<span>Original Article at<span>:</span>https://penafieljlm.wordpress.com/2016/10/29/ekoparty-ctf-2016-write-ups/#fbi-100FBI 100 (Find me)</span><span>This challenge requires the participants to find the IP address of an anonymous hidden service accessible via the Tor network. This would be easy if we were in your ordinary internet environment, but in the Tor network, you can’t really do an nslookup or dig. The participants will have to find other ways to pinpoint the location of the service. Luckily, there is indeed a way, and it has something to do with searching for the banner of the service using one of my favourite search engines: Shodan.</span>RequirementstorgitSSH Key ScannerProcessInstall Tor on your Linux machine. In my case, I simply did a sudo apt install torbecause I used a Lubuntu Virtual Machine.Register a Shodan account and acquire your API key. It should be under your Account Overview.Clone SSH Key Scanner using git (git clone https://github.com/0x27/ssh_keyscanner.git)Open the keyscanner.py file inside the cloned repository directoryChange the value of the SHODAN_API_KEY variable to your own Shodan API keyRun torify python keyscanner.py -i ekosshlons2uweke.onionWhat keyscanner.py does is: it acquires a colon-separated MD5 hash of the SSH service’s public key called an “SSH Fingerprint” and then it searches Shodan for a banner containing that fingerprint. You can alternatively extract the SSH fingerprint of the service manually using nmap and search for it in Shodan.The flag is EKO{52.73.16.127}