EXTENSIONS
Built by operatives — models, drivers, vaults, and reports, the parts that plug into Swamp.
Filter by what you need and pull what fits.
Claimbook
Breach-claim ledger and verification state machine on DuckDB. Files claims with asserted levels (L0 rumor → L5 published), attaches sha256-attributed evidence, reconciles asserted dump profiles against observed inventories, records public statements, tracks onion watch-state diffs, and emits verification reports. Persistence layer of the breach-verification bench.
Onion
Tor onion-service observability model: bootstrap a persistent Tor daemon, probe onion endpoints, capture sha256-attributed evidence snapshots, crawl dump-inventory listings (filebrowser HTML or enumeration JSON) with PII-bearing filename masking. Network layer of the breach-verification bench.
Shodan
Query the Shodan internet-wide scan database to find and profile internet-exposed devices. Single API key resolved from vault. Read the account plan and remaining credits, run searches that return trimmed device records (IP, org, product, location, open port, CVEs) with facet rollups, count results without spending query credits, pull the full banner history for one IP, do keyless InternetDB lookups (ports, CPEs, tags, CVEs), and request on-demand scans of IPs you own. Built for AV/IoT exposure recon.