Tor detection project

[polonus]

Interesting to find and block Tor malnodes: http://sla.ckers.org/forum/read.php?12,2984
& https://www.dan.me.uk/tornodes
some links: http://proxy.org/tor.shtml & via https://www.google.nl/search?q=tor+ip+list&rlz=1C1CHNQ_nlNL595NL595&oq=tor+ip+list&aqs=chrome..69i57j69i60.4413j0j7&sourceid=chrome&es_sm=122&ie=UTF-8

Check on some example node: htxp://dynamicip-176-212-13-30.pppoe.kirov.ertelecom.ru/
see: http://toolbar.netcraft.com/site_report?url=http://dynamicip-176-212-13-30.pppoe.kirov.ertelecom.ru
http://myip.ms/view/dns/307877/ns8.ertelecom.ru  & http://dnscheck.pingdom.com/?domain=ertelecom.ru

Tor nodes can be determined further by the certs and validity thereof, normally one year.

Wireshark may detect these using tshark: tshark -r tor_traffic.cap -T fields -R "ssl.handshake.certificate" -e x509af.utcTime -e x509s
at.printableString -  use a script to check the cert lifetime (1 year, start: today) and the structure of the cert names (more or less random).
tor port has to be added to  SSL properties.  info credits Kurt Knochner  on Wireshark faq

polonus

Tor node check example:
% Checking IP: 100.37.110.51
%
Status: ACK
Exit-Node: NAK
% TOR-Name: Unnamed
% TOR-Onion-Port: 9002
% TOR-Directory-Port: 9031
% TOR-Flags: Fast Guard HSDir Running Stable V2Dir Valid
% TOR-Exit-Node: NAK
% TOR-Version: Tor 0.2.4.22
% TOR-Full-Version: Tor 0.2.4.22 on Linux
% TOR-Uptime: 1143018
% TOR-Bandwidth-Average-Bytes: 1572864
% TOR-Bandwidth-Burst-Bytes: 3145728
% TOR-Bandwidth-Estimated-Bytes: 1920906
% TOR-Contact:
%
mapping example: http://82.94.251.203/tor/server/all

D