/ty-darkweb

description: Search dark web .onion sites for leak databases (requires dark/ghost profile)
allowed-tools: Bash, Read, Glob, Grep
argument-hint: <query>

You are executing a dark web leak search for the tyrell data exfiltration plugin.

Step 1 — Profile Gate Check

The dark web hunting module requires a `dark` or `ghost` operational profile. Verify before proceeding:

node "${CLAUDE_PLUGIN_ROOT}/scripts/hunt-engine.js" darkweb --check-profile $ARGUMENTS

If the active profile is anything other than `dark` or `ghost`, stop immediately:

> Dark web access requires a **dark** or **ghost** operational profile. This protects operator identity. Switch profiles and ensure Tor routing is active before continuing.

Step 2 — Verify Tor Routing

Confirm that traffic will be routed through Tor before making any .onion requests:

# Verify Tor is running and accessible
curl --socks5 127.0.0.1:9050 --socks5-hostname 127.0.0.1:9050 \
  -s https://check.torproject.org/api/ip | jq '.IsTor'

If this returns `false`, start the Tor service:

sudo service tor start
# Wait for circuit establishment
sleep 10

Alternatively, verify proxychains configuration is pointing to Tor's SOCKS5 proxy at `127.0.0.1:9050`.

Step 3 — Generate Dark Web Search Queries

Run the hunt engine for .onion-specific search targets:

node "${CLAUDE_PLUGIN_ROOT}/scripts/hunt-engine.js" darkweb $ARGUMENTS

The script returns: `onion_urls` (known leak index sites), `search_queries`, and `keywords` tailored for dark web leak markets.

Step 4 — Execute Searches via Tor

For each dark web search engine or index in the returned list, execute via torsocks or proxychains:

# Via torsocks
torsocks curl -s "http://<onion-search-engine>.onion/search?q=<query>" \
  -H "User-Agent: Mozilla/5.0" | grep -oP 'http://[a-z2-7]{16,56}\.onion[^\s"<>]*'

# Via proxychains
proxychains curl -s "http://<onion-url>.onion/search?q=<query>"

Common dark web leak indexes to query (use addresses from hunt-engine output):

• Ahmia (clearnet-accessible Tor search)
• Torch, Haystak (Tor-native search engines)
• Known leak market .onion addresses from the hunt engine

Step 5 — Enumerate Found .Onion Pages

For each .onion result that appears to be a leak listing or database market:

torsocks curl -s "http://<result>.onion/<path>" | \
  grep -iE "(database|dump|records|leak|breach|million|credentials|combo)"

Extract: site name, listing title, target organization, record count, price, and any contact methods (Jabber, SimpleX, Telegram).

Step 6 — Log Findings

node "${CLAUDE_PLUGIN_ROOT}/scripts/source-tracker.js" add \
  --type darkweb \
  --url "http://<onion-address>.onion/<path>" \
  --target "<organization-or-domain>" \
  --records "<count-if-known>" \
  --price "<price-or-free>" \
  --notes "<additional-context>"

Step 7 — Present Results

Output a dark web intelligence summary:

Leak Markets / Shops

| Source ID | .Onion Site | Target | Records | Price | Contact | |-----------|-------------|--------|---------|-------|---------| | ... | ... | ... | ... | ... | ... |

Indexed Leak Archives

• List any freely accessible leak archives or paste sites found

Operator note: Do not access any .onion URL directly from the host browser. All access must route through Tor. Use `/ty-classify` to assign credibility scores before proceeding to acquisition.