Route tor SOCKS5 dns query through dnscrypt

[Romulo-Romero]

Hello,
I have been trying to use dnscrypt over TOR via SOCKS5, but SOCKS5 uses the tor exit dns servers to resolve name servers. I noticed some exits uses google dns, which defeats the whole purpose of anonymity. The good thing is that I don't need tor browser now to access onion sites , which by the way, in my option, tor browser is not really that privacy bullet proof like most say, I've found many loopholes, just as an example it does not even fake http referrer header nor block it. Anyways, so now I am looking into a way to forward tor socks5 dns queries to dnscrypt. I tried to use dns2socks application, but was not able to get it to work.

Does anyone know how to solve this problem ?

[jedisct1]

You’re right that using SOCKS5 over Tor will typically send DNS queries through the Tor exit nodes, and some of them use Google DNS or other resolvers, which isn’t ideal if you’re aiming for full DNS privacy.

To get around this, you have a few options:

• Use DNSCrypt over TCP over Tor:
  Instead of sending DNS queries over SOCKS5, you can run your DNSCrypt client over Tor directly. One way is to run your DNSCrypt client with torsocks so it sends all its TCP traffic through Tor, or you can use Tor’s TransPort to transparently route your DNSCrypt client traffic through Tor.

• Run a DNSCrypt resolver as a Tor hidden service:
  This is a bit more advanced, but you could run your own DNSCrypt server as an onion service and point your client to it. This way, your DNS queries never leave the Tor network at all.

• Using dns2socks:
  It can work, but it’s a bit tricky. You need your DNSCrypt client to listen locally, and then dns2socks forwards those queries over Tor’s SOCKS5 to your DNSCrypt resolver (using the resolver’s IP, not its domain name, to avoid pre-resolution leaks). However, dns2socks can be flaky and might need extra tuning.

• Use Anonymized DNSCrypt:
  Way easier, faster, made for DNS, faster and prevents correlation unlike Tor.

Regarding Tor Browser, you’re also right that it doesn’t fully strip the HTTP Referer header by default, just trims it, which can leak some information. It’s one of those trade-offs they made for compatibility, but it can be disabled if you want stricter privacy.

[Romulo-Romero]

Thank you for replying.
"Instead of sending DNS queries over SOCKS5, you can run your DNSCrypt client over Tor directly. One way is to run your DNSCrypt client with torsocks so it sends all its TCP traffic through Tor, or you can use Tor’s TransPort to transparently route your DNSCrypt client traffic through Tor."

How exactly would it work, can you go into the specifics?

"Use Anonymized DNSCrypt: Way easier, faster, made for DNS, faster and prevents correlation unlike Tor."
Not an option when someone tapping the wire :) , and even when your IP is well known by an array of websites, which makes fingerprinting so obvious. Not that I have something to hide, just don't want my every move being seen and to have metadata formed based on browsing habits, that is what I call freedom my friend, other than that is non sense.

dig @127.0.0.1 -p 9053 facebookcorewwwi.onion resolves the onion sites without any issue, but the problem lies in the web browser. I am using SOCKS4 in order to have my dnscrypt servers anonimized via tor. Like I said before, if I use SOCKS5 127.0.0.1:9050 in my proxy settings, by design[I think] SOCKS5 uses the exit nodes to resolve. Tor DNSPort 9053 listens on UDP, which may explain when it doesn't work on my browser, considering dnscrypt uses force_tcp setting.

As a side note there is a very simple solution to that, if I want to visit onion sites with my browser, then just use SOCKS5, other than that just stick to socks4 for proxying. However, there is a catch though, as I have seen most of the exit nodes also use google and other sketchy dns severs to resolve the hostnames, which defeats the purpose of anonymity like I said before. And that can put you in a watchlist if you're just out of curiosity visiting some suspicious onion sites - but that is just an assumption since the exit node is not even aware of the guard node.

Can you share how to accomplish forwarding onion sites to tor with cromite?
Thanks

[Romulo-Romero]

I found the solution, I only needed to create a pac script, and insert it into the pac URL as base64 encoded, that was it , nothing fancy.