OSINT Deep & Dark Web Investigation 2 — Questions and Answers
Question 1: What is the primary protocol used by Tor to anonymize traffic across its network?
- SOCKS5 proxy chaining
- Onion routing with layered encryption (Correct answer)
- VPN tunneling with AES-256
- I2P garlic routing
Correct answer: Onion routing with layered encryption
Tor uses onion routing, wrapping traffic in multiple layers of encryption that are peeled off at each relay node.
Question 2: Which tool is specifically designed to enumerate .onion hidden services and map the dark web?
- OnionScan (Correct answer)
- Shodan
- Maltego
- theHarvester
Correct answer: OnionScan
OnionScan is an open-source tool that probes .onion services for security issues and correlating metadata.
Question 3: When accessing dark web markets for OSINT purposes, which risk is most associated with JavaScript being enabled in Tor Browser?
- Slower connection speeds
- De-anonymization via browser fingerprinting or exploits (Correct answer)
- Loss of .onion address resolution
- Increased CAPTCHA frequency
Correct answer: De-anonymization via browser fingerprinting or exploits
Enabled JavaScript can expose real IP addresses through browser exploits or canvas/WebRTC fingerprinting attacks.
Question 4: What does the term 'exit node' refer to in the context of a Tor network investigation?
- The first relay that receives encrypted traffic
- The relay that decrypts and forwards traffic to the destination (Correct answer)
- A compromised Tor directory server
- The hidden service's hosting server
Correct answer: The relay that decrypts and forwards traffic to the destination
The exit node is the final relay in the Tor circuit that decrypts the last layer and sends traffic to the clearnet destination.
Question 5: Which dark web search engine is commonly used by OSINT investigators to index .onion sites?
- DuckDuckGo
- Ahmia (Correct answer)
- Startpage
- Bing Dark
Correct answer: Ahmia
Ahmia is a clearnet-accessible search engine that indexes .onion hidden services while filtering illegal content.
Question 6: What is a 'honeypot' in the context of dark web investigation, and why should investigators be cautious?
- A tool to sweeten search queries for better results
- A fake site operated by law enforcement to identify visitors (Correct answer)
- A cryptocurrency mixing service
- A directory of verified .onion addresses
Correct answer: A fake site operated by law enforcement to identify visitors
Honeypots are traps set by law enforcement or threat actors to identify and deanonymize users who access them.
Question 7: In dark web OSINT, what is the significance of a site's PGP key when assessing its legitimacy?
- It proves the site is government-approved
- It allows verification that communications genuinely originate from the site operator (Correct answer)
- It encrypts the .onion address from search indexing
- It indicates the site uses Bitcoin rather than Monero
Correct answer: It allows verification that communications genuinely originate from the site operator
PGP keys published by dark web operators allow investigators to verify authenticity of signed messages and assess operational consistency.
OSINT Deep & Dark Web Investigation 2
What is the primary protocol used by Tor to anonymize traffic across its network?