Breaking & Hardening

# ships with the repo; runs on the host because the capture needs docker.
# sends a bursty pattern from the workstation through Tor while capturing
# the gateway uplink at the same time — you own both ends
$ ./labs/artifacts/correlate/observe.sh &    # entry-side capture (uplink)
$ ./labs/artifacts/correlate/generate.sh     # the bursty flow + its timing log

$ ./labs/artifacts/correlate/correlate.py \
    /tmp/correlate/uplink.log /tmp/correlate/dest.log

$ python3 - <<'PY'
import os
from stem.control import Controller
with Controller.from_port(address="10.152.152.10", port=9051) as c:
    c.authenticate(password=os.environ["LAB_CONTROL_PW"])
    rel = list(c.get_network_statuses())
    bw = sorted((r.bandwidth or 0) for r in rel)
    total = sum(bw)
    top10 = sum(bw[-len(bw)//10:])
    print(f"relays          : {len(rel)}")
    print(f"total weight    : {total}")
    print(f"top 10% of relays hold {100*top10//total}% of the weight")
PY

# the guard doesn't change when you ask for a new identity — confirm it
$ G1=$(printf 'AUTHENTICATE "%s"\r\nGETINFO entry-guards\r\nQUIT\r\n' "$LAB_CONTROL_PW" | nc 10.152.152.10 9051 | grep -oE '\$[0-9A-F]{40}' | head -1)
$ printf 'AUTHENTICATE "%s"\r\nSIGNAL NEWNYM\r\nQUIT\r\n' "$LAB_CONTROL_PW" | nc 10.152.152.10 9051
$ sleep 8
$ G2=$(printf 'AUTHENTICATE "%s"\r\nGETINFO entry-guards\r\nQUIT\r\n' "$LAB_CONTROL_PW" | nc 10.152.152.10 9051 | grep -oE '\$[0-9A-F]{40}' | head -1)
$ [ "$G1" = "$G2" ] && echo "same guard — persistence holds"

# ships with the repo: makes a canary document + a listener that logs its beacon.
# the beacon points at a LAB-INTERNAL address. no macros, no scripts, no exploit.
$ ~/labs/artifacts/canary/make-canary.sh
listener on 10.152.152.11:8971
canary written to /tmp/canary/report.html

# the defenses from earlier chapters, re-checked as a block
$ ./lab check 2.2      # DNS still torified — no clear name lookups
$ ./lab check 2.7      # still fails closed — no clear egress path
$ ./lab check 3.3      # guard persisted — not churning

# confirm your own services don't leak the way Lab 4.6's did
$ ~/labs/artifacts/canary/make-canary.sh &      # prove you can detect a beacon
$ ./lab check 4.7                               # your reference service stays quiet