http://g7ee5otfyict57k24vjujuqzi6pd7iwvnsry2mt3svsgwzn6o6iynsad.onion/popets/2018/popets-2018-0011.php
This paper shows how to exploit this flexibility by proposing two new active attacks: one against onion services and the other against Tor clients. Our attack against onion services is a new low-cost sidechannel guard discovery attack that makes it possible to retrieve the entry node used by an onion service in one day, without injecting any relay in the network.