Lab #03 · OSINT attribution walkthrough

Self-hosted lab, one script

This lab is fully self-hosted. On a dedicated Ubuntu, Debian or Fedora desktop, the setup script installs Tor, Nginx and the training material in a few minutes and generates a unique Onion address each time. It auto-detects apt or dnf. All data is synthetic.

⬇ Download the setup script (.sh)

1. Lab setup

bash, run as root on the trainer desktop (Ubuntu / Debian / Fedora)

curl -O https://www.synapse-consulting.eu/assets/labs/setup-synapse-osint-lab.sh

# preview without changing anything
sudo bash setup-synapse-osint-lab.sh --help

# install (~3-5 min depending on the connection)
sudo bash setup-synapse-osint-lab.sh

Architecture

Trainer machine

Ubuntu / Debian / Fedora desktop, VM or bare metal

Nginx :8080, Onion backend (127.0.0.1 only)Tor daemon, routes :80 to :8080 internallyNginx :8081, clearnet (student network)

→

Student, Onion

Tor Browser or torsocks

http://<address>.onion/standard port 80, no number to type

Student, clearnet

Standard browser + /etc/hosts entry

http://lab-clearnet.local:8081/

🔀 Port 8080 is invisible to the student. Tor receives connections on standard port 80 (hence no port number in the .onion URL) and forwards them internally to Nginx on 127.0.0.1:8080. Only port 8081 needs to be shared with students, and only for the clearnet site.

Prerequisites

Trainer machine (server)

Ubuntu, Debian or Fedora, desktop (not a headless server)
root / sudo access
Internet access (apt + Tor bootstrap)
2 GB RAM, 4 GB disk minimum
Port 8081 reachable from the student network

Student workstation

Linux, macOS or Windows (WSL2)
Tor Browser for Onion access
exiftool, gpg, sha256sum, wget
Network access to the trainer machine (port 8081)
/etc/hosts entry provided by the trainer

output, information to share with students

============================================================
 SYNAPSE OSINT LAB IS READY
============================================================
 Onion URL:       http://<56-chars>.onion/     <- share with students
 Clearnet URL:    http://lab-clearnet.local:8081/
 Student hosts:   192.168.x.x lab-clearnet.local <- /etc/hosts line
 PGP fingerprint: XXXX XXXX XXXX XXXX XXXX ...
 Trainer files:   /opt/synapse-osint-lab/

⚠️ The .onion address is reachable by anyone who knows it. Share it only through an internal session channel, never in course material or a public channel.

2. Student configuration

Three steps only. No special network configuration is required.

Add the local DNS entry (`/etc/hosts`)

/etc/hosts

The clearnet site uses the name lab-clearnet.local, which does not exist in public DNS. The trainer shares the server IP at the end of setup. Without this step, the browser cannot find the clearnet site.

Linux / macOS, terminal

# replace 192.168.x.x with the IP given by the trainer
echo "192.168.x.x  lab-clearnet.local" | sudo tee -a /etc/hosts

# check that resolution works
ping -c1 lab-clearnet.local

Windows, PowerShell as Administrator

Add-Content -Path "C:\Windows\System32\drivers\etc\hosts" `
            -Value "192.168.x.x  lab-clearnet.local"

ping lab-clearnet.local

⚠️ Windows: Notepad or PowerShell must be run as Administrator, otherwise the hosts change is silently ignored. Always verify with ping lab-clearnet.local.

Install Tor Browser (Onion access)

Tor

Tor Browser is the only lab-specific prerequisite. It handles the Tor network automatically. Download it from torproject.org/download (Linux, Windows, macOS).

Linux, CLI alternative (without Tor Browser)

sudo apt-get install -y torsocks

# Onion connectivity test (address given by the trainer)
torsocks curl -sI http://<address>.onion/
# HTTP/1.1 200 OK means the lab is reachable

Install the analysis tools

apt / brew

gpg and sha256sum ship by default on most Linux distributions. Usually only exiftool needs installing.

Debian / Ubuntu / Kali

sudo apt-get install -y exiftool gnupg curl wget

exiftool -ver   # 12.x
gpg --version   # 2.x
sha256sum --version

✓

Final check, both sites reachable

curl

bash

# clearnet site
curl -sI http://lab-clearnet.local:8081/     # HTTP/1.1 200 OK

# Onion site (Tor Browser, or torsocks in CLI)
torsocks curl -sI http://<address>.onion/    # HTTP/1.1 200 OK

3. End of session, teardown

After each session, remove the whole environment to invalidate the Onion address. Reusing the same address across sessions creates continuity between participants and breaks the realism of the exercise.

bash

# reinstall with a fresh Onion identity for the next session
sudo bash setup-synapse-osint-lab.sh

✅ Environment ready. Give students the .onion address and the /etc/hosts line, then send them to the Scenario below to start the investigation.

4. Scenario

An Onion site called Black Harbor publishes documents tied to Project ORION, a confidential file your organisation knows. At the same time, a clearnet forum hosts the profile of one AlexM, openly interested in privacy and archives.

The two presences look independent. Your job is to decide, with a rated level of confidence, whether they are the same individual or a coincidence. You only have the artefacts publicly available on both sites.

🛡️ Controlled environment. This lab is entirely synthetic. No real individual, organisation or data is involved. Never use these techniques on real targets without explicit authorisation. Keep all Tor traffic on the lab's isolated network.

Mission, expected deliverables

Collection: preserve every page and downloaded file. Compute the SHA-256 of each artefact.
Metadata: extract and document every PDF metadata field.
PGP: import the public key and record the full fingerprint.
Visual correlation: compare the SHA-256 of the two sites' graphic assets.
Pseudonym analysis: document every identifier variant found.
Timezone and language: analyse temporal patterns and recurring phrasing.
Report: rate each indicator (strong / medium / weak / false lead) and conclude with a confidence level.

5. Working setup and evidence preservation

bash

mkdir -p ~/osint-lab03/{onion,clearnet,analysis}
cd ~/osint-lab03

# download every Onion artefact
torsocks curl -sO http://<address>.onion/downloads/orion_sample.pdf
torsocks curl -sO http://<address>.onion/downloads/black-harbor-public-key.asc
torsocks curl -sO http://<address>.onion/downloads/banner.svg
torsocks curl -sO http://<address>.onion/downloads/posts.csv

# clearnet assets
wget -P clearnet/ http://lab-clearnet.local:8081/assets/profile-background.svg

# compute and save every hash NOW, before any analysis
sha256sum onion/* clearnet/* > analysis/hashes.txt

💡 OSINT golden rule: compute and record the SHA-256 before any change or analysis. That establishes the chain of custody and proves you did not alter the artefacts.

6. Investigation walkthrough

PDF metadata analysis

exiftool · pdfinfo

The PDF is often the artefact richest in unintended metadata. Tools like LibreOffice or Word automatically embed the system username, the application name and sometimes the file path.

bash

exiftool onion/orion_sample.pdf
pdfinfo  onion/orion_sample.pdf

expected output (key fields)

Title     : Project ORION - Sample
Author    : alex.m
Subject   : North Sea Digital / Internal research
Creator   : LibreOffice 24.2 -- AlexM workstation
Producer  : ReportLab PDF Library - www.reportlab.com

Authoralex.m

CreatorLibreOffice 24.2, AlexM workstation

SubjectNorth Sea Digital / Internal research

💡 alex.m in Author plus AlexM workstation in Creator: two independent references to the same identifier in a single file. Log them separately, both rated medium (metadata is editable, but consistent).

PGP key analysis

gpg

A public PGP key is available on the Onion site. The fingerprint is a 40-hex-character cryptographic identifier. If it reappears elsewhere, it proves both parties control the same private key.

bash

gpg --no-default-keyring --keyring /tmp/lab-keyring.gpg \
    --import onion/black-harbor-public-key.asc
gpg --no-default-keyring --keyring /tmp/lab-keyring.gpg \
    --fingerprint northsea@example.invalid

output

pub   ed25519 2026-... [S] [expires: 2027-...]
      XXXX XXXX XXXX XXXX XXXX  XXXX XXXX XXXX XXXX XXXX
uid   North Sea Lab (Synthetic OSINT training identity)

Now read the fingerprint shown on the clearnet site and compare:

bash

curl -s http://lab-clearnet.local:8081/ | grep -o '[A-F0-9 ]\{45,\}'

🔑 If both fingerprints match, that is the strongest possible correlator: the same private key generated both. Two different people cannot share a PGP fingerprint without explicit collaboration.

Visual asset correlation, SHA-256

sha256sum

Both sites host an SVG graphic. Named differently (banner.svg and profile-background.svg), they look like two distinct resources. Are they really different?

bash

sha256sum onion/banner.svg clearnet/profile-background.svg
# identical hashes -> same file, same author

💡 Different file names do not imply different content. The SHA-256 hash depends only on the bytes, not the name. An identical hash means the two files are exact copies of one original, distributed on both sites unchanged.

Pseudonyms and false leads

manual analysis

Several identifier variants are present. Map them all before concluding on their link.

Onion siteN0rthSea, post author

PDF (Author)alex.m

PDF (Creator)AlexM workstation

Clearnet profileAlexM

Clearnet postnorthsea-dev (repository alias)

Clearnet (other)N0rthSee, FALSE LEAD

⚠️ N0rthSee is not N0rthSea. The difference is intentional. The clearnet page states it is an unrelated account. Document it as noted and discarded. Including a false lead in your findings would weaken the case.

leet-speak pattern and normalisation

N0rthSea     -> 0 to o -> "NorthSea"  (classic leet substitution)
northsea-dev -> same root "northsea" + "-dev" suffix (technical alias)
AlexM        -> "Alex" + initial "M" (first name + surname)
alex.m       -> same pattern with "." separator (email / Unix format)

Temporal and timezone correlation

posts.csv

The posts.csv file holds the Onion persona's activity timestamps. The clearnet profile states a timezone. Check whether the activity patterns are compatible.

bash

cat onion/posts.csv

posts.csv

timestamp_utc,source,username,event
2026-06-14T06:42:00Z,onion,N0rthSea,Published announcement
2026-06-14T11:18:00Z,forum,N0rthSea,Posted technical comment
2026-06-15T19:36:00Z,onion,N0rthSea,Uploaded ORION sample
2026-06-16T07:10:00Z,blog,AlexM,Updated profile

N0rthSea 06:42 UTC= 08:42 CEST, usual early morning

N0rthSea 11:18 UTC= 13:18 CEST, lunch time

AlexM 07:10 UTC= 09:10 CEST, morning, same zone

Clearnet profileUTC+2 (CEST) explicitly stated

💡 Timezone alone is a weak indicator (hundreds of millions live in UTC+2). Coupled with the others, it corroborates the profile without creating it. Note the distinction in your report: corroboration is not proof.

Linguistic fingerprint

grep · manual analysis

Humans have stable language tics: a recurring phrase, a characteristic grammatical error, a vocabulary choice. Check whether an identical phrase appears on both sites.

bash

grep -r "evidence" onion/ clearnet/
strings onion/orion_sample.pdf | grep -i "evidence"
grep -i "evidence" onion/banner.svg

🔍 The phrase "Every evidence tells a story, if you listening carefully." appears on the Onion site, in the SVG, in the PDF and in a clearnet post. Note the grammatical error, "if you listening" instead of "if you're listening". This stable mistake is an idiolect marker, a medium indicator that grows stronger through repetition and cross-medium consistency.

Correlation matrix and confidence report

synthesis

Before concluding, classify each indicator. A serious OSINT report separates what is cryptographically proven, what is corroborated by several sources, what is suggestive, and what is invalidated.

Indicator	Source	Confidence	Rationale
Identical PGP fingerprint on both sites	gpg --fingerprint	Strong	Control of the same private key, not forgeable without compromise
Identical SHA-256, banner.svg / profile-background.svg	sha256sum	Strong	Exact copy of the same file on both sites
PDF Author: "alex.m"	exiftool	Medium	Consistent with AlexM, but PDF metadata is editable
PDF Creator: "AlexM workstation"	exiftool	Medium	Second independent reference in the same file
Recurring phrase with a stable grammatical error	grep / analysis	Medium	Four identical occurrences, idiolect marker, but imitable
N0rthSea / northsea-dev / AlexM / alex.m, same root	lexical analysis	Weak	Consistent but no cryptographic proof, possible coincidence
Timezone UTC+2, morning activity pattern	posts.csv	Weak	Corroborating only, hundreds of millions in UTC+2
N0rthSee (clearnet), similar account	clearnet HTML	False lead	Explicitly stated as unrelated, discard from the case

📝 Conclusion template: "Based on [N indicators], including [X strong] of a cryptographic nature, we attribute with a [MODERATE / HIGH] level of confidence the personas N0rthSea (Onion) and AlexM (clearnet) to the same individual. This is not judicial proof and cannot identify a real individual from this data alone."

7. Instructor answer key

Reveal the answer key

✅ Expected conclusion: MODERATE TO HIGH confidence that N0rthSea and AlexM are the same individual, based on two cryptographically strong indicators (identical PGP fingerprint + identical SVG hash), corroborated by medium indicators (PDF metadata, idiolect) and weak ones (timezone, pseudonyms). One indicator was discarded (N0rthSee).

Key learning points

Why the PGP fingerprint is strong: holding the matching private key is required to produce a valid signature. Without key compromise, two different entities cannot share a fingerprint.
Why the SHA-256 hash is strong: two files with the same hash are, in practice, the same file. An attacker would have to change at least one byte to create distance.
Why PDF metadata is only medium: Author and Creator are fully editable after the fact with exiftool -Author="other" file.pdf. They corroborate, they do not prove.
The grammatical error as idiolect: "if you listening" is a stable non-native marker. Its identical presence across four artefacts strengthens attribution, but an adversary who knows the technique could reproduce it on purpose.

Debrief, countermeasures

PGP fingerprint, use a different key per persona
Identical SVG, alter the file before reuse (one pixel is enough)
PDF metadata, strip with exiftool -all= file.pdf
Idiolect, proofread with a grammar checker
Timezone, use Tor + VPN to mask the system time

8. Resources

OSINT Framework

Catalogue of OSINT tools and sources by target type.

ExifTool, Phil Harvey

Metadata extraction and editing for 150+ file formats.

GnuPG Documentation

Reference on PGP keys, fingerprints and signature verification.

Tor Browser Manual

Official guide for reaching Onion services via Tor Browser.

MITRE, Reconnaissance

Techniques T1589, T1592, T1598, information gathering on targets.

Bellingcat Guides

OSINT investigation methodologies used by investigative journalists.

← Back to Labs

Entirely fictional environment, for educational use only. Confine all Tor traffic to the lab network.

Multi-source OSINT attribution: Black Harbor / Project ORION

Self-hosted lab, one script

1. Lab setup

Architecture

Prerequisites

Trainer machine (server)

Student workstation

2. Student configuration

Add the local DNS entry (/etc/hosts)

Install Tor Browser (Onion access)

Install the analysis tools

Final check, both sites reachable

3. End of session, teardown

4. Scenario

Mission, expected deliverables

5. Working setup and evidence preservation

6. Investigation walkthrough

PDF metadata analysis

PGP key analysis

Visual asset correlation, SHA-256

Pseudonyms and false leads

Temporal and timezone correlation

Linguistic fingerprint

Correlation matrix and confidence report

7. Instructor answer key

Key learning points

Debrief, countermeasures

8. Resources

Add the local DNS entry (`/etc/hosts`)