Unlock the Secrets of the
DARKWEB
Threat Intelligence and Hands-On Labs · Volume 2
Build · Verify · Collect · Attribute
The commands for every lab in the book, ready to copy and run. The reasoning behind them, and the judgment each one is teaching, are in the book.
Nothing here touches live infrastructure. You build the networks, you build the services, and you break them yourself, inside a synthetic range that ships with the labs.
Start the labs
Chapter 1 · The Container Lab
How this site works
This is the command half of the book. Each page carries the exact things you type, under the same lab number the book uses, so Lab 3.1 here is Lab 3.1 there. What each step does and why it is built that way is written up in the book.
Five items are not here: Labs 11.8, 12.8, 12.9 and 14.8, and Chapter 15. Those run against real archived data or chain every engine into a final report, and they are covered in the book with their commands.
Go to the labs The books Technical appendix
Chapters
Part I · The Range
Workstation tier · can you touch hidden services without exposing yourself?
01
The Container Lab
Stand up the stack, map what reaches the internet, prove the isolation is structural.
in the book
WS · 4G
02
Verified Access
Leak testing, fail-closed verification, and why a leaked .onion query is worse than a DNS leak.
7 labs
WS · 4G
Part II · Protocol & Services
Workstation tier · understand hidden services by building, breaking, and hardening them
03
Tor From the Inside
Your own directory authorities, relays, and exits. Read your own consensus.
7 labs
WS · 4G
04
Onion Services v3, End to End
Descriptors, blinded keys, the full rendezvous handshake, and why enumeration fails.
7 labs
WS · 4G
05
Breaking and Hardening
Deanonymize a misconfigured service, then make it unbreakable.
7 labs
WS · 8G
06
Beyond Tor: I2P
Garlic routing, unidirectional tunnels, and a distributed netDb instead of nine authorities.
7 labs
WS · 8G
07
The Third Architecture: Hyphanet
Content-addressed storage, friend-to-friend darknet mode, and content you cannot delete.
7 labs
WS · 8G
Part III · Collection
Infrastructure tier · onion services are ephemeral; if you aren't watching, you miss it
08
The Simulated Darknet
Markets, forums, leak sites and paste sites, all real onion services you own.
7 labs
INF · 8G
09
Crawling Hidden Services
No DNS, no certificates, no search engine, and latency that breaks ordinary crawlers.
7 labs
INF · 8G
10
Ephemerality, Mirrors, and Clones
Tell a seizure from an exit scam, and a real service from a phishing copy.
7 labs
INF · 8G
11
Marketplaces and Forums
Escrow, reputation, vouching, and PGP keys as the only durable identity.
7 labs
INF · 8G
Part IV · Attribution and Reporting
Infrastructure tier · turn collection into an intelligence product
12
Leak Sites and Negotiation
Around 220 real transcripts across 23 groups, and a local model that keeps them local.
7 labs
INF · 16G
13
Persona Linkage and OPSEC Failure
Stylometry, timezone inference, key reuse: how operators actually get caught.
7 labs
INF · 8G
14
Detecting Anonymity Networks
The defender's chapter: spot Tor, bridges, and I2P on your own network.
7 labs
INF · 8G
15
Capstone and Reporting
One seeded incident threaded through every tool you built.
in the book
INF · 16G
Reference
Optional setup, kept out of the labs
A
Technical Appendix
WSL2 and Docker setup (moved out of Chapter 1), drive relocation and USB, Git and GitHub, running the site locally, and troubleshooting.
Setup +
reference
B
Lab Commands
Every ./lab command with a one-line description and a copy-ready example, plus a spreadsheet download.
Reference
Where to run it
Option A
Your own machine
Docker Desktop on Windows or macOS, Docker Engine on
Linux. Comfortable through Parts I and II.
Option B
A VPS
Always-on Linux. Recommended from Part III, where collection runs
continuously and outages are the thing you're measuring.
Check first
lab doctor
Reports your platform, memory, and architecture, then tells you which
labs run natively and which want the VPS.