I'm now researching an attack against Tor.
Resume of Attack: We control exit node and entry node. Upon receiving a RELAY BEGIN cell,the exit node will forger a malicious webpage to client. The webpage contains some empty gif files. The entry node will be able to detect a distinctive pattern of the connection to that malicious webpage, basing on number of relay cells backward and forward.
For implementation, it's needed to modify a piece of Tor source code at the exit node, to forger a malicious webpage to client. Notice that this is not modifying webpage response from the server, but forger attacker's webpage to the client. Could some one please give a hint about where I need to modify.
Thank you.
Regards.
--
Nguyen Quoc Viet