Automating Threat Hunting on the Dark Web: Tor Scraping & Credential Harvesting
Apurv Gautam demonstrates building automated crawlers and threat intelligence collectors to monitor Tor darknet markets and paste sites for leaked corporate data.
Summary
The Value of Dark Web Telemetry in Enterprise Threat Intelligence
Underground cybercrime forums, paste sites, and darknet leak platforms serve as early indicators of compromised employee credentials and corporate breach data.
Architecting Automated Tor Crawlers and Scrapers
Apurv Gautam details building resilient automated scraping frameworks in Python using Tor proxies, rotating user agents, and CAPTCHA handling.
Extracting, Parsing, and Normalizing Leaked Indicators
The speaker shows how to extract email domains, hashed credentials, and proprietary code snippets from unstructured forum posts and indexed onion pages.
Operationalizing Dark Web Feeds for Threat Hunting
The presentation provides incident responders with methodologies for integrating darknet intelligence into automated SIEM alerting and proactive credential resets.
Related talks
Recon Village·45 min
Levi
Introduces Ambly, an open-source dark web crawler and spider for mapping hidden Tor services and onion sites.
Recon Village·21 min
Manabu Niseki
Manabu Niseki presents Mihari, an open-source framework that queries multiple threat intelligence search engines to continuously track adversary C2 infrastructure.
Village Presentations·52 min
Grecs
Security analyst Grecs shows how to build an agile, cost-effective threat intelligence repository using Evernote and curated open-source indicators.