Lab 10 of 17 · By Michael Stout
In this lab
Read the steps, then try them in your lab environment.
Research safely and anonymously with Tor Browser
Chapter 4 covers open-source intelligence as a source of threat data. Some of the most useful OSINT — forums, paste sites, marketplaces where stolen data surfaces — is somewhere you shouldn't visit from an address that traces back to your employer. Tor Browser is how analysts get there without doing that.
Your IP address is itself an indicator
If a site logs visitor IPs and you show up from your organization's known netblock, you've told whoever runs that site exactly who's watching. Tor routes your traffic through three relays, so the site only ever sees the exit relay's address. This is a research-safety tool, not a way to act with impunity — keep that distinction in mind for the rest of this lab.
The exit relay operator can, in principle, see your unencrypted traffic. Tor hides where you're connecting from — it doesn't encrypt what you send the way a VPN to a trusted provider would.
What you'll need
Windows 10 or 11, 64-bit.
None required — Tor Browser installs to your user profile, not system-wide.
Check your organization's acceptable-use policy before installing Tor on a work machine — some networks block or flag it entirely.
10–15 minutes.
Get connected
- Download it. Go to
download.torproject.organd select Windows. - Run the installer. Choose an install location and finish — no admin prompt should appear.
- Launch it and connect. On first launch, click Connect (not Configure Connection, unless your network is censored or requires a proxy, in which case use Connection Assist to pick a bridge automatically).
- Confirm it worked. Once connected, visit
check.torproject.org. A “Congratulations” message confirms your traffic is routing through Tor.
Compare before and after
- Check your real IP first. In your normal browser, visit an IP-lookup page and note the address and its rough location.
- Check it again in Tor. Visit the same kind of lookup page inside Tor Browser. The address — and often the apparent country — will be different: that's the exit relay, not you.
- Leave the default window size alone. Tor Browser deliberately keeps a small set of common window sizes so yours doesn't stand out in a crowd — maximizing it works against that.
Never log into an account tied to your real identity over Tor if you're trying to stay unlinkable, and never treat it as a substitute for your organization's approved tooling and legal guidance when the research touches anything that could become evidence.
Sources. The Tor Project, download, download.torproject.org. The Tor Project, first launch guide, support.torproject.org/tor-browser/getting-started/first-launch.