deanonymization

Documentation

Index

• func ApacheModStatus(osreport *report.OnionScanReport, report *report.AnonymityReport, ...)
• func CheckExif(osreport *report.OnionScanReport, anonreport *report.AnonymityReport, ...)
• func CheckExposedDirectories(osreport *report.OnionScanReport, report *report.AnonymityReport, ...)
• func CommonCorrelations(osreport *report.OnionScanReport, anonreport *report.AnonymityReport, ...)
• func ComputeChecksum(b []byte) (c [4]byte)
• func EmailScan(osreport *report.OnionScanReport, anonreport *report.AnonymityReport, ...)
• func EmbeddedChecksum(b []byte) (c [4]byte)
• func ExtractBitcoinAddress(osreport *report.OnionScanReport, anonreport *report.AnonymityReport, ...)
• func ExtractGoogleAnalyticsID(osreport *report.OnionScanReport, anonreport *report.AnonymityReport, ...)
• func ExtractGooglePublisherID(osreport *report.OnionScanReport, anonreport *report.AnonymityReport, ...)
• func GetOnionLinks(osreport *report.OnionScanReport, anonreport *report.AnonymityReport, ...)
• func GetUserDefinedRelationships(osreport *report.OnionScanReport, anonreport *report.AnonymityReport, ...)
• func MailtoScan(osreport *report.OnionScanReport, anonreport *report.AnonymityReport, ...)
• func PGPContentScan(osreport *report.OnionScanReport, anonreport *report.AnonymityReport, ...)
• func PrivateKey(osreport *report.OnionScanReport, report *report.AnonymityReport, ...)
• func Set58(s []byte, b []byte) error
• func ValidateA58(a58 []byte) (ok bool)
• func ValidateP58(p58 []byte) (ok bool)
• func Version(b []byte) byte
• type ExifWalker
  • func (w *ExifWalker) Walk(name exif.FieldName, val *tiff.Tag) error
• type ExtractIdentifierStep
  • func (eis *ExtractIdentifierStep) Do(osreport *report.OnionScanReport) error
  • func (eis *ExtractIdentifierStep) Init(osc *config.OnionScanConfig)

Functions

func ApacheModStatus

func ApacheModStatus(osreport *report.OnionScanReport, report *report.AnonymityReport, osc *config.OnionScanConfig)

ApacheModStatus extracts any information related to exposed mod_status endpoints. FIXME: We can make this much smarted than it currently is.

func CheckExif

func CheckExif(osreport *report.OnionScanReport, anonreport *report.AnonymityReport, osc *config.OnionScanConfig)

CheckExif extracts all EXIF metadata out of any images processed during the current crawl.

func CheckExposedDirectories

func CheckExposedDirectories(osreport *report.OnionScanReport, report *report.AnonymityReport, osc *config.OnionScanConfig)

CheckExposedDirectories makes note of any directories which display a directory listing instead of an expected 403 or equivalent error.

func CommonCorrelations

func CommonCorrelations(osreport *report.OnionScanReport, anonreport *report.AnonymityReport, osc *config.OnionScanConfig)

CommonCorrelations extracts relationships from other non-web protocols FIXME: At somepoint we probably want to separate these out into their own files as non-http functionality becomes better.

func ComputeChecksum

func ComputeChecksum(b []byte) (c [4]byte)

ComputeChecksum returns a four byte checksum computed from bytes (except for the last 4) of the slice. The embedded checksum is not updated.

func EmailScan

func EmailScan(osreport *report.OnionScanReport, anonreport *report.AnonymityReport, osc *config.OnionScanConfig)

EmailScan extracts anything which resembles an email address from the current crawl.

func EmbeddedChecksum

func EmbeddedChecksum(b []byte) (c [4]byte)

EmbeddedChecksum returns the checksum of the byte slice.

func ExtractBitcoinAddress

func ExtractBitcoinAddress(osreport *report.OnionScanReport, anonreport *report.AnonymityReport, osc *config.OnionScanConfig)

ExtractBitcoinAddress extracts any information related to bitcoin addresses from the current crawl.

func ExtractGoogleAnalyticsID

func ExtractGoogleAnalyticsID(osreport *report.OnionScanReport, anonreport *report.AnonymityReport, osc *config.OnionScanConfig)

ExtractGoogleAnalyticsID extracts any Google analytics IDs e.g. UA-32423-7564

func ExtractGooglePublisherID

func ExtractGooglePublisherID(osreport *report.OnionScanReport, anonreport *report.AnonymityReport, osc *config.OnionScanConfig)

ExtractGooglePublisherID extract Google publisher ids, used for adsense marketing e.g. pub-230210202

func GetOnionLinks

func GetOnionLinks(osreport *report.OnionScanReport, anonreport *report.AnonymityReport, osc *config.OnionScanConfig)

GetOnionLinks extracts links and urls from the current crawl

func GetUserDefinedRelationships

func GetUserDefinedRelationships(osreport *report.OnionScanReport, anonreport *report.AnonymityReport, osc *config.OnionScanConfig)

GetUserDefinedRelationships extracts any user configured relationships from the current crawl

func MailtoScan

func MailtoScan(osreport *report.OnionScanReport, anonreport *report.AnonymityReport, osc *config.OnionScanConfig)

MailtoScan Extracts any email addresses linked via mailto targets.

func PGPContentScan

func PGPContentScan(osreport *report.OnionScanReport, anonreport *report.AnonymityReport, osc *config.OnionScanConfig)

PGPContentScan extracts any PGP public key blobs that may exist in the current scan.

func PrivateKey

func PrivateKey(osreport *report.OnionScanReport, report *report.AnonymityReport, osc *config.OnionScanConfig)

PrivateKey extracts an exposed private key if it exists in the current crawl

func Set58

func Set58(s []byte, b []byte) error

Set58 takes a base58 encoded string decodes it into a byte slice. Errors are returned if the argument is not a valid base58 or if the decoded value does not fit in the byte slice.

func ValidateA58

func ValidateA58(a58 []byte) (ok bool)

ValidateA58 validates a base58 encoded bitcoin address. An address is valid if it can be decoded into a 25 byte address, the version number is 0 (P2PKH) or 5 (P2SH), and the checksum validates. Return value ok will be true for valid addresses. If ok is false, the address is invalid and the error value may indicate why.

func ValidateP58

func ValidateP58(p58 []byte) (ok bool)

ValidateP58 validates a base58 encoded private key. A private key is valid if it can be decoded into a 37 byte private key, start with a 0x80 byte, and the checksum validates. Return value ok will be true for valid private keys. If ok is false, the private key is invalid and the error value may indicate why.

func Version

func Version(b []byte) byte

Version extracts the version byte from the byte slice.

Types

type ExifWalker

type ExifWalker struct {
	// contains filtered or unexported fields
}

ExifWalker captures functionality to process all exif data obtained from an image.

func (*ExifWalker) Walk

func (w *ExifWalker) Walk(name exif.FieldName, val *tiff.Tag) error

Walk takes the given exif information and stores it the the anonymity report.

type ExtractIdentifierStep

type ExtractIdentifierStep struct {
	// contains filtered or unexported fields
}

ExtractIdentifierStep is a pipeline step which extracts as many relationships out of the giveb crawl as possible.

func (*ExtractIdentifierStep) Do

func (eis *ExtractIdentifierStep) Do(osreport *report.OnionScanReport) error

Do process all of the ExtractIdentifierStep steps.

func (*ExtractIdentifierStep) Init

func (eis *ExtractIdentifierStep) Init(osc *config.OnionScanConfig)

Init sets up the ExtractIdentifierStep step.