First is to find how the website is being served to you. If you can break how it's being served you can possibly extract the source files of the website (which allows for total compromise). If you don't see any holes in that way, look at how the website is programmed. One easy way to find what kind of programming language is shown is from the ending file types being served. If it's .html generally that's going to be a static site making way less holes possible. If it's .php that's probably a dynamic site. If it's ending without any file types you can guess the language from how GET requests are handled (go down that rabbit hole if you are interested). After that look at how POST requests are handled. If it's dynamic, is it susceptible to blind injection attacks? Does it reject or just fail? Any returned inputs? Does it save data and serve it to others? Could the output be processed in a way which is able to be broken out of? Any file uploads? Does it process and clean images? Does it check file types? Is the upload directory able to be viewed directly? If you upload a dynamic script (in the same language of the site) does it run it? How are cookies handled? Any exploits can be found from the mishandling of those cookies? Onion sites are the same as regular sites. The only exception is the user on the site will be from 127.0.0.1 (localhost) which makes it more likely for things to be exploitable on the server layer if not configured properly. For example apache server-status and server-info was only supposed to be reported by 127.0.0.1 which is great for regular websites not great for sites which have onion domains. There is a reason why NGINX is used for basically all the large onion sites. Harder to fuck up on it.

[removed]