Dark › Module 2 › Lesson 2
Tor Browser Hygiene
Onion services literacy names v3 onion addresses, hidden service authentication, and defender monitoring context — map one fictional.onion mention on YOUR $DW_LAB before Tor Browser hygiene.
Visual · t39_onion_services_literacy
Onion services literacy. $DW_LAB only. Original Cyberlium.
Opening
Onion services are not synonymous with criminal markets — literacy teaches v3 address format and defender TI context so $DW_LAB notes distinguish technology from unauthorized access.
Onion services — formerly hidden services — let servers reachable via Tor without revealing server IP to clients. v3 onion addresses use 56-character base32 strings that authenticate the service. Defenders may see.onion references in authorized vendor alerts — legal collection channels only, not DIY marketplace browsing. Cyberlium writes onion services row on YOUR $DW_LAB — v3 address format note, hidden service definition, defender monitoring context, refused marketplace access boundary. Next: Tor Browser Hygiene.
1. Onion service components (named)
v3 onion address: 56-char base32 — authenticates service identity to client per Tor Project docs. Hidden service: server reachable via Tor without revealing IP to connecting client. Defender view: brand and leak monitoring may reference.onion in TI alert context — authorized vendor and legal review required.
On $DW_LAB, write onion services row — v3 format note, hidden service definition, defender context sentence.
Command guide
Try these commands — Onion service components (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Onion Services — https://support.torproject.org/onion-services/ Tor Manual — https://tb-manual.torproject.org/onion-services/ Tor Project — https://www.torproject.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export DW_LAB=${DW_LAB:-$HOME/cyberlium-lab/t39-dw}
curl -sS https://support.torproject.org/onion-services/ | head -10
cat > "$DW_TOR/onion-services-literacy.txt" <<'EOF'
Onion services literacy (defensive/educational):
v3 onion address: 56-char base32 — authenticates service to client
Hidden service: server reachable via Tor without revealing IP to client
Defender view: brand/leak monitoring may reference .onion in TI context — legal vendor only
Refused: step-by-step access to criminal marketplaces or fraud shops
EOFCommand — copy this
grep -E 'v3 onion|Refused|Defender' "$DW_TOR/onion-services-literacy.txt"
Primary tools to practice this lesson: curl, grep. Reference sites: Onion Services (https://support.torproject.org/onion-services/); Tor Manual (https://tb-manual.torproject.org/onion-services/); Tor Project (https://www.torproject.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why onion literacy supports defender workflows
TI alerts citing.onion URLs require analysts to distinguish legitimate monitoring context from unauthorized browsing temptation. Misunderstanding onion services leads to policy violations — ad-hoc Tor browsing on employer networks without authorization.
Students document lab onion vocabulary on notes — production alert triage follows authorized vendor playbooks and legal escalation.
3. Lab boundary
Forbidden: step-by-step access to criminal marketplaces or fraud shops. Allowed: onion services literacy card — v3 format and defender context with $DW_LAB FAKE/LAB alert example.
Ship: onion services row for YOUR lab notes. Next: Tor Browser Hygiene.
4. What you ship: onion services row for $DW_LAB
v3 format, hidden service definition, defender context. $DW_LAB named. chmod 600.
5. What you record before the next lesson
Date. Onion services row. $DW_LAB named. File t39-m02-l02-onion-services-literacy.txt chmod 600.
6. Wrong vs right: criminal markets vs YOUR OPSEC lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Write marketplace access steps 'because alerts mention.onion.' Treat every.onion reference as invitation to browse.
Right
Write onion services literacy row for YOUR $DW_LAB. Next: Tor Browser Hygiene.
Mission: draft onion services vocabulary on YOUR lab notes
1) Describe v3 onion address format. 2) Define hidden service in one sentence. 3) Write defender monitoring context sentence. 4) Add refused marketplace access note. chmod 600.
Stuck? Ask Cyberlium AI Mentor
Onion services are a technology — criminal marketplaces are a misuse you refuse.
Knowledge Check
APPLY: Onion services literacy on Cyberlium covers:
Multiple choice
Knowledge Check
APPLY: True or False: Defenders may see.onion references in authorized vendor monitoring alerts.
True or False
Knowledge Check
APPLY: Onion services literacy on Cyberlium uses:
Multiple choice