5Yww",
"3FMRCWEv7XqW26mqe526s4ibmEz9qJSmt6",
"19iqYbeATe4RxghQZJnYVFU4mjUUu76EA6",
"3MV9ESE7CTjGJRivnXCE4MUnzpxAYnJNLT",
"37VbgjzwVrM93g6zQrc4XP5RonpwnwKevj",
"1HtuUatKrJSR8PYs2qSxnxvPuYhf8UiCpB",
"1gzm7L4GNbNDUkfWZxQJdZt6b7tjoWzRb",
"112dznTAr3m1PHnkQYK5CpsDJboEiCScwP"
],
"linkedOnions": [
"fagnojbvbqey34qd.onion",
"ytxmxncdn2tjyzid.onion",
"7rsgftiskp4xqlqd.onion",
"hkcr7naqdkmw76gr.onion",
"torbox3uiot6wchz.onion",
"w5oxf255cjcziyyd.onion",
"7g525hcd4cyowmid.onion",
"uaciqctyky5olsid.onion",
"2rdyr63onwhqp3qd.onion",
"dreamdogehwnde5b.onion",
"e5to4n5a325lvsad.onion",
"xwwcqj3jt4dbfeid.onion",
"cryptoupei2am6si.onion",
"o5kq76skl2em3xad.onion",
"k2hwrssoj7yivhid.onion",
"x3dphthawcqtd4id.onion"
],
"openDirectories": null,
"exifImages": null
},
"crawls": [
"http://nzxj65x32vh2fkhk.onion/",
"http://nzxj65x32vh2fkhk.onion/all",
"http://nzxj65x32vh2fkhk.onion/all?page=1",
"http://nzxj65x32vh2fkhk.onion/all?page=2",
"http://nzxj65x32vh2fkhk.onion/all?page=3",
"http://nzxj65x32vh2fkhk.onion/assets/bootstrap/css/bootstrap.min.css",
"http://nzxj65x32vh2fkhk.onion/assets/bootstrap/css/phpdiff.css",
"http://nzxj65x32vh2fkhk.onion/assets/bootstrap/css/stickynotes.css",
"http://nzxj65x32vh2fkhk.onion/assets/bootstrap/img/favicon.png",
"http://nzxj65x32vh2fkhk.onion/assets/bootstrap/js/bootstrap.min.js",
"http://nzxj65x32vh2fkhk.onion/assets/bootstrap/js/jquery.cookie.js",
"http://nzxj65x32vh2fkhk.onion/assets/bootstrap/js/jquery.min.js",
"http://nzxj65x32vh2fkhk.onion/assets/bootstrap/js/jquery.scrollto.js",
"http://nzxj65x32vh2fkhk.onion/assets/bootstrap/js/stickynotes.js",
"http://nzxj65x32vh2fkhk.onion/diff/ptoft0c1l/pbbofkqn1",
"http://nzxj65x32vh2fkhk.onion/docs",
"http://nzxj65x32vh2fkhk.onion/feed",
"http://nzxj65x32vh2fkhk.onion/p0v6zvoin",
"http://nzxj65x32vh2fkhk.onion/p0v6zvoin/ac3zze/raw",
"http://nzxj65x32vh2fkhk.onion/p8nqdddzb",
"http://nzxj65x32vh2fkhk.onion/p8nqdddzb/wafcdu/raw",
"http://nzxj65x32vh2fkhk.onion/p8qorgjj2",
"http://nzxj65x32vh2fkhk.onion/p8qorgjj2/duswuw/raw",
"http://nzxj65x32vh2fkhk.onion/pawgypvjz",
"http://nzxj65x32vh2fkhk.onion/pawgypvjz/7artey/raw",
"http://nzxj65x32vh2fkhk.onion/pbbofkqn1",
"http://nzxj65x32vh2fkhk.onion/pbbofkqn1/j5n49p/raw",
"http://nzxj65x32vh2fkhk.onion/pdmtzkwup",
"http://nzxj65x32vh2fkhk.onion/pdmtzkwup/jfm68l/raw",
"http://nzxj65x32vh2fkhk.onion/pdot84cmm",
"http://nzxj65x32vh2fkhk.onion/pdot84cmm/cgj4qw/raw",
"http://nzxj65x32vh2fkhk.onion/pdubkxy1v",
"http://nzxj65x32vh2fkhk.onion/pdubkxy1v/i3nrxl/raw",
"http://nzxj65x32vh2fkhk.onion/pegkdomcx",
"http://nzxj65x32vh2fkhk.onion/pegkdomcx/s4yquj/raw",
"http://nzxj65x32vh2fkhk.onion/pfgafcrvp",
"http://nzxj65x32vh2fkhk.onion/pfgafcrvp/kxj5lj/raw",
"http://nzxj65x32vh2fkhk.onion/ph62mpvce",
"http://nzxj65x32vh2fkhk.onion/ph62mpvce/kmqnwb/raw",
"http://nzxj65x32vh2fkhk.onion/pjfn3yclj",
"http://nzxj65x32vh2fkhk.onion/pjfn3yclj/u6o2wm/raw",
"http://nzxj65x32vh2fkhk.onion/pkjhtx8tn",
"http://nzxj65x32vh2fkhk.onion/pkjhtx8tn/mgqope/raw",
"http://nzxj65x32vh2fkhk.onion/pl6wwk9go",
"http://nzxj65x32vh2fkhk.onion/pl6wwk9go/4n2h7m/raw",
"http://nzxj65x32vh2fkhk.onion/poppwa9mo",
"http://nzxj65x32vh2fkhk.onion/poppwa9mo/52keri/raw",
"http://nzxj65x32vh2fkhk.onion/ppez6ok6r",
"http://nzxj65x32vh2fkhk.onion/ppez6ok6r/xtgf4l/raw",
"http://nzxj65x32vh2fkhk.onion/pqnih2eus",
"http://nzxj65x32vh2fkhk.onion/pqnih2eus/mchmij/raw",
"http://nzxj65x32vh2fkhk.onion/private_key",
"http://nzxj65x32vh2fkhk.onion/psfl80ry1",
"http://nzxj65x32vh2fkhk.onion/psfl80ry1/fzpoil/raw",
"http://nzxj65x32vh2fkhk.onion/pswvhb2u2",
"http://nzxj65x32vh2fkhk.onion/pswvhb2u2/bwypdr/raw",
"http://nzxj65x32vh2fkhk.onion/psxsbptqy",
"http://nzxj65x32vh2fkhk.onion/psxsbptqy/ac2fwg/raw",
"http://nzxj65x32vh2fkhk.onion/ptoft0c1l",
"http://nzxj65x32vh2fkhk.onion/ptoft0c1l/jekdce/raw",
"http://nzxj65x32vh2fkhk.onion/pufx3aabu",
"http://nzxj65x32vh2fkhk.onion/pufx3aabu/jkf8k7/raw",
"http://nzxj65x32vh2fkhk.onion/pvxlo9hda",
"http://nzxj65x32vh2fkhk.onion/pvxlo9hda/tx5qns/raw",
"http://nzxj65x32vh2fkhk.onion/pweo3qenp",
"http://nzxj65x32vh2fkhk.onion/pweo3qenp/fjn8ok/raw",
"http://nzxj65x32vh2fkhk.onion/pwgegfzoe",
"http://nzxj65x32vh2fkhk.onion/pwgegfzoe/ad13am/raw",
"http://nzxj65x32vh2fkhk.onion/pxn7di53e",
"http://nzxj65x32vh2fkhk.onion/pxn7di53e/7gqdtb/raw",
"http://nzxj65x32vh2fkhk.onion/pxppe2cwf",
"http://nzxj65x32vh2fkhk.onion/pxppe2cwf/pdwog7/raw",
"http://nzxj65x32vh2fkhk.onion/pyb041lxb",
"http://nzxj65x32vh2fkhk.onion/pyb041lxb/m10i4y/raw",
"http://nzxj65x32vh2fkhk.onion/pyd5xhkct",
"http://nzxj65x32vh2fkhk.onion/pyd5xhkct/r0oupe/raw",
"http://nzxj65x32vh2fkhk.onion/pz7ltroub",
"http://nzxj65x32vh2fkhk.onion/pz7ltroub/4tfvri/raw",
"http://nzxj65x32vh2fkhk.onion/pzkraz18q",
"http://nzxj65x32vh2fkhk.onion/pzkraz18q/jhh2tn/raw",
"http://nzxj65x32vh2fkhk.onion/rev/p0v6zvoin",
"http://nzxj65x32vh2fkhk.onion/rev/p8nqdddzb",
"http://nzxj65x32vh2fkhk.onion/rev/p8qorgjj2",
"http://nzxj65x32vh2fkhk.onion/rev/pawgypvjz",
"http://nzxj65x32vh2fkhk.onion/rev/pbbofkqn1",
"http://nzxj65x32vh2fkhk.onion/rev/pdmtzkwup",
"http://nzxj65x32vh2fkhk.onion/rev/pdot84cmm",
"http://nzxj65x32vh2fkhk.onion/rev/pdubkxy1v",
"http://nzxj65x32vh2fkhk.onion/rev/pegkdomcx",
"http://nzxj65x32vh2fkhk.onion/rev/pfgafcrvp",
"http://nzxj65x32vh2fkhk.onion/rev/ph62mpvce",
"http://nzxj65x32vh2fkhk.onion/rev/pjfn3yclj",
"http://nzxj65x32vh2fkhk.onion/rev/pkjhtx8tn",
"http://nzxj65x32vh2fkhk.onion/rev/pl6wwk9go",
"http://nzxj65x32vh2fkhk.onion/rev/poppwa9mo",
"http://nzxj65x32vh2fkhk.onion/rev/ppez6ok6r",
"http://nzxj65x32vh2fkhk.onion/rev/pqnih2eus",
"http://nzxj65x32vh2fkhk.onion/rev/psfl80ry1",
"http://nzxj65x32vh2fkhk.onion/rev/pswvhb2u2",
"http://nzxj65x32vh2fkhk.onion/rev/psxsbptqy",
"http://nzxj65x32vh2fkhk.onion/rev/ptoft0c1l",
"http://nzxj65x32vh2fkhk.onion/rev/pufx3aabu",
"http://nzxj65x32vh2fkhk.onion/rev/pvxlo9hda",
"http://nzxj65x32vh2fkhk.onion/rev/pweo3qenp",
"http://nzxj65x32vh2fkhk.onion/rev/pwgegfzoe",
"http://nzxj65x32vh2fkhk.onion/rev/pxn7di53e",
"http://nzxj65x32vh2fkhk.onion/rev/pxppe2cwf",
"http://nzxj65x32vh2fkhk.onion/rev/pyb041lxb",
"http://nzxj65x32vh2fkhk.onion/rev/pyd5xhkct",
"http://nzxj65x32vh2fkhk.onion/rev/pz7ltroub",
"http://nzxj65x32vh2fkhk.onion/rev/pzkraz18q",
"http://nzxj65x32vh2fkhk.onion/server-status",
"http://nzxj65x32vh2fkhk.onion/trending",
"http://nzxj65x32vh2fkhk.onion/trending/all",
"http://nzxj65x32vh2fkhk.onion/trending/all?page=1",
"http://nzxj65x32vh2fkhk.onion/trending/all?page=2",
"http://nzxj65x32vh2fkhk.onion/trending/all?page=3",
"http://nzxj65x32vh2fkhk.onion/trending/month",
"http://nzxj65x32vh2fkhk.onion/trending/month?page=1",
"http://nzxj65x32vh2fkhk.onion/trending/month?page=2",
"http://nzxj65x32vh2fkhk.onion/trending/month?page=3",
"http://nzxj65x32vh2fkhk.onion/trending/week",
"http://nzxj65x32vh2fkhk.onion/trending/week?page=1",
"http://nzxj65x32vh2fkhk.onion/trending/week?page=2",
"http://nzxj65x32vh2fkhk.onion/trending/week?page=3",
"http://nzxj65x32vh2fkhk.onion/trending/year",
"http://nzxj65x32vh2fkhk.onion/trending/year?page=1",
"http://nzxj65x32vh2fkhk.onion/trending/year?page=2",
"http://nzxj65x32vh2fkhk.onion/trending/year?page=3",
"http://nzxj65x32vh2fkhk.onion/trending?page=1",
"http://nzxj65x32vh2fkhk.onion/trending?page=2",
"http://nzxj65x32vh2fkhk.onion/trending?page=3",
"http://nzxj65x32vh2fkhk.onion/user/forgot",
"http://nzxj65x32vh2fkhk.onion/user/login",
"http://nzxj65x32vh2fkhk.onion/user/register"
]
},
"html": "\n\n\n\n\n\t\n\t\n\tStronghold Paste\n\n\t\n\n\t\n\t\n\t\n\n\t\n\t\n\t\n\t\n\t\n\t\n\n\t\n\n\n\n\t
\n\t\t\n\t\n\tLoading\n\n\t
\n\n\t\n\n\t
\n\t\t\n\t\t\t
\n\t
\n\t\t\n\t\t\n\t\t\t
\n
\n\n\t\n\t\t\n\t\n\n\t\t\t
\n\n\t\n\n\n\n",
"screenshots": {
"dateScreenshoted": "2020-07-02T15:28:35.722031Z",
"filename": "nzxj65x32vh2fkhk.onion_screenshot_a692c810.png"
},
"interestingKeywords": [
"rss",
"xml",
"RSS",
"feed",
"xml",
"XML",
"xml",
"XML"
]
},
"fields": {
"screenshots.dateScreenshoted": [
"2020-07-02T15:28:35.722Z"
],
"onionscan.dateScanned": [
"2020-07-02T15:27:18.443Z"
]
}
}
```
## Authors
Daniele Perera
# Disclaimer
OnionIngestor is a platform which makes use of many other open source projects, many of which have their own licenses. OnionIngestor does not claim ownership of any projects that it uses, and does not represent any of said projects. To the best of the Author's knowledge, the use of these tools in the OnionIngestor is not violating any licenses. OnionIngestor is a free and open source project that does not make, nor seeks to make, any revenue from the use of the other open source tools in use. Developers assume no liability and are not responsible for any misuse or damage caused by this program. It's the end user's responsibility to obey all applicable local, state and federal laws while using OnionIngestor.
### Credits
* Rosy Battaglia for the amazing logo that she created for this project! Check her on [instagram](https://www.instagram.com/royxhe/)
* ThreatIngestor for backbone logic for sources, operators! Check [here](https://github.com/InQuest/ThreatIngestor)
* VigilantOnion for some sources logic! Check [here](https://github.com/andreyglauzer/VigilantOnion)
* onionscan the best tool that I have found to scan an onion link! Check [here](https://github.com/s-rah/onionscan)
* Justin from automatingosint! Without his blog I woudn't have made it. Check [here](http://www.automatingosint.com/blog/2016/07/dark-web-osint-with-python-and-onionscan-part-one/)
Their code was used to implement this project
Feel free to fork or open an issue to collaborate with the project.
## License
This project is licensed under the [MIT](https://choosealicense.com/licenses/mit/) License - see the LICENSE.md file for details.
