Controlled Reconnaissance on Hidden Services: Source Governance and Isolation Architectures

Abstract

Investigative research on Tor hidden services requires stringent operational discipline. Unlike indexing standard clearnet websites, querying .onion services exposes research infrastructure to untrusted inputs, malicious client-side scripting, and potential deanonymization traps. This paper proposes a three-tier isolation architecture combining controlled source whitelisting, SOCKS5 proxy segregation, and script-stripped DOM rendering under restrictive Content Security Policies.

1. The Operational Threat Model

When an investigative tool interacts with an untrusted hidden service, it faces three distinct threats:

Malicious Active Content: Execution of JavaScript designed to exploit browser memory bugs or fingerprint hardware.
Out-of-Band Callbacks: Hidden services embedding references to clearnet URLs or unique subdomains to observe whether the investigator's resolver leaks direct IP requests.
Resource Exhaustion: Unbounded recursive link crawling leading to multi-gigabyte payload downloads over slow onion circuits.

2. The Three-Tier Isolation Model

text
Layer 1: Source Governance (Allow-list only)
  ├── Queries restricted to approved .onion addresses
  └── Automatic rejection of unverified third-party redirections

Layer 2: Transport & Routing Isolation
  ├── Requests routed strictly through local Tor SOCKS5 socket (port 9050)
  ├── Hard timeout limits (15 seconds) to prevent worker starvation
  └── DNS queries forced through Tor daemon (SOCKS5h) to eliminate DNS leakage

Layer 3: Ingestion & Sandboxed Presentation
  ├── Response payload stripped of <script>, <style>, <iframe>, <object>
  ├── Stripped HTML saved as static text artifact
  └── Rendered in investigator view inside iframe sandbox="allow-same-origin"

3. Strict Content Security Policy (CSP) Enforcement

To eliminate the risk of delayed client execution, preview surfaces must be served with non-negotiable CSP headers:

http
Content-Security-Policy: default-src 'none'; img-src data:; style-src 'self' 'unsafe-inline';
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN

By ensuring that default-src 'none' is enforced, the browser is categorically prohibited from initiating any secondary network requests, ensuring total isolation for the analyst.