SYSTEM OVERVIEW:
This operating system is designed for privacy research, penetration testing, and secure communications. All network traffic is routed through Tor by default with an optional VPN overlay.
DEFAULT CREDENTIALS:
Username: tinfoil Password: tinfoil (CHANGE THIS IMMEDIATELY)
BASIC OPERATION:
- Right-click anywhere on the desktop for the main menu - Middle-click for window operations - Super+Enter opens a terminal - Super+D minimizes all windows
FIRST BOOT SEQUENCE:
1. System automatically randomizes MAC address 2. WireGuard VPN connects (if configured) 3. Tor daemon starts with obfuscated bridges 4. I2P daemon starts in background 5. Network verification completes 6. Documentation opens in browser
VERIFY CONNECTIVITY:
- Open terminal and type: check-ip - This shows your Tor-exit IP address - Type: tor-status to verify Tor is running - Type: i2p-status to verify I2P is running
CRITICAL REMINDERS:
- This system is amnesiac by default - Changes are not saved unless persistence is enabled - Always use panic procedures if compromised - Never connect without VPN+Tor chain active
ARCHITECTURE:
WireGuard VPN (outer) -> Tor Transparent Proxy (inner) -> Applications
DEFAULT SETUP:
The system automatically routes all TCP traffic through Tor's transparent proxy on port 9040. UDP DNS queries are routed through Tor's DNSPort on port 5353.
VPN CONFIGURATION:
1. Place your WireGuard config at: /etc/wireguard/wg0.conf 2. Test with: wg-quick up wg0 3. Enable auto-start: systemctl enable wg-quick@wg0
TOR CONFIGURATION:
Main config file: /etc/tor/torrc - TransPort 9040 (transparent proxy) - DNSPort 5353 (DNS over Tor) - SocksPort 9050 (SOCKS5 proxy for applications)
BRIDGE CONFIGURATION:
If Tor is blocked, add bridges to /etc/tor/torrc: Bridge obfs4 <IP>:<PORT> <FINGERPRINT> Then restart: systemctl restart tor
VERIFICATION:
check-ip - Shows current exit IP via SOCKS proxy nyx - Interactive Tor status monitor curl --socks5-hostname 127.0.0.1:9050 ifconfig.me
PROXYCHAINS:
All tools run through proxychains by default. Config: /etc/proxychains4.conf Proxy chain: SOCKS5 127.0.0.1 9050
I2P OVERVIEW:
I2P (Invisible Internet Project) is an anonymous overlay network. It runs alongside Tor and provides access to eepsites (.i2p domains).
STARTING I2P:
systemctl start i2p systemctl enable i2p (auto-start on boot)
I2P STATUS:
i2p-status - Shows daemon status i2p-console - Opens web console (localhost:7657)
WEB CONSOLE ACCESS:
Browser -> http://127.0.0.1:7657 Default credentials: Username: i2p Password: i2p (CHANGE THIS)
SAM BRIDGE (for applications):
SAM (Simple Anonymous Messaging) runs on port 7656 Used by applications to connect to I2P network
I2P APPLICATIONS:
- I2P-Bote: Anonymous email system - I2PSnark: Bittorrent over I2P - SusiMail: Anonymous webmail - I2P Tunnel Manager: Manage outbound/inbound tunnels
PROXY CHAIN CONFIGURATION:
For proxychains4, add to /etc/proxychains4.conf: http 127.0.0.1 4444 (HTTP proxy) socks4 127.0.0.1 4447 (SOCKS4) socks5 127.0.0.1 4447 (SOCKS5)
ACCESSING EEPSITES:
Use I2P HTTP proxy on localhost:4444 Example: http://<eepsite>.i2p
FINDING EEPSITES:
Use the I2P console's "Explore" feature Or use official I2P directory services
FILE CLEANING:
secure-delete - srm, sfill, sswap, sdmem (Gutmann method) wipe - Secure file wiping with multiple passes bleachbit - GUI system cleaner with shredding mat2 - Metadata anonymization for files exiftool - EXIF data viewer/editor
ENCRYPTION:
gpg - OpenPGP encryption and signing openssl - Crypto toolkit (AES, RSA, etc.) cryptsetup - LUKS disk encryption veracrypt - Cross-platform encrypted containers ecryptfs-utils - Encrypted home directories
STEGANOGRAPHY:
steghide - Hide data in images/audio outguess - Image steganography f5-stego - JPEG steganography cloakify - Data transformation for exfiltration
COMMUNICATION:
pidgin + otr - Multi-protocol IM with OTR ricochet - Tor-based instant messaging (no metadata) onionshare - File sharing over Tor firejail - Application sandboxing
SYSTEM HARDENING:
apparmor - Application-level access control fail2ban - Brute-force protection rkhunter - Rootkit detection chkrootkit - Rootkit detection lynis - System security auditing aide - File integrity monitoring tripwire - File integrity monitoring auditd - Linux audit framework
UTILITY COMMANDS:
wipe -rf /path - Secure delete directory sdmem - Wipe RAM (run before shutdown) mat2 /path/file - Remove metadata from file steghide embed -cf image.jpg -ef secret.txt gpg -c file.txt - Symmetric encrypt gpg -e -r user file.txt - Asymmetric encrypt
All tools are pre-configured to use Tor SOCKS proxy (127.0.0.1:9050)
Use proxychains4 prefix for tools that don't support SOCKS natively
NETWORK RECONNAISSANCE:
nmap -sS -A target - SYN scan with OS detection masscan 0.0.0.0/0 -p80 - Internet-wide port scan dnsrecon domain.com - DNS enumeration theharvester domain.com - Email/domain enumeration fierce domain.com - DNS brute forcing
VULNERABILITY SCANNING:
nikto -h target.com - Web server scanner wpscan target.com - WordPress vulnerability scanner sqlmap -u target.com/?id=1 - SQL injection testing nmap --script vuln target.com - NSE vulnerability scan
PENETRATION TESTING:
metasploit - Framework (msfconsole, msfvenom) hydra -l user -P passlist ssh://target - SSH brute force john --wordlist=passlist hash.txt - Password cracking hashcat -m 0 hash.txt wordlist.txt - GPU-accelerated cracking
WIRELESS TESTING:
airmon-ng start wlan0 - Enable monitor mode airodump-ng wlan0mon - Capture wireless packets aireplay-ng -0 5 -a AP_MAC wlan0mon - Deauth attack reaver -i wlan0mon -b AP_MAC - WPS brute force
DIRECTORY BRUTE FORCE:
gobuster dir -u target.com -w wordlist.txt dirb target.com ffuf -u target.com/FUZZ -w wordlist.txt
NETWORK INTERCEPTION:
bettercap - MITM framework dsniff - Password sniffer tcpdump -i any -w capture.pcap - Packet capture wireshark - GUI packet analyzer ngrep -d any port 80 - HTTP packet inspection
PROXY CHAIN USAGE:
proxychains4 nmap -sT -Pn target.com proxychains4 sqlmap -u target.com proxychains4 hydra ... (all tools)
IMPORTANT: All testing must be performed on systems you own or have explicit written permission to test. Unauthorized access is illegal in most jurisdictions.
LEVEL 1: SUSPICIOUS ACTIVITY
- Type: panic-status (shows current threat level) - Type: panic-kill (shreds all user data, preserves system) - Close all applications immediately
LEVEL 2: ACTIVE THREAT
- Type: panic-full (shreds everything including system logs) - Type: panic-usb (destroys LUKS header on persistence partition) - Physically disconnect network cables - Remove USB device immediately
LEVEL 3: RAID PROCEDURE
- Hard power off (hold power button 5 seconds) - Remove all storage devices - Destroy physical media if necessary - Wait 30 seconds, reboot from clean media
PANIC SCRIPTS LOCATION:
/usr/local/bin/panic-kill - Shreds user data only /usr/local/bin/panic-full - Shreds all data + logs /usr/local/bin/panic-usb - Destroys persistence partition
AUTO-PANIC TRIGGERS:
- USB removal (if persistence is active) - Failed network authentication - Kernel panic detection - File integrity violations
MANUAL PANIC:
- Hold Super+P for 3 seconds (configurable) - Press physical kill-switch (if USB hardware supports) - Remove network cable + USB simultaneously
PERSISTENCE DESTRUCTION:
cryptsetup luksErase /dev/sdb2 (destroys encryption header) dd if=/dev/urandom of=/dev/sdb bs=1M count=10 (corrupts USB)
POST-PANIC PROCEDURES:
1. Boot from fresh Tinfoil ISO 2. Verify no persistence remnants 3. Change all passwords from separate system 4. Report incident to security team (if applicable)
REMEMBER: Physical security is paramount. No software protection can defeat a camera in your room.
PERSISTENCE OVERVIEW:
By default, Tinfoil Hat is fully amnesiac. All changes are lost on reboot. Enable persistence to save configurations, keys, and data. WARNING: Persistence creates evidence. Use only when necessary.
METHOD 1: LUKS ENCRYPTED USB PARTITION
1. Partition USB: /dev/sdb1 (FAT32, bootable) + /dev/sdb2 (LUKS) 2. cryptsetup luksFormat /dev/sdb2 3. cryptsetup open /dev/sdb2 persistence 4. mkfs.ext4 /dev/mapper/persistence 5. Mount to /mnt/persistence 6. Symlink: ln -s /mnt/persistence/home/user /home/user
METHOD 2: FILE-BASED ENCRYPTION
1. Create encrypted container: dd if=/dev/urandom of=/home/user/container.img bs=1M count=1024 2. cryptsetup luksFormat container.img 3. cryptsetup open container.img container 4. mkfs.ext4 /dev/mapper/container 5. Mount to /mnt/container
AUTO-MOUNT ON BOOT:
Create /etc/crypttab: # <target> <source> <key> <options> persistence /dev/sdb2 none luks
MODIFY .BASHRC TO LOAD PERSISTENCE:
if [ -b /dev/sdb2 ]; then cryptsetup open /dev/sdb2 persistence mount /dev/mapper/persistence /home/user export HOME=/home/user fi
PERSISTENCE CONTENT TYPES:
- GPG keyrings - SSH keys - WireGuard configs - Browser profiles (Tor Browser) - I2P router configuration - Custom shell aliases - Saved scripts and tools
PERSISTENCE SECURITY:
- Always use LUKS2 with Argon2 - Use strong passphrases (minimum 20 characters) - Store recovery key separately - Enable keyfile + passphrase (two-factor) - Regular backup of encrypted container
REMOVING PERSISTENCE:
- shred -vfz -n 10 /dev/sdb2 - Or: cryptsetup luksErase /dev/sdb2 - Physical destruction if necessary
NO NETWORK CONNECTION:
1. Check interfaces: ip link show 2. Reset networking: systemctl restart systemd-networkd 3. Check Tor: systemctl status tor 4. Check VPN: wg show 5. Manual bypass: /usr/local/bin/tinfoil-net-reset
TOR NOT STARTING:
1. Check log: journalctl -u tor -f 2. Check config: tor --verify-config 3. Reset config: cp /usr/share/tinfoil/torrc.default /etc/tor/torrc 4. Restart: systemctl restart tor 5. Check time: timedatectl (Tor requires accurate clock)
I2P NOT RESPONDING:
1. Check daemon: systemctl status i2p 2. Check ports: netstat -tlnp | grep i2p 3. Reset router: i2prouter restart 4. Clear cache: rm -rf /var/lib/i2p/*.cache 5. Web console: http://127.0.0.1:7657
VPN CONNECTION FAILED:
1. Check config: wg showconf wg0 2. Test handshake: wg show 3. Check interface: ip addr show wg0 4. Restart: wg-quick down wg0 && wg-quick up wg0 5. Check firewall: iptables -L -n -v
PROXYCHAINS NOT WORKING:
1. Verify SOCKS proxy: curl --socks5 127.0.0.1:9050 ifconfig.me 2. Check config: cat /etc/proxychains4.conf 3. Add dynamic chain: add "dynamic_chain" to config 4. Test: proxychains4 curl ifconfig.me
GUI NOT STARTING:
1. Start X manually: startx 2. Check logs: cat /var/log/Xorg.0.log 3. Check display: echo $DISPLAY 4. Force start: xinit /usr/bin/fvwm95 5. If fails: use terminal only (Alt+F1-F6)
SYSTEM WON'T BOOT:
1. Boot with 'nomodeset' GRUB parameter 2. Boot to recovery mode 3. Check disk: fsck /dev/sda1 4. Reset GRUB: update-grub 5. Reinstall bootloader: grub-install /dev/sda
KEYBOARD LAYOUT WRONG:
1. setxkbmap us (or your layout) 2. dpkg-reconfigure keyboard-configuration 3. Edit /etc/default/keyboard
PERFORMANCE ISSUES:
1. Check memory: free -h 2. Check CPU: top 3. Kill heavy processes: pkill [process] 4. Use lightweight apps: avoid GUI tools 5. Disable unneeded services: systemctl disable [service]
LOG FILES:
/var/log/syslog - System events /var/log/tor/notices.log - Tor messages /var/log/i2p/error.log - I2P errors /var/log/auth.log - Authentication attempts /var/log/kern.log - Kernel messages $HOME/.xsession-errors - X session errors
Tinfoil Hat GNU/LINUX v0.1 Beta Hardened Privacy Operating System Documentation Version 0.1 Beta