🧅 Complete OSINT Guide to Onion Sites and Wallet Recovery with MyZubster

#tor #osint #myzubster #kalilinux

How to extract Bitcoin and Monero addresses from onion sites, verify balances, and recover lost wallets using open-source tools.
📌 Introduction

MyZubster is a decentralized ecosystem that combines Monero, Tari, Kali Linux, and DeepSeek AI. In this article, I'll show you how we've integrated OSINT (Open Source Intelligence) capabilities to analyze onion sites, extract cryptocurrency wallets, and verify balances—all legally and ethically.
🧠 What You'll Learn

What an onion site is and how the Tor network works

How to passively analyze an onion site (OSINT)

How to extract BTC and XMR addresses from HTML pages

How to verify balances using public APIs

How to recover a lost wallet if the site is yours

How to integrate everything into MyZubster

🛠️ Tools Used
Tool Purpose
Tor Access to the onion network
curl Download HTML pages via Tor
Python + BeautifulSoup HTML parsing and data extraction
Blockchain.info API Bitcoin balance verification
MoneroBlocks API Monero balance verification
MyZubster Gateway Expose functionality via API
🔍 1. Accessing an Onion Site via Tor

To access an onion site from the terminal, use curl with Tor's SOCKS proxy:
bash

curl --socks5-hostname 127.0.0.1:9050 http://.onion/

To follow redirects:
bash

curl --socks5-hostname 127.0.0.1:9050 -L http://.onion/

🧪 2. Extracting Bitcoin and Monero Addresses
Bitcoin Pattern (Base58)
regex

[13][a-km-zA-HJ-NP-Z1-9]{25,34}

Monero Pattern (Base58)
regex

4[0-9AB][1-9A-HJ-NP-Za-km-z]{93}

Python Script Example
python

import re
import requests

def extract_addresses(text):
btc_pattern = r'\b[13][a-km-zA-HJ-NP-Z1-9]{25,34}\b'
xmr_pattern = r'\b4[0-9AB][1-9A-HJ-NP-Za-km-z]{93}\b'
return {
'btc': list(set(re.findall(btc_pattern, text))),
'xmr': list(set(re.findall(xmr_pattern, text)))
}

💰 3. Verifying Balances
Bitcoin – Blockchain.info API
python

def get_btc_balance(address):
url = f"https://blockchain.info/q/addressbalance/{address}"
response = requests.get(url)
return int(response.text) / 1e8 if response.status_code == 200 else None

Monero – MoneroBlocks API
python

def get_xmr_balance(address):
url = f"https://moneroblocks.info/api/get_address_info/{address}"
response = requests.get(url)
return response.json().get('balance', 0) / 1e12 if response.status_code == 200 else None

🧅 4. Complete OSINT Script for Onion Sites

Here's the full script we've integrated into MyZubster:
python

!/usr/bin/env python3

"""
Onion OSINT Scanner – Passive analysis of an external onion site.
"""

import re
import json
import time
import requests
from bs4 import BeautifulSoup

TARGET = "http://.onion"
PROXY = {
'http': 'socks5h://127.0.0.1:9050',
'https': 'socks5h://127.0.0.1:9050'
}

def get_page(url):
try:
response = requests.get(url, proxies=PROXY, timeout=30)
return response.text if response.status_code == 200 else None
except Exception as e:
print(f"Error: {e}")
return None

def get_balance(address, crypto):
if crypto == 'btc':
try:
r = requests.get(f"https://blockchain.info/q/addressbalance/{address}", timeout=10)
return int(r.text) / 1e8 if r.status_code == 200 else None
except:
return None
elif crypto == 'xmr':
try:
r = requests.get(f"https://moneroblocks.info/api/get_address_info/{address}", timeout=10)
return r.json().get('balance', 0) / 1e12 if r.status_code == 200 else None
except:
return None
return None

def main():
print(f"🧅 OSINT Scan of: {TARGET}")
html = get_page(TARGET)
if not html:
print("❌ Unable to reach the site.")
return

addresses = extract_addresses(html)
print(f"BTC found: {len(addresses['btc'])}")
print(f"XMR found: {len(addresses['xmr'])}")

for addr in addresses['btc'][:5]:
    balance = get_balance(addr, 'btc')
    print(f"BTC {addr[:10]}...: {balance} BTC" if balance is not None else f"BTC {addr[:10]}...: error")
    time.sleep(1)

for addr in addresses['xmr'][:5]:
    balance = get_balance(addr, 'xmr')
    print(f"XMR {addr[:10]}...: {balance} XMR" if balance is not None else f"XMR {addr[:10]}...: error")
    time.sleep(1)

if name == "main":
main()

🔐 5. Recovering a Lost Wallet (if the site is yours)
If you have the seed phrase (25 words)
bash

monero-wallet-cli --restore-deterministic-wallet

If you have the .keys file and remember the password
bash

monero-wallet-cli --wallet-file myzubster_wallet

If you lost the hs_ed25519_secret_key (onion)

The old onion address cannot be recovered. Generate a new one:
bash

rm -rf /var/lib/tor/myzubster/
mkdir -p /var/lib/tor/myzubster/
chown debian-tor:debian-tor /var/lib/tor/myzubster/
systemctl restart tor
cat /var/lib/tor/myzubster/hostname

🌐 6. Integration into MyZubster

We've exposed these features via API:
bash

POST /api/onion/scan
Body: { "target": "http://.onion", "depth": 1 }

Example API Call
bash

curl -X POST http://localhost:3002/api/onion/scan \
-H "Content-Type: application/json" \
-d '{"target": "http://.onion", "depth": 1}' | jq '.'

⚠️ Legal Disclaimer
Aspect Recommendation
Authorization Only use these tools on sites you own or have explicit permission to test.
Legality Unauthorized access to onion sites is illegal.
Privacy Do not share collected data.
Purpose Use only for research and OSINT analysis.
🔗 Resources

Tor Project: torproject.org

Blockchain.info API: blockchain.info/api

Monero RPC Documentation: docs.getmonero.org/interacting/

MyZubster GitHub: DanielIoni-creator/MyZubsterGateway

🏷️ Tags