Two books · Antonio Brandao

Two books about the same hidden internet

The first explains how it works. The second teaches you to collect intelligence from it.

Volume 1 shows the onion whole. Volume 2 shows it opened, with the network inside lit up and readable. That is the difference between the two books.

About the books

One subject, two jobs

They are not two editions of the same book. They teach different skills, and they are written to be read in order.

Volume One

Understanding

Unlock the Secrets of the Dark Web: Theoretical Instruction and Hands-On Labs

The dark web has a reputation that its evidence does not support. This book sets the two against each other. It covers what the dark web actually is, how Tor and onion routing work, what people legitimately use it for, what crime genuinely happens there, and where the law and the ethics sit.

Its labs are introductions to the tools. You deploy a container, verify and use Tor Browser, publish your own onion site, chain proxies, share files with OnionShare, and run an OSINT investigation. A statistics chapter gives you the current numbers, and a glossary and index make it usable as a reference afterwards.

Tor · Onion Services · Darknet Markets · OSINT · Hands-On Labs

Read this if you want to understand the place, brief a board or a classroom on it, or get your first hands on the tooling. It assumes nothing.

ii
Volume Two

Collection

Unlock the Secrets of the Dark Web, Volume 2: Threat Intelligence and Hands-On Labs

Understanding the dark web and collecting intelligence from it are different skills. This book assumes the first and teaches the second. You build a collection workstation, stand up a synthetic darknet you control, and then run the full cycle against it.

You crawl hidden services, tell mirrors from clones, pull structured claims out of pages built to mislead you, read an extortion operation across its public and private surfaces, link pseudonyms into operators, hold a standing watch, and write a report that does not overclaim. Every lab is graded against ground truth, and most are graded twice: once as you built the engine, and once in a naive mode that skips the discipline.

Crawling · Markets · Leak Sites · Attribution · Detection · Reporting

Read this if you collect, or want to. It is built for analysts, SOC and CTI teams, and anyone who has to turn a hidden service into a finding somebody can act on.

iii

Volume 1 answers what is this. Volume 2 answers what do I do about it. Volume 1 stands on its own; Volume 2 assumes it.

The companion lab site

Volume 2 comes with a lab you run yourself

The book carries the reasoning. The lab site carries the commands, the graded engines, and the synthetic range they run against. You host it on your own machine, and it works offline.

109 graded labs across fifteen chapters, four parts, and three networks. Every one is scored against ground truth the range gives you, so you can see what your engine got right and what it missed.

What is inside

Contents at a glance

Volume 1

Seven chapters of theory, seven hands-on labs, and a statistics chapter. Numbers are page numbers.

Theory

Introduction to the Dark Web9
Understanding the Technology37
Legitimate Uses59
Illicit Activities77
Risks103
Legal and Ethical Considerations115
Conclusion and Final Reflections137
Dark Web Key Statistics145

Hands-on labs

Deploying a Container with Docker155
Ransomware Chat Simulation165
Using the Tor Browser169
Creating a Dark Web Website175
Proxy Chains187
OnionShare191
Open Source Intelligence197

Reference

Glossary201
Index219

Available now in paperback and Kindle.

Volume 2

Fifteen chapters in four parts, and a companion lab site you host yourself. Numbers are graded labs.

Part I · The Range

The Container Lab6
Verified Access7

Part II · Protocol and Services

Tor From the Inside7
Onion Services v37
Breaking and Hardening7
Beyond Tor: I2P7
Hyphanet7

Part III · Collection

The Simulated Darknet7
Crawling Hidden Services7
Mirrors and Clones7
Markets and Forums8

Part IV · Attribution and Reporting

Leak Sites and Negotiation9
Persona Linkage7
Detection8
Capstone and Reporting8

Reference

Technical appendix, lab commands, and glossary

109 graded labs in total. Everything runs on a synthetic range that ships with the book, so nothing you run reaches a real service.

About the author

Antonio Brandao

Antonio Brandao is the Director of Cybersecurity Services at BCNET, British Columbia's shared research-and-education network, where he leads security operations for a community of dozens of post-secondary and research institutions.

He is a former military officer who taught cybersecurity at a military academy, and he has held technology and results-management roles at major international sporting events.

Both books grew out of a live, hands-on dark web awareness workshop he developed and delivered to security practitioners, students, and professionals who wanted an evidence-based account of how the dark web actually works, and of the gap between its reputation and its reality.

  • Director of Cybersecurity Services, BCNET
  • Former military officer and instructor
  • ISACA Community Leadership Award, 2026
Start here

Read Volume 1. Then go to work in Volume 2.