All CySA+ v4 labs

Lab 10 of 17 · By Michael Stout

In this lab

Read the steps, then try them in your lab environment.

CYSA+ CS0-004 · DOMAIN I SECURITY OPERATIONS CyberCorps.uk · LAB 10
LAB 10 · OPEN-SOURCE INTELLIGENCE

Research safely and anonymously with Tor Browser

Chapter 4 covers open-source intelligence as a source of threat data. Some of the most useful OSINT — forums, paste sites, marketplaces where stolen data surfaces — is somewhere you shouldn't visit from an address that traces back to your employer. Tor Browser is how analysts get there without doing that.

WHY THIS LAB

Your IP address is itself an indicator

If a site logs visitor IPs and you show up from your organization's known netblock, you've told whoever runs that site exactly who's watching. Tor routes your traffic through three relays, so the site only ever sees the exit relay's address. This is a research-safety tool, not a way to act with impunity — keep that distinction in mind for the rest of this lab.

ANONYMOUS, NOT INVISIBLE

The exit relay operator can, in principle, see your unencrypted traffic. Tor hides where you're connecting from — it doesn't encrypt what you send the way a VPN to a trusted provider would.

BEFORE YOU START

What you'll need

OPERATING SYSTEM

Windows 10 or 11, 64-bit.

PERMISSIONS

None required — Tor Browser installs to your user profile, not system-wide.

POLICY

Check your organization's acceptable-use policy before installing Tor on a work machine — some networks block or flag it entirely.

TIME

10–15 minutes.

CyberCorps.uk · Lab 10 Page 1 of 2
INSTALL · CONNECT · SOURCES CyberCorps.uk · LAB 10
PART 1 · INSTALL TOR BROWSER

Get connected

  1. Download it. Go to download.torproject.org and select Windows.
  2. Run the installer. Choose an install location and finish — no admin prompt should appear.
  3. Launch it and connect. On first launch, click Connect (not Configure Connection, unless your network is censored or requires a proxy, in which case use Connection Assist to pick a bridge automatically).
  4. Confirm it worked. Once connected, visit check.torproject.org. A “Congratulations” message confirms your traffic is routing through Tor.
PART 2 · SEE IT WORK

Compare before and after

  1. Check your real IP first. In your normal browser, visit an IP-lookup page and note the address and its rough location.
  2. Check it again in Tor. Visit the same kind of lookup page inside Tor Browser. The address — and often the apparent country — will be different: that's the exit relay, not you.
  3. Leave the default window size alone. Tor Browser deliberately keeps a small set of common window sizes so yours doesn't stand out in a crowd — maximizing it works against that.
THIS IS FOR RESEARCH, NOT CREDENTIALS

Never log into an account tied to your real identity over Tor if you're trying to stay unlinkable, and never treat it as a substitute for your organization's approved tooling and legal guidance when the research touches anything that could become evidence.

Sources. The Tor Project, download, download.torproject.org. The Tor Project, first launch guide, support.torproject.org/tor-browser/getting-started/first-launch.

CyberCorps.uk · Lab 10 Page 2 of 2

Connect this lab to your learning