A Go scanner that watches Tor exit relays for misbehaviour — tampering, TLS downgrade and exit-policy abuse — as a focused, self-hostable bad-relay detector.
- Go 100%
bcc4808362
Tor network security monitoring tool with Sybil detection and exit node scanning capabilities. Features: - Three Sybil detection algorithms (subnet clustering, config similarity, bandwidth patterns) - Real exit testing via embedded Tor (bine/Go) - SSL strip, MitM, injection detection - SQLite persistence with uptime tracking |
||
|---|---|---|
| .gitignore | ||
| go.mod | ||
| go.sum | ||
| osentinel.go | ||
| README.md | ||
Onion Sentinel
Tor network security monitoring tool for detecting Sybil attacks and malicious exit nodes.
Features
- Sybil Detection: Analyzes Tor consensus data using three algorithms (subnet clustering, config similarity, bandwidth patterns)
- Exit Node Scanning: Tests exit relays for malicious behavior (SSL stripping, MitM, content injection) by building real Tor circuits
- Real-Time Monitoring: Tracks relay uptime and stores historical data for pattern analysis
- Embedded Tor: Uses bine/Go library to build circuits through exits without external Tor daemon
Usage
# Fetch latest Tor consensus
./onion-sentinel consensus fetch
# Run Sybil detection
./onion-sentinel sybil detect
# Scan exit nodes (requires --use-tor for real testing)
./onion-sentinel exit scan --use-tor --limit 10
# Generate daily report
./onion-sentinel report daily
Build
go build -o onion-sentinel osentinel.go
Database
SQLite database stored at ~/.config/onion-sentinel/onion-sentinel.db
Related
Part of a larger effort to improve Tor network sustainability through:
- OnionCoin: Economic incentives for relay operators
- Blockchain-based operator identity for accountability
License
MIT
Author
Gabriele Salati (Gab Virebent) gabriel1@gabrielesalati.eu