🦊 DarkFox 09/15/2026

Darkweb CTI & OSINT Investigation Framework

⚠️ LEGAL DISCLAIMER: DarkFox is designed for authorized security research, cyber threat intelligence (CTI), and lawful OSINT investigations only. Users are responsible for complying with all applicable laws and regulations. Unauthorized access to computer systems is illegal.

---

🎯 What is DarkFox?

🦊 DarkFox is an automated Dark Web investigation framework that streamlines the OSINT/CTI workflow:

• 🔍 Discover - Search for .onion sites using Ahmia
• ✅ Verify - Validate discovered onion addresses
• 📸 Document - Capture screenshots and forensic metadata without visiting the darkweb site!
• 📊 Report - Document and organize findings in a LibreOffice spreadsheet
• 🔒 Secure - Route all traffic through Tor network

Perfect for:

• Cyber Threat Intelligence (CTI) analysts
• Security researchers
• Law enforcement (authorized)
• OSINT investigators
• Red team operations
• Blue team operations

---

✨ Features

Core Capabilities

• 🌐 Automated Tor Integration - Connect via TorGhostNG with country selection
• 🔎 Dark Web Search - pyAhmia powered onion discovery
• 🖼️ Screenshot Capture - GoWitness automated site screenshots
• 📝 Investigation Documentation - LibreOffice Calc worksheets
• 🔄 Real-time Verification - Check onion site availability
• 🗺️ Network Mapping - Track your IP changes (clearnet vs Tor)

Security Features

• ✅ Input sanitization to prevent command injection
• ✅ Proper permission management (no 777 permissions)
• ✅ Process cleanup on exit
• ✅ Tor connection verification
• ✅ Isolated Python virtual environments

---

🚀 Quick Start

Prerequisites

Required:

• Kali Linux XFCE (or Debian-based distro)
• 4GB to 16GB RAM, 4 CPU
• Root/sudo access
• Active internet connection

DarkFox Requirements:

• Tor & TorGhostNG
• pyAhmia
• GoWitness 3.0.5
• LibreOffice Calc
• Firefox ESR
• Python 3 + dependencies

Installation

# Clone the repository
sudo git clone https://github.com/aryanguenthner/darkfox /opt/darkfox

# Navigate to directory
cd /opt/darkfox

# Make scripts executable
sudo chmod +x darkfox.sh

# Run DarkFox
sudo bash darkfox.sh

First Investigation

1. Run the tool:

   sudo bash darkfox.sh
   

2. Enter your search query:

   What are you researching: cybercrime forums
   

3. Wait for results:

   • Tool searches for .onion sites
   • Connects to Tor network
   • Verifies discovered sites
   • Captures screenshots
   • Opens workspace

4. Review CTI findings:

   • LibreOffice opens a spreadsheet with results (Great for taking notes and keeping track of your investigation)
   • Firefox opens a visual gallery using gowitness (Examine the darkweb deepweb target without visiting the site)
   • Top relevant sites open automatically

---

📖 Usage

Basic Investigation

sudo bash darkfox.sh

Follow the interactive prompts:

1. Enter research topic
2. Wait for onion discovery
3. Review results in workspace
4. Document findings in spreadsheet
5. Investigate findings in a visual format

Advanced Options

Custom Tor Exit Country: Edit darkfox.sh and modify:

connect_tor_network "nl"  # Netherlands (default)
# Options: nl, cz, de, us, ca, mx, ru, br, gb, fr, etc.
# Exit the Tor: torghostng -x --dns

Adjust Screenshot Threads:

# In darkfox.sh, find GoWitness command:
--threads 10  # Increase for faster scanning (use with caution)

---

📂 Directory Structure

After installation, DarkFox creates:

/opt/darkfox/
├── investigations/              # All investigation results
│   └── [topic_name_timestamp]/  # Individual investigation
│       ├── results.onion.csv    # Raw search results
│       ├── onion_page_titles.csv # Verified sites with titles
│       ├── screenshots/         # GoWitness captures
│       └── gowitness.db        # Screenshot database
├── tools/
│   ├── gowitness              # Screenshot tool
│   └── onion_verifier.py      # Verification script
├── logs/
│   ├── tor_connection.log     # Tor connection logs
│   ├── verification.log       # Onion verification logs
│   └── gowitness.log         # Screenshot capture logs
└── venv/                      # Python virtual environment

---

🔧 Components

Integrated Tools

Tool	Purpose	Version
Ahmia	Dark web search engine	0.7.3
GoWitness	Screenshot capture	3.0.5
TorGhostNG	Tor routing & anonymity	Latest
LibreOffice Calc	Documentation & reporting	Latest
Firefox ESR	.onion site browsing	Latest

Custom Scripts

• darkfox.sh - Main orchestration script
• onion_verifier.py - Validates .onion addresses
• Installation automation for all dependencies

---

🛡️ Security Considerations

Best Practices

1. Use a Dedicated VM: Run DarkFox in an isolated virtual machine
2. No Personal Info: Never use personal accounts while investigating
3. VPN + Tor: Consider additional VPN layer before Tor
4. NoScript: Install NoScript addon in Firefox (blocks malicious JS)
5. Regular Updates: Keep Kali Linux and tools updated

Threat Model