Dark › Module 10 › Lesson 3
Evidence Pack
Bundle Topic 39 literacy evidence from `$DW_LAB` — Tor, OPSEC, monitoring, leak hunting, legal ethics, TI, reporting; no crime how-tos.
Visual · t39_evidence_pack
Evidence pack = mentor handoff from $DW_LAB literacy. Original Cyberlium.
Opening
One indexed pack beats scattered dark-web notes — and never includes marketplace guides or unauthorized collection scripts.
Assemble evidence pack: `$DW_LAB` fictional org template inventory, lab setup proof, Tor/OPSEC/hardened OS labs if brief assigned, monitoring lab, leak hunting lab, legal ethics lab, TI handoff lab, reporting lab, integrity statement (YOUR fictional org only, LAB labels mandatory, defender monitoring only, no marketplace buys, no carding, no crime how-tos, no unauthorized collection, educational not legal advice, limitations documented). Directory chmod 600 — index.md lists contents UTC redactions. Mentor copy: report + TI stubs + diagrams, not crime cookbooks. Gap paragraph for Topic 40 Zero Trust Architecture — separate authorized track. Scan folder for marketplace guides, carding references, unauthorized collection scripts — zero tolerance.
1. Pack contents
Minimum: org template inventory, Tor/OPSEC, monitoring, leak hunting, legal ethics, TI, reporting, integrity index.
Optional: module labs per brief — no refused crime how-to files.
Command guide
Try these commands — Pack contents
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Tor Project — https://www.torproject.org/ OASIS STIX — https://oasis-open.github.io/cti-documentation/ CISA — https://www.cisa.gov/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export DW_LAB=${DW_LAB:-$HOME/cyberlium-lab/t39-dw}
python3 - <<'PY'
import os
lab = os.environ.get('DW_LAB', os.path.expanduser('~/cyberlium-lab/t39-dw'))
path = os.path.join(lab, 'notes', 'capstone-evidence-index.txt')
open(path, 'w').write('
'.join([
'CAPSTONE EVIDENCE INDEX — YOUR t39-dw lab only',
'Ethics: roe.txt, no-marketplace-access.txt',
'Tor: tor-named + onion-services + browser-hygiene packs',
'OPSEC: opsec-named + identity-compartment + metadata-hygiene',
'Hardened: tails + whonix + vm-isolation packs',
'Monitoring: dark-web + brand + vendor hygiene (FAKE/LAB alerts)',
'Leaks: authorized sources + credential stuffing + breach notify',
'Legal: boundaries + LE handoff + authorized collection',
'TI: stix-ioc-handoff-stub.json + sharing-boundaries (TLP)',
'Reporting: exec-brief + incident template + lessons learned',
'Label: LAB-SAMPLE on all artifacts — NOT production monitoring claims',
'Refusals: no marketplace buys / carding / crime how-tos',
]))
print(f'Wrote {path}')
PYCommand — copy this
grep -E 'LAB-SAMPLE|Refusals|stix-ioc' "$DW_LAB/notes/capstone-evidence-index.txt"
Primary tools to practice this lesson: grep, python3. Reference sites: Tor Project (https://www.torproject.org/); OASIS STIX (https://oasis-open.github.io/cti-documentation/); CISA (https://www.cisa.gov/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Index fields
Artifact name, module lesson, path, UTC date, description, LAB label, redactions applied.
Checklist row ↔ index row accountability.
3. Integrity
$DW_LAB only, LAB label discipline, no crime how-tos, share-safe export.
Scan before seal — remove accidental marketplace or carding references.
4. What you ship: Dark Web evidence pack
Bundled deliverables + index + integrity — chmod 600, report not crime guides default.
5. What you record before the next lesson
Evidence pack path.
6. Wrong vs right: criminal markets vs YOUR OPSEC lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Evidence pack includes marketplace access guide and carding reference sheet.
Right
Evidence pack assembled. Next: Capstone Lab.
Mission: assemble evidence pack
1) Bundle monitoring through reporting index. 2) Integrity statements. 3) Confirm zero crime how-to refs. 4) Gap note for Topic 40 Zero Trust.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum index rows for capstone?”
Knowledge Check
APPLY: Evidence pack includes:
Multiple choice
Knowledge Check
APPLY: True or False: Crime how-tos OK in pack.
True or False
Knowledge Check
APPLY: Integrity line states:
Multiple choice