Building a Research Environment

Learning Objectives

• After this, students can explain the layers of an OSINT research environment and what each layer protects.
• After this, students can set up an isolated virtual machine or browser profile for research.
• After this, students can compare VPNs and Tor and choose appropriately.
• After this, students can test for DNS, WebRTC, and IPv6 leaks and for browser fingerprinting.
• After this, students can keep research identities and research data separate and secure.

Goals of a Research Environment

A research environment is the set of machines, software, network paths, and accounts you use only for investigations. A good one gives you:

• Isolation: malicious files, scripts, and trackers can’t reach your personal computer.
• Separation: nothing links your research back to your real identity or employer.
• Consistency: the environment behaves the same way each time, so you don’t slip up.
• Recoverability: you can reset to a clean state after each investigation.
• Data protection: what you collect stays confidential and gets deleted when it should.

Think in Layers

A weakness in any layer can undo the others. A hardened VM means nothing if you log into your personal Google account inside it.

Virtual Machines

A virtual machine is software that emulates a full computer. Popular free options include VirtualBox and VMware’s desktop hypervisors; Apple Silicon Macs commonly use UTM.

Why VMs are the standard for OSINT work:
- Snapshots let you save a clean state and roll back after each investigation, wiping cookies, downloads, and anything malicious.
- Containment: if you open a booby-trapped document, the damage is (mostly) confined to the VM.
- Separation: the VM has its own browser, accounts, and settings.

Important limits:
- A VM does not hide your IP address. By default (NAT networking) the VM’s traffic leaves through your host’s internet connection. You still need a VPN or Tor for network separation.
- Shared clipboard, drag-and-drop, and shared folders create bridges between the VM and host. Turn them off unless you need them, and never share your whole home folder.
- VMs can be detected. Some tracking tools report whether the visitor appears to be in a virtual machine. A VM protects you; it doesn’t make you invisible.

OSINT-focused distributions

Build-your-own option: many practitioners start from a minimal Debian or Ubuntu VM and add only the tools they need. It takes longer, but you understand every component and have fewer unknowns.

VM hygiene checklist

[ ] Changed default username/password
[ ] Updated the OS and tools
[ ] Disabled shared clipboard, drag-and-drop, shared folders (unless needed)
[ ] Set hostname and username to something generic (not your real name)
[ ] Set time zone and language to fit your research persona/cover
[ ] Took a clean snapshot named with the date
[ ] Revert to the clean snapshot after each investigation (after exporting evidence securely)

Browser Compartmentalization

The browser is where most OSINT happens, and where most identity leaks happen.

Separate profiles

• Firefox: open about:profiles to create a separate profile with its own cookies, history, extensions, and settings.
• Chrome/Chromium: use separate profiles, but do not sign in to sync with a personal Google account.
• Never sync a research profile to a personal account. Sync copies history, bookmarks, and passwords across devices and ties them to you.

Firefox Multi-Account Containers

The Firefox Multi-Account Containers extension (from Mozilla) splits browsing into color-coded container tabs. Cookies and site storage in one container aren’t available to the others. For OSINT this means you can:
- Keep each research account (sock puppet) in its own container
- Keep “logged-out” browsing in a separate container
- Avoid logging in and out repeatedly, which invites mistakes

Containers separate cookies, not your IP address or fingerprint. Sites can still correlate containers that share an IP and fingerprint.

Privacy-hardened browsers

• Tor Browser routes traffic through the Tor network and is designed so its users look alike. It has three security levels:
• Standard: all Tor Browser and website features enabled
• Safer: JavaScript disabled on non-HTTPS sites; some fonts, math symbols, and HTML5 media require a click to load
• Safest: JavaScript disabled on all sites by default, along with some images, fonts, and icons; many sites break
• Mullvad Browser was released in April 2023 by Mullvad VPN and the Tor Project. It is essentially “Tor Browser without the Tor network”: the same anti-fingerprinting protections, meant to be used with a trustworthy VPN. It aims to give all its users the same fingerprint and runs in private mode by default (no cookies or history saved between sessions).

Extensions

Every extension adds attack surface and makes your browser more unique. Install only what you need from reputable sources, such as a content blocker (e.g., uBlock Origin) and the containers extension. Avoid “OSINT toolbar” extensions from unknown developers; they can see every page you visit.

Network Separation: VPN vs. Tor

Key cautions:
- Your corporate or university network is the worst choice. Their IP ranges are publicly registered to the organization (look them up with WHOIS or the Hurricane Electric BGP Toolkit and you’ll see). Visiting a target from them announces who you are. A corporate VPN usually exits from the company’s own IP ranges too.
- Check your network’s acceptable use policy. Some campus and corporate networks prohibit Tor or third-party VPNs.
- Match your exit location to your cover. A persona that “lives in Ohio” but always appears from a German IP is an indicator.
- Use a kill switch. Most VPN apps can block all traffic if the VPN drops, so you don’t silently fall back to your real IP.
- Managed attribution platforms: large organizations sometimes use commercial remote-browser services that route research through controlled, non-attributable infrastructure. It’s worth knowing the category exists.

Routing Research Tools Through a VPN Container: Gluetun

Gluetun (github.com/passteque/gluetun) is a free, open-source (MIT-licensed) VPN client that runs as a small Docker container. Instead of putting your whole computer on a VPN, you run Gluetun and attach other containers to its network: a research browser, a scraper, or an OSINT framework like SpiderFoot or theHarvester (Module 4). Everything those containers send goes through the VPN tunnel, or it doesn’t go anywhere.

Example docker-compose.yml (based on the project README and wiki):

services:
  gluetun:
    image: qmcgaw/gluetun:v3.41.3        # pin a version you've reviewed
    container_name: gluetun              # lets other containers attach by name
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    env_file: gluetun.env                # VPN credentials live here, never in a shared repo
    environment:
      - VPN_SERVICE_PROVIDER=mullvad     # your approved provider
      - VPN_TYPE=wireguard
      - TZ=UTC

  research-tool:
    image: <your OSINT tool image>
    network_mode: "service:gluetun"      # all of this container's traffic uses the VPN

Verify before you research (command from the Gluetun wiki; it should show the VPN’s IP and location, not yours):

docker run --rm --network=container:gluetun alpine:3.22 sh -c "apk add wget && wget -qO- https://ipinfo.io"

Limits and cautions
- The VPN provider still sees your traffic’s metadata. Choose a reputable provider and follow your organization’s policy.
- It only protects what’s attached to it. Your host browser and other apps are unaffected unless you point them at Gluetun’s proxy.
- It doesn’t fix browser-level leaks. Fingerprinting, logged-in accounts, and WebRTC in a browser still apply; run the leak test routine below anyway.
- It needs Docker and elevated container permissions (NET_ADMIN and /dev/net/tun). Check your network’s acceptable use policy first.
- VPN keys are secrets. Keep them in an .env file that is never committed (see Module 5 on code repository leaks and Module 9 on secret scanning).
- Supply-chain OPSEC: use only official sources. The README warns that the GitHub repository and the gluetun-wiki are the only official Gluetun websites, and that other sites claiming to be official are scams. The official images are qmcgaw/gluetun and ghcr.io/qdm12/gluetun.
- Teaching moment: in May 2026 the maintainer moved the repository from github.com/qdm12/gluetun to github.com/passteque/gluetun.
- The old link now redirects to the new one.
- It’s the same repository, with the same history and stars.
- The move was announced in the README beforehand.
- The image names didn’t change.
- At first glance, a legitimate move looks just like a lookalike repo. Check those signals before trusting a new link.

Leaks: What They Are and How to Test

Even with a VPN, your real identity can leak through side channels.

A simple leak test routine

1. On your normal browser with no VPN, visit ipleak.net and note your real IP, DNS servers, and location.
2. Connect the VPN (or open Tor Browser) inside your research environment.
3. Visit ipleak.net and browserleaks.com/webrtc again.
4. Confirm: the IP shown is NOT your real IP, the DNS servers are NOT your ISP's, WebRTC shows no real/local IPs you care about, and no IPv6 address belongs to you.
5. Record the results with the date.

Browser Fingerprinting

Browser fingerprinting identifies a browser by combining many small attributes: user agent, screen size, time zone, language, installed fonts, graphics card details (WebGL), how it draws hidden images (canvas), extensions, and more. It needs no cookies, so clearing cookies or opening a new container doesn’t change it.

Test sites:
- Cover Your Tracks (coveryourtracks.eff.org), run by the Electronic Frontier Foundation: shows how well your browser blocks trackers and how unique your fingerprint is
- AmIUnique (amiunique.org): shows how rare your fingerprint is compared with its dataset
- BrowserLeaks (browserleaks.com): detailed individual tests (canvas, WebGL, fonts, JavaScript attributes, TLS, and more)

Two strategies:
1. Blend in: use a browser designed so everyone looks the same (Tor Browser, Mullvad Browser). Don’t customize it, because customization makes you unique.
2. Randomize: some tools randomize attributes so you look different each visit. This can work but can also look unusual.

Common mistakes: installing lots of extensions, changing fonts, or using a rare language/time zone combination that makes your “anonymous” browser one of a kind.

Separating Identities: Email and Phone

• Dedicated research email accounts, never your personal or school email. Use them only for their assigned purpose.
• Dedicated phone numbers obtained through your organization’s approved process. Never attach a personal phone number to a research account. Platforms use phone numbers and contact lists to suggest connections (“People You May Know”), which can put your persona in front of your real friends, or your real account in front of the target.
• Don’t install research apps on your personal phone, and never sync contacts from research accounts.
• Separate password manager vault (or separate entries clearly labeled) for research credentials.
• Usernames: never reuse a personal handle for research. Reused usernames are one of the most common ways people get linked (see the Ross Ulbricht case in 8.4-common-opsec-mistakes.md).

Keeping Research Data Secure

What you collect is sensitive: personal data about real people, client weaknesses, and sometimes evidence.
- Encrypt at rest: full-disk encryption on the host (BitLocker, FileVault, LUKS) and encrypted containers (e.g., VeraCrypt) for case folders.
- Organize by case: one folder per investigation, with a clear evidence log (see Module 7).
- Limit access: only people on the engagement should see the data.
- Don’t use personal cloud storage for case data. Use your organization’s approved storage.
- Export before you revert: move evidence out of the VM securely before rolling back a snapshot.
- Retention and deletion: delete data when the engagement ends, per your contract (minimization, from Module 2).
- Strip metadata from anything you share (see 8.4-common-opsec-mistakes.md).

A Class-Level Setup (Good Enough to Start)

1. Install VirtualBox (or UTM on Apple Silicon).
2. Import the Trace Labs OSINT VM (or build a minimal Debian VM). Change the default password.
3. Update everything, disable shared clipboard/folders, take a snapshot.
4. Inside the VM, create a separate Firefox profile with Multi-Account Containers and a content blocker, or use Mullvad Browser.
5. Connect through an approved VPN (if your network policy allows it) and run the leak test routine. If you run your tools in Docker, route them through a Gluetun container instead of putting the whole VM on the VPN.
6. Check your fingerprint on Cover Your Tracks and write down what makes you unique.
7. Never log into personal accounts inside the VM.

Key Terms

• Virtual machine (VM): software that emulates a separate computer inside your real one.
• Snapshot: a saved state of a VM you can roll back to.
• Browser profile / container: separate storage areas for cookies and site data.
• VPN (Virtual Private Network): an encrypted tunnel that makes your traffic appear to come from the VPN provider.
• Tor: a network that routes traffic through three relays to separate who you are from where you’re going.
• DNS leak: domain lookups escaping outside the VPN tunnel.
• WebRTC leak: a browser real-time communication feature revealing your real IP address.
• Kill switch: a VPN feature that blocks traffic if the VPN disconnects.
• Gluetun: an open-source VPN client that runs as a Docker container; other containers can share its network so all their traffic goes through the VPN.
• Browser fingerprinting: identifying a browser from a combination of its attributes, without cookies.
• Managed attribution: controlling what identity and location your research traffic appears to come from.

Key Takeaways

• Think in layers: host → VM → OS → browser → accounts → network; one weak layer undoes the rest.
• A VM isolates and resets, but doesn’t hide your IP.
• Never research from corporate or campus IPs, and never log into personal accounts in your research environment.
• VPN for everyday OSINT, Tor for high-risk work; each has trade-offs.
• Gluetun puts your tools, not your whole machine, behind a VPN with a kill switch and DNS over TLS; get it only from its official sources.
• Test for DNS, WebRTC, and IPv6 leaks before you start (ipleak.net, BrowserLeaks).
• Fingerprinting ignores cookies; blend in with Tor/Mullvad Browser and don’t over-customize.
• Separate emails, phone numbers, and usernames for research.
• Encrypt case data and delete it when the engagement ends.

References

• Trace Labs OSINT VM — GitHub
• Trace Labs OSINT VM 2026.05: Rebuilt on Debian — Trace Labs blog
• VM Introduction — Trace Labs Docs
• OSINT: Operational Security, Virtualisation and Trace Labs — SpecialEurasia
• Tsurugi Linux
• CSI Linux: Linux Distribution for Cyber and OSINT Investigation — HackerNoon
• Multi-Account Containers — Mozilla Support
• How Firefox’s Total Cookie Protection and container extensions work together — Mozilla Add-ons Blog
• Tor Browser security settings — Tor Project Support
• Gluetun VPN client — GitHub (passteque/gluetun)
• Gluetun wiki — GitHub (qdm12/gluetun-wiki)
• Connect a container to Gluetun — Gluetun wiki
• Test your setup — Gluetun wiki
• DNS options — Gluetun wiki
• qmcgaw/gluetun — Docker Hub
• Mullvad Browser: Tor without Tor — Mullvad
• We’ve Teamed Up With Mullvad VPN to Launch the Mullvad Browser — Tor Project Blog
• ipleak.net
• BrowserLeaks
• Cover Your Tracks — EFF
• What browser fingerprinting tests like AmIUnique and BrowserLeaks really show — Castle