EmploLeaks

EmploLeaks is an OSINT (Open Source Intelligence) tool with a CLI interface, designed to discover and correlate information about employees of a target company. It allows collecting LinkedIn profiles, generating potential corporate emails, searching for leaked credentials in leak databases (ClickHouse internally), verifying known breaches through HaveIBeenPwned, discovering company infrastructure, and profiling employees on social networks. All information is stored locally in SQLite for later analysis.

Features

• Employee search and enumeration from LinkedIn (scraping with session cookies)
• Automatic generation of potential corporate emails with customizable formats
• Search for leaked credentials in own ClickHouse database
• Verification of known breaches with the HaveIBeenPwned API
• Secret scanning in GitHub/GitLab repositories with gitleaks
• Infrastructure discovery: Subdomain enumeration with assetfinder + SecurityTrails
• Social media profiling: Email search (Holehe, ~120 platforms) and username search (Maigret, 500+ platforms)
• Telegram scraper (userbot): Standalone daemon that joins approved Telegram channels and automatically downloads credential files
• 100% agentic leak parser: No hardcoded regex. An AI agent proposes a schema, validates with a score on the sample, receives feedback with error examples, and retries until convergence. Auto-detects UTF-16/UTF-8, ASCII art banners, country code prefixes, stealer logs (Redline/Lumma/Raccoon), arbitrary email/user/url formats
• Local storage of all information in SQLite
• Generation of interactive HTML reports with profile pictures
• Automatic classification of employees by department using AI (OpenAI, Ollama, etc.)
• Export of results to CSV
• Modular plugin system (LinkedIn, GitHub, HIBP)
• Auto-save and automatic loading of plugin configuration
• Administrative webapp with FastAPI + Next.js for result triage

Project Structure```

emploleaks/ ├── emploleaks.py # Script principal (CLI interactiva con cmd2) ├── telegram_sync.py # Daemon userbot de Telegram (Telethon, standalone) ├── requirements.txt # Dependencias de Python ├── README.md ├── .gitignore ├── plugins/ │ ├── linkedin.py # Plugin de LinkedIn (scraping de empleados) │ ├── github.py # Plugin de GitHub (repos, stalk, secrets) │ └── hibp.py # Plugin de HaveIBeenPwned (brechas) ├── utils/ │ ├── logging_format.py # Configuración de logging con colores │ ├── ai_classifier.py # Clasificación de roles con IA (OpenAI/Ollama) │ ├── leak_parser.py # Parser de leaks 100% agéntico (loop de IA, sin regex) │ ├── email_lookup.py # Búsqueda de emails en redes sociales (Holehe) │ ├── profile_lookup.py # Búsqueda de usernames en redes sociales (Maigret) │ └── discovery.py # Enumeración de subdominios (assetfinder + SecurityTrails opcional) ├── clickhouse-docker/ # Docker Compose para levantar ClickHouse │ ├── docker-compose.yml │ └── config/ │ └── users.xml ├── leaks_data/ # Carpeta para archivos de leaks a importar (no en git) ├── config/ # Configuración (autogenerado) │ └── tokens.ini # Tokens y credenciales de plugins (no en git) ├── data/ # Base de datos local (autogenerado) │ └── emploleaks.db # SQLite con toda la información recopilada ├── webapp/ # Webapp administrativa │ ├── backend/ # FastAPI (Python) │ └── frontend/ # Next.js (React/TypeScript) └── logs/ # Archivos de log (autogenerado) └── log.txt

## Requirements

- Python 3.10+
- pip
- Internet connection
- **Optional:** Docker and Docker Compose (to run ClickHouse locally)
- **Optional:** [gitleaks](https://github.com/gitleaks/gitleaks) (for scanning secrets in repos)
- **Optional:** [HaveIBeenPwned](https://haveibeenpwned.com/API/Key) API key
- LinkedIn session cookies (`JSESSIONID` and `li_at`) for the LinkedIn plugin

## Installation

1. Clone the repository:```bash
git clone https://github.com/yourusername/emploleaks.git
cd emploleaks

2. Install dependencies:```bash pip install -r requirements.txt

3. (Optional) Launch ClickHouse with Docker for the leak database:```bash
cd clickhouse-docker
docker compose up -d
cd ..

Usage

Run the tool:```bash python emploleaks.py

With debug mode:```bash
python emploleaks.py -d

General Commands

Companies Management

Plugins Management

Leaks Database Connection (ClickHouse)

The ClickHouse connection is configured in config/tokens.ini:```ini [clickhouse] host = localhost port = 9000 user = default passwd = dbname = credentials_db

If ClickHouse is configured in `tokens.ini`, the connection is established automatically on startup.

### Credential and Breach Search

| Command | Description |
|---------|-------------|
| `find_passwords <mode>` | Searches for credentials in ClickHouse + [ProxyNova COMB](https://www.proxynova.com/tools/comb/) (3.2B credentials). Modes: `find_all`, `only_usernames`, `only_emails` |
| `find_passwords <mode> --no-proxynova` | Searches only in local ClickHouse |
| `find_passwords <mode> --no-clickhouse` | Searches only in ProxyNova COMB (requires no ClickHouse) |
| `find_passwords <mode> --email <email>` | Searches for credentials for a specific email |
| `find_breaches` | Searches for breaches in HIBP for all company emails (requires plugin `hibp` active) |

**ProxyNova COMB** is a public database with 3.2 billion leaked credentials (Combination Of Many Breaches). It requires no API key and is queried automatically on each search. Use `--no-proxynova` to disable it.

### Infrastructure Discovery

| Command | Description |
|---------|-------------|
| `add_domain <domain>` | Associates a domain with the selected company (e.g., `add_domain faradaysec.com`) |
| `discover` | Runs subdomain enumeration against all company domains using `assetfinder` (+ optional SecurityTrails), resolving DNS |
| `print --data domains` | Shows registered domains and the number of subdomains found |
| `print --data subdomains` | Shows all subdomains with their IP, source, and discovery date |

The Discovery module delegates passive enumeration to [`assetfinder`](https://github.com/tomnomnom/assetfinder), which internally aggregates results from crt.sh, HackerTarget, BufferOver, and other sources without an API key. The binary is expected to be in `$PATH` (installation: `go install github.com/tomnomnom/assetfinder@latest`).

Optionally, if you configure a SecurityTrails API key, their subdomains are merged with those from assetfinder:```ini
[discovery]
# securitytrails_key = your_key_here

Social Media Profiling

Holehe (email lookup): uses the "forgot password" technique to determine if an email is registered on each platform, without alerting the owner. The platforms are configured in tokens.ini:```ini [holehe] platforms = google, discord, github, instagram, twitter, spotify, ...

**Maigret** (username lookup): searches if a username exists on 500+ social media platforms. Usernames are added manually by employees from the webapp. Platforms are optionally filtered in `tokens.ini`:```ini
[maigret]
# platforms = instagram, twitter, facebook, tiktok, reddit, github

Visualization and Export

AI Configuration and Classification

AI classification analyzes employees' titles/roles and groups them by department (Engineering, Security, Sales, etc.). Departments are persisted in SQLite and are visible in the HTML report and in the webapp.

Supported providers (any OpenAI-compatible API):

• Ollama (local, by default): set_ai --endpoint http://localhost:11434/v1 --model llama3
• OpenAI: set_ai --endpoint https://api.openai.com/v1 --key sk-... --model gpt-4o-mini
• Any other compatible: LM Studio, Together AI, etc.

Telegram Scraper (Userbot)

Standalone daemon that uses a personal Telegram account (via Telethon) to join approved channels/groups, download .txt/.csv/.dat/.zip/.gz files and leave them in leaks_data/telegram/<chat>/. The subsequent import_leaks ingests them into ClickHouse using the agentic parser. Decoupled from the CLI — runs as a separate process, so it can be 24/7 without the CLI being open.

Initial setup (one-time):

1. Create app at https://my.telegram.org/apps to get api_id and api_hash.
2. Add to config/tokens.ini: ```ini [telegram] api_id = 12345678 api_hash = abcd1234... session = config/telegram.session download_root = leaks_data/telegram allowed_extensions = txt, csv, dat, zip, gz default_backfill_limit = 10
   root@kitploit:~

3. Interactive login (asks for your number, app code, optionally 2FA): ```bash python3.13 telegram_sync.py login
   root@kitploit:~

Subcommands:

New tables in data/emploleaks.db:

Daemon in background:```bash nohup python3.13 telegram_sync.py run --watch >> logs/telegram.log 2>&1 & echo $! > /tmp/telegram_daemon.pid

Para parar:

kill $(cat /tmp/telegram_daemon.pid)

### 100% Agentic Leak Parser

The `utils/leak_parser.py` module uses **only an AI agent** to parse each file. There are no hardcoded regexes (they were removed because each new format introduced subtle extraction bugs).

**Agent pipeline:**```
1. Auto-detectar encoding (BOM sniffing): utf-8 / utf-8-sig / utf-16 / utf-32.
2. Sampling inteligente: tomar las primeras 80 líneas que parezcan credenciales
   (con separadores típicos, alfanumérico >50%) — skipea banners ASCII art.
3. La IA recibe 50 líneas + system prompt con familias comunes de formato y
   propone {separator, fields, skip_lines}.
4. Aplicamos el schema a la muestra SIN filtros → list of tuples.
5. Validamos con _is_clean_credential → score = % rows válidas.
6. Si score ≥ 0.8 y ≥ 5 rows → aplicar al archivo completo.
7. Si no → mandar al agente la (source_line ↔ extracción mala) en pares,
   más checklist de errores típicos. Goto 3.
8. Hasta 7 iteraciones. Si no converge a 0.8: fallback al mejor schema si
   alcanzó ≥ 0.7. Bajo eso → skip con warning (nunca ingerimos basura).

_is_clean_credential — cross-validation:

• Username: length 1-64, no / : \ space, does not start with http/android/ftp//.
• Password: length 1-256, no /, maximum one :, no whitespace, does not start with URL prefix.

Determinism: temperature=0 in all calls + in-memory caching within the same run. The same file produces the same schema between runs → import_leaks is idempotent.

Typical cost: 1-3 API calls per file, ~$0.0001-$0.0005 with gpt-4o-mini. For 12 files: ~$0.005 = half a cent.

Administrative Webapp

The webapp allows:

• Dashboard with statistics, key findings, and quick actions
• Employee management with collapsible sections by department and drag & drop
• Connected Accounts: view social media profiles, search by email (Holehe) and by username (Maigret)
• Discovery: manage domains, run subdomain enumeration, view results with IP and source
• Triage of credentials and secrets (mark as verified, not working, false positive)
• Editing emails and usernames per employee (add, modify, delete)
• AI classification from the interface

Plugins

LinkedIn

Allows searching for employees of a company on LinkedIn using browser session cookies, and generating potential corporate emails. Automatically captures the company logo.

Options:

Available commands within the plugin:

Available email formats:

• Default: f_last (e.g., [email protected]) and f.last (e.g., [email protected])
• Custom with --email-format: use placeholders {n} (first name initial), {s} (last name), {name} (full name), {l} (last name initial)
  • Example: --email-format {n}.{s} generates [email protected]

Complete example:``` emploleaks> add_company --name miempresa emploleaks> select_company --name miempresa emploleaks(miempresa)> use --plugin linkedin emploleaks(miempresa)(linkedin)> setopt JSESSIONID JSESSIONID: emploleaks(miempresa)(linkedin)> setopt li-at li-at: emploleaks(miempresa)(linkedin)> run impersonate emploleaks(miempresa)(linkedin)> run find miempresa miempresa.com --email-format {n}.{s}

### GitHub

Allows obtaining information from GitHub profiles, listing repositories, and scanning secrets in repositories with gitleaks.

**Options:**

| Option | Description |
|--------|-------------|
| `token` | Personal GitHub access token |
| `blur` | Obfuscate the token when displaying it |
| `gitleaks_path` | Path to gitleaks binary (default: `gitleaks` in PATH) |
| `max_repo_size` | Maximum repository size to analyze in MB (default: `15`) |

**Available commands within the plugin:**

| Command | Description |
|---------|-------------|
| `run stalk <username>` | Get email from a GitHub account |
| `run get_repos <username>` | List public repositories of a user |
| `run find_secrets` | Scan secrets in company employee repositories |
| `run find_secrets --download-all` | Same but without size limit |

**Complete example:**```
emploleaks(miempresa)> use --plugin github
emploleaks(miempresa)(github)> setopt token ghp_xxxxxxxxxxxx
emploleaks(miempresa)(github)> run find_secrets
emploleaks(miempresa)(github)> print --data secrets

HaveIBeenPwned (HIBP)

Checks if the company's emails appear in known breaches using the HIBP API.

Options:

Available commands within the plugin:

Complete example:``` emploleaks(miempresa)> use --plugin hibp emploleaks(miempresa)(hibp)> setopt apikey <tu_api_key> emploleaks(miempresa)(hibp)> find_breaches emploleaks(miempresa)(hibp)> print --data breaches

## Leaks Database (ClickHouse)

EmploLeaks can connect to its own ClickHouse database with filtered credentials to search for passwords associated with the emails/usernames of discovered employees.

### Starting ClickHouse with Docker```bash
cd clickhouse-docker
docker compose up -d

This exposes ClickHouse on:

• Port 9000 (native TCP protocol)
• Port 8123 (HTTP interface)

The leaks_data/ folder is mounted as a read-only volume inside the container.

Import credentials

1. Place your leak files (.txt, .csv, .dat, .zip, .gz) in the leaks_data/ folder.
2. Run the import command:``` emploleaks> import_leaks

The parser automatically detects the most common formats:
- `email:password`
- `email:password:url`
- `email;password`
- `email|password`
- `url,email,password`

For unknown formats, it uses the configured AI (OpenAI/Ollama) to analyze a sample of the file and determine how to parse it. Use `--no-ai` to skip AI detection.

`.zip` and `.gz` files are decompressed automatically before parsing.

### Search credentials```
emploleaks(miempresa)> find_passwords only_emails
emploleaks(miempresa)> find_passwords find_all
emploleaks(miempresa)> print --data passwords

If ClickHouse is configured in tokens.ini, the connection is automatic when the tool starts.

Structure of the credentials table in ClickHouse

Local Database Structure (SQLite)

Typical Workflow```

1. python emploleaks.py

Gestión de empresa

2. add_company --name target_corp
3. select_company --name target_corp

Scraping de LinkedIn (captura empleados + logo de empresa)

4. use --plugin linkedin
5. setopt JSESSIONID
6. setopt li-at
7. run impersonate
8. run find target_corp targetcorp.com --email-format {n}.{s}
9. print --data emails

Discovery de infraestructura

10. add_domain targetcorp.com
11. discover
12. print --data subdomains

Credenciales filtradas (ClickHouse se conecta automáticamente desde config)

13. find_passwords only_emails

Brechas conocidas

14. use --plugin hibp
15. setopt apikey <hibp_key>
16. find_breaches

Secretos en repositorios

17. use --plugin github
18. setopt token <github_token>
19. run find_secrets

Profiling en redes sociales (por email)

20. deactivate
21. lookup_emails

Profiling en redes sociales (por username, requiere cargar usernames en webapp)

22. lookup_profiles

Clasificación por departamento

23. classify

Reportes y exportación

24. print --data all --export
25. print --data all --html --ai

Webapp para triage interactivo

26. python emploleaks.py --webapp

Telegram scraper (proceso aparte, en otra terminal)

27. python3.13 telegram_sync.py login # one-time
28. python3.13 telegram_sync.py list_groups
29. python3.13 telegram_sync.py approve <chat_id> --limit 5
30. python3.13 telegram_sync.py run --watch # daemon en watch

Archivos van a leaks_data/telegram/... → re-ejecutar import_leaks los absorbe.

## Disclaimer

This tool is designed solely for educational purposes, security research, and authorized penetration testing. The use of this tool for malicious or unauthorized activities is strictly prohibited. Users are responsible for complying with all applicable laws and project terms of service.