TorBroker - Security vulnerability found

Anyone who run a tor exit node can change this JavaScript and make some bad things:

<!--[if lt IE 9]>
  <script src=""></script>

<script src="//"></script>

The above link is actually linking to Google (

and not to


as you may think.

Loading a JavaScript thought an insecure tor exit node can be very dangerous.

One hour after report I received an answer from the TorBroker:

To exploit this vulnerability an attacker would have to control the specific exit node the targeted TorBroker user is currently exiting through. This is not easy to accomplish, so we do not consider this to be a critical vulnerability. However, given the nature of our service we insist on providing the best possible security for our customers, so we have updated the code to remove this point of attack.

Thank you for the report!TorBroker

I confirm that this problem is solved:


  1. its a hidden service (.onion) there are no exit nodes.

    1. There should be no exit nodes involved at all... but there are - the site was embedding objects from non-onion urls.


Post a Comment is a participant in the Amazon Services LLC Associates Program, an affiliate advertising program designed to provide a means for sites to earn advertising fees by advertising and linking to

Popular posts from this blog

"The Uncensored Hidden Wiki" fake replica!

Stallion XL Review – The Natural Sexual Enhancer for Men

Archiving private keys - TLDR version

The new Bitstamp's KYC (Know Your Customer) questionnaire is intrusive and out of control

Do not use (only) flash memory (SSD drives, hardware wallets, USB flash drives) for your precious private keys!