🧅 Complete Guide: OSINT and Scanner Implementation for Onion Sites in MyZubster

#scanner #onion #web #myzubster

A detailed guide on how we implemented analysis and scanning tools for onion sites, with practical examples and use cases.
📌 Introduction

MyZubster is a decentralized ecosystem combining Monero, Tari, Kali Linux, and DeepSeek AI. In this article, I'll show you how we integrated a suite of OSINT (Open Source Intelligence) scanners to analyze onion sites, extract information, and identify vulnerabilities—all integrated into our gateway.
🎯 What We Implemented
Component Description
/api/scanner Routes Endpoints for scanning onion sites
Nmap via Tor Port scanning via SOCKS5 proxy
Headers Analyzer HTTP header analysis (CSP, CORS, Server)
Endpoint Scanner Detection of active APIs (/api/health, /api/tokens)
OSINT Scripts BTC/XMR wallet extraction from HTML pages
Metasploit Integration (Optional) Scanning with Metasploit via Tor
🏗️ Architecture
text

┌─────────────────────────────────────────────────────────────────────────────┐
│ MyZubster Scanner Suite │
├─────────────────────────────────────────────────────────────────────────────┤
│ │
│ ┌──────────────────────────────┐ ┌──────────────────────────────────┐ │
│ │ /api/scanner/onionscan │ │ /api/scanner/headers │ │
│ │ – Nmap via proxychains │ │ – HTTP Headers │ │
│ │ – Port scanning │ │ – CSP, CORS, Server │ │
│ └──────────────────────────────┘ └──────────────────────────────────┘ │
│ │
│ ┌──────────────────────────────┐ ┌──────────────────────────────────┐ │
│ │ /api/scanner/endpoints │ │ /api/scanner/full │ │
│ │ – Common endpoint testing │ │ – All scans combined │ │
│ └──────────────────────────────┘ └──────────────────────────────────┘ │
│ │
│ ┌──────────────────────────────────────────────────────────────────────┐ │
│ │ Tor Proxy (SOCKS5 on 9050) │ │
│ │ – All traffic routed through Tor │ │
│ │ – .onion address resolution │ │
│ └──────────────────────────────────────────────────────────────────────┘ │
└─────────────────────────────────────────────────────────────────────────────┘

🛠️ Technical Implementation

Routing Through Tor

All scanning traffic is routed through Tor's SOCKS5 proxy:
javascript

const PROXY = {
'http': 'socks5h://127.0.0.1:9050',
'https': 'socks5h://127.0.0.1:9050'
};

Port Scanning with Nmap javascript

const cmd = proxychains4 nmap -sT -Pn -p 80,443,22,8080,3000 ${target};
const { stdout } = await execPromise(cmd);

HTTP Headers Analysis javascript

const cmd = curl --socks5-hostname 127.0.0.1:9050 -I -m 30 http://${target};
const { stdout } = await execPromise(cmd);

Endpoint Discovery javascript

const ENDPOINTS = ['/', '/api/health', '/api/tokens', '/login', '/dashboard'];
for (const endpoint of ENDPOINTS) {
const url = http://${target}${endpoint};
// Test each endpoint
}

🧪 Live Test on an Onion Market

We tested our scanner on a live onion market: awazonsnag7pv4jxhfeiw37nuibg3gibokou2sawcgucapt3d2tyggid.onion
Test Results
Test Result
Port Scanning Port 80 open (HTTP), Port 22 closed, Port 443 closed
Headers X-Powered-By: Express, CSP: default-src 'none'
Endpoint Discovery /api/health → 200 OK, /api/tokens → 200 OK (2173 bytes)
API Data Token list returned as JSON
Detailed Scan Output
json

{
"success": true,
"target": "2otfic43en3fp3kz7ddowd3xlps5km6obu7qsgp2jhq7qlfv7tdkzqad.onion",
"scans": {
"nmap": {
"output": "PORT STATE SERVICE\n22/tcp closed ssh\n80/tcp open http\n443/tcp closed https"
},
"headers": {
"output": "X-Powered-By: Express\nAccess-Control-Allow-Origin: *\nContent-Security-Policy: default-src 'none'"
}
}
}

🔍 What We Discovered
Finding Implication
Port 80 open HTTP service is active
Express.js server Node.js backend
/api/health active API is live and responding
/api/tokens active Token list is publicly accessible
CSP: default-src 'none' Very restrictive security policy
CORS: * Open cross-origin access
📊 API Endpoints Discovered
Endpoint Status Content
/ 404 Not Found
/api/health ✅ 200 JSON status
/api/tokens ✅ 200 Token list (2173 bytes)
/api/auth 404 Not Found
/api/payments 404 Not Found
/login 404 Not Found
🛡️ Security Implications
Issue Risk Recommendation
CORS: * Cross-origin attacks Restrict to trusted origins
Express exposed Version fingerprinting Hide or obfuscate
No HTTPS Man-in-the-middle attacks Enable SSL/TLS
Default CSP Limited protection Configure proper CSP policy
Open APIs Data exposure Implement authentication
🧠 What We Learned

Onion sites often expose APIs – even without documentation, endpoints like /api/health and /api/tokens are common.

CORS misconfiguration is common – many services leave Access-Control-Allow-Origin: * enabled.

HTTP headers reveal a lot – X-Powered-By: Express immediately reveals the technology stack.

Port scanning via Tor works – but is slow (0.39s latency is typical).

API data can be valuable – the /api/tokens endpoint returned real token data.

🚀 What You Can Do Now

Scan Your Own Onion Services bash

curl -X POST http://localhost:3002/api/scanner/full \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{"target": "your.onion"}' | jq '.'

Analyze Headers bash

curl -X POST http://localhost:3002/api/scanner/headers \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{"target": "your.onion"}' | jq '.'

Discover Endpoints bash

curl -X POST http://localhost:3002/api/scanner/endpoints \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{"target": "your.onion"}' | jq '.'

Extract Wallet Addresses bash

python3 /root/onion_wallet_scanner.py --target http://your.onion

⚠️ Important Disclaimers
Aspect Warning
Authorization Only scan sites you own or have explicit permission to test.
Legality Unauthorized scanning is illegal in many jurisdictions.
Ethics Use these tools responsibly and ethically.
Privacy Do not share collected data without consent.
📌 Next Steps

Add AI Analysis – integrate DeepSeek to analyze scan results automatically.

Historical Tracking – save scan results to MongoDB for trend analysis.

Alert System – notify when critical vulnerabilities are found.

Automated Reporting – generate PDF reports from scan data.

More Endpoints – expand the endpoint scanner with common API paths.

🔗 Related Code

GitHub: DanielIoni-creator/MyZubsterGateway

Scanner Routes: routes/scanner.js

Services: services/scannerService.js

Scripts: scripts/onion_wallet_scanner.py

🏷️ Tags