WhatBreach

WhatBreach는 이메일 주소가 어떤 유출 사고에 발견되었는지 찾는 작업을 간소화하는 OSINT 도구입니다. WhatBreach는 여러 개 또는 단일 이메일 주소를 검색하고 해당 이메일이 발견된 모든 알려진 유출 사고를 찾는 간단하고 효과적인 방법을 제공합니다. 그런 다음 WhatBreach는 데이터베이스가 공개적으로 제공되는 경우 데이터베이스를 다운로드하거나, 이메일이 발견된 페이스트를 다운로드하거나, 추가 조사를 위해 이메일 도메인을 검색할 수 있습니다. 이 작업을 성공적으로 수행하기 위해 WhatBreach는 다음 웹사이트 및/또는 API를 활용합니다:

WhatBreach는 haveibeenpwned.com의 API를 활용합니다. HIBP의 API는 더 이상 무료가 아니며 월 3.50 USD입니다. API 키를 얻으려면 여기를 참조하세요.
WhatBreach는 데이터베이스가 이전에 유출 사고에서 발견되었는지 확인하기 위해 dehashed.com을 활용합니다. WhatBreach는 효과적인 다운로드를 위해 dehashed 검색 링크를 제공합니다.
WhatBreach는 hunter.io의 API를 활용합니다 (무료 API 토큰 필요). 이를 통해 간단하고 효과적인 도메인 검색이 가능하며, 검색 중인 도메인에 대한 추가 정보를 제공하고 발견된 결과를 파일에 저장하여 나중에 처리할 수 있습니다.
WhatBreach는 HIBP에서 발견된 pastebin.com의 페이스트를 활용합니다. 유출 사고가 발견된 페이스트에 대한 링크도 제공하며, 요청 시 원시 페이스트를 다운로드할 수 있습니다.
WhatBreach는 databases.today를 활용하여 웹사이트에서 데이터베이스를 다운로드합니다. 수동으로 검색할 필요 없이 간단하고 효과적으로 데이터베이스를 다운로드할 수 있습니다.
WhatBreach는 weleakinfo.com의 API를 활용합니다 (무료 API 토큰 필요). 이는 더 많은 공개 유출 사고를 발견하기 위해 이메일에 대한 추가 검색을 제공합니다.
WhatBreach는 emailrep.io의 간단한 오픈 API를 활용하여 이메일과 관련된 가능한 프로필을 검색하며, 발견된 모든 정보를 파일에 덤프하여 추가 처리를 할 수 있습니다.

WhatBreach의 흥미로운 기능 중 일부는 다음과 같습니다:

이메일이 10분 이메일인지 감지하고 처리 여부를 묻는 기능
hunter.io를 사용하여 이메일의 전달 가능 상태 확인
HIBP가 차단하는 것을 방지하기 위해 요청을 조절하는 기능
(대용량) 데이터베이스를 원하는 디렉토리에 다운로드
단일 이메일 또는 한 줄에 하나의 이메일이 포함된 텍스트 파일 검색

예제

도움말 페이지:

usage: whatbreach.py [-h] [-e EMAIL] [-l PATH] [-nD] [-nP] [-sH] [-wL] [-dP]
                     [-vH] [-cT] [-d] [-s DIRECTORY-PATH] [--throttle TIME]

optional arguments:
  -h, --help            show this help message and exit

mandatory opts:
  -e EMAIL, --email EMAIL
                        Pass a single email to scan for
  -l PATH, -f PATH, --list PATH, --file PATH
                        Pass a file containing emails one per line to scan

search opts:
  -nD, --no-dehashed    Suppres dehashed output
  -nP, --no-pastebin    Suppress Pastebin output
  -sH, --search-hunter  Search hunter.io with a provided email address and
                        query for all information, this will process all
                        emails found as normal
  -wL, --search-weleakinfo
                        Search weleakinfo.com as well as HIBP for results

misc opts:
  -dP, --download-pastes
                        Download pastes associated with the email address
                        found (if any)
  -vH, --verify-hunter  Verify the emails found on hunter.io for deliverable
                        status
  -cT, --check-ten-minute
                        Check if the provided email address is a ten minute
                        email or not
  -d, --download        Attempt to download the database if there is one
                        available
  -s DIRECTORY-PATH, --save-dir DIRECTORY-PATH
                        Pass a directory to save the downloaded databases into
                        instead of the `HOME` path
  --throttle TIME       Throttle the HIBP requests to help prevent yourself
                        from being blocked

간단한 이메일 검색:

python whatbreach.py -e [email protected]

	                                                    _____ 
	   _ _ _ _       _   _____                 _       |___  |
	  | | | | |_ ___| |_| __  |___ ___ ___ ___| |_       |  _|
	  | | | |   | .'|  _| __ -|  _| -_| .'|  _|   |      |_|  
	  |_____|_|_|__,|_| |_____|_| |___|__,|___|_|_|[][][]|_|
	Find emails and their associated leaked databases.. v0.1.5


[ i ] starting search on single email address: [email protected]
[ i ] searching breached accounts on HIBP related to: [email protected]
[ i ] searching for paste dumps on HIBP related to: [email protected]
[ i ] found a total of 9 database breach(es) pertaining to: [email protected]
---------------------------------------------------------------------------
Breach/Paste:	     | Database/Paste Link:
Dailymotion          | https://www.dehashed.com/search?query=Dailymotion
500px                | https://www.dehashed.com/search?query=500px
LinkedIn             | https://www.dehashed.com/search?query=LinkedIn
MyFitnessPal         | https://www.dehashed.com/search?query=MyFitnessPal
Bolt                 | https://www.dehashed.com/search?query=Bolt
Dropbox              | https://www.dehashed.com/search?query=Dropbox
Lastfm               | https://www.dehashed.com/search?query=Lastfm
Apollo               | https://www.dehashed.com/search?query=Apollo
OnlinerSpambot       | N/A                           
---------------------------------------------------------------------------

weleakinfo 및 haveibeenpwned로 검색:

python whatbreach.py -e [email protected] -wL

	                                                    _____ 
	   _ _ _ _       _   _____                 _       |___  |
	  | | | | |_ ___| |_| __  |___ ___ ___ ___| |_       |  _|
	  | | | |   | .'|  _| __ -|  _| -_| .'|  _|   |      |_|  
	  |_____|_|_|__,|_| |_____|_| |___|__,|___|_|_|[][][]|_|
	Find emails and their associated leaked databases.. v0.1.5


[ i ] starting search on single email address: [email protected]
[ i ] searching breached accounts on HIBP related to: [email protected]
[ i ] searching for paste dumps on HIBP related to: [email protected]
[ i ] searching weleakinfo.com for breaches related to: [email protected]
[ i ] discovered a total of 12 more breaches from weleakinfo.com
[ i ] found a total of 21 database breach(es) pertaining to: [email protected]
[ w ] large amount of database breaches, obtaining links from dehashed (this may take a minute)
-------------------------------------------------------------------------------
Breach/Paste:	     | Database/Paste Link:
Pesfan.com           | https://www.dehashed.com/search?query=Pesfan.com
Dailymotion          | https://www.dehashed.com/search?query=Dailymotion
Apollo               | https://www.dehashed.com/search?query=Apollo
MyFitnessPal         | https://www.dehashed.com/search?query=MyFitnessPal
500px                | https://www.dehashed.com/search?query=500px
Collection 4         | https://www.dehashed.com/search?query=Collection 4
OnlinerSpambot       | N/A                           
LinkedIn             | https://www.dehashed.com/search?query=LinkedIn
Dropbox.com          | https://www.dehashed.com/search?query=Dropbox.com
500px.com            | https://www.dehashed.com/search?query=500px.com
Dailymotion.com      | https://www.dehashed.com/search?query=Dailymotion.com
Last.fm March 2012   | https://www.dehashed.com/search?query=Last.fm March 2012
Dropbox              | https://www.dehashed.com/search?query=Dropbox
Myfitnesspal.com     | https://www.dehashed.com/search?query=Myfitnesspal.com
Collection 1         | https://www.dehashed.com/search?query=Collection 1
Collection 2         | https://www.dehashed.com/search?query=Collection 2
Bolt.cd              | https://www.dehashed.com/search?query=Bolt.cd
Lastfm               | https://www.dehashed.com/search?query=Lastfm
Bolt                 | https://www.dehashed.com/search?query=Bolt
Collection 3         | https://www.dehashed.com/search?query=Collection 3
LinkedIn.com         | https://www.dehashed.com/search?query=LinkedIn.com
-------------------------------------------------------------------------------

공개 데이터베이스 다운로드:

python whatbreach.py -e [email protected] -d

	                                                    _____ 
	   _ _ _ _       _   _____                 _       |___  |
	  | | | | |_ ___| |_| __  |___ ___ ___ ___| |_       |  _|
	  | | | |   | .'|  _| __ -|  _| -_| .'|  _|   |      |_|  
	  |_____|_|_|__,|_| |_____|_| |___|__,|___|_|_|[][][]|_|
	Find emails and their associated leaked databases.. v0.1.5


[ i ] starting search on single email address: [email protected]
[ i ] searching breached accounts on HIBP related to: [email protected]
[ i ] searching for paste dumps on HIBP related to: [email protected]
[ i ] found a total of 9 database breach(es) pertaining to: [email protected]
---------------------------------------------------------------------------
Breach/Paste:	     | Database/Paste Link:
Dailymotion          | https://www.dehashed.com/search?query=Dailymotion
500px                | https://www.dehashed.com/search?query=500px
LinkedIn             | https://www.dehashed.com/search?query=LinkedIn
MyFitnessPal         | https://www.dehashed.com/search?query=MyFitnessPal
Bolt                 | https://www.dehashed.com/search?query=Bolt
Dropbox              | https://www.dehashed.com/search?query=Dropbox
Lastfm               | https://www.dehashed.com/search?query=Lastfm
Apollo               | https://www.dehashed.com/search?query=Apollo
OnlinerSpambot       | N/A                           
---------------------------------------------------------------------------
[ i ] searching for downloadable databases using query: dailymotion
[ w ] no databases appeared to be present and downloadable related to query: Dailymotion
[ i ] searching for downloadable databases using query: 500px
[ w ] no databases appeared to be present and downloadable related to query: 500px
[ i ] searching for downloadable databases using query: linkedin
[ ? ] discovered publicly available database for query LinkedIn, do you want to download [y/N]: n
[ i ] skipping download as requested
[ w ] no databases appeared to be present and downloadable related to query: LinkedIn
[ i ] searching for downloadable databases using query: myfitnesspal
[ w ] no databases appeared to be present and downloadable related to query: MyFitnessPal
[ i ] searching for downloadable databases using query: bolt
[ w ] no databases appeared to be present and downloadable related to query: Bolt
[ i ] searching for downloadable databases using query: dropbox
[ ? ] discovered publicly available database for query Dropbox, do you want to download [y/N]: n
[ i ] skipping download as requested
[ w ] no databases appeared to be present and downloadable related to query: Dropbox
[ i ] searching for downloadable databases using query: lastfm
[ ? ] discovered publicly available database for query Lastfm, do you want to download [y/N]: n
[ i ] skipping download as requested
[ w ] no databases appeared to be present and downloadable related to query: Lastfm
[ i ] searching for downloadable databases using query: apollo
[ w ] no databases appeared to be present and downloadable related to query: Apollo
[ i ] searching for downloadable databases using query: onlinerspambot
[ w ] no databases appeared to be present and downloadable related to query: OnlinerSpambot

도메인 헌팅 및 HIBP 차단 방지를 위한 요청 조절에 hunter.io 사용:

python whatbreach.py -e [email protected] -sH --throttle 35

	                                                    _____ 
	   _ _ _ _       _   _____                 _       |___  |
	  | | | | |_ ___| |_| __  |___ ___ ___ ___| |_       |  _|
	  | | | |   | .'|  _| __ -|  _| -_| .'|  _|   |      |_|  
	  |_____|_|_|__,|_| |_____|_| |___|__,|___|_|_|[][][]|_|
	Find emails and their associated leaked databases.. v0.1.5


[ i ] starting search on hunter.io using [email protected]
[ i ] discovered a total of 11 email(s)
[ i ] information discovered associated with fbi.com
[ i ] discovered possible pattern to emails: {first}.{last}@fbi.com
[ w ] did not discover any associated phone number(s)
[ i ] discovered associated email address(es):
	-> [email protected]
	-> [email protected]
	-> [email protected]
	-> [email protected]
	-> [email protected]
	-> [email protected]
	-> [email protected]
	-> [email protected]
	-> [email protected]
[ w ] hit maximum length, total of 1 not displayed
[ i ] discovered associated external URL(s):
	-> http://jobsnotification.blogspot.com/2011/03/ifbi-pgdbo-admission-2011-pg-diploma-in.html
	-> http://complaintsboard.com/complaints/fbi-robert-s-muelleriii-huber-heights-ohio-c121118.html
	-> http://user.xmission.com/~daina/known_scammers.html
	-> http://anonymousxwrites.blogspot.com/2012/02
	-> http://boingboing.net/2012/02/14
	-> http://joewein.net/dbl-update/2014-06/2014-06-22.htm
	-> http://anonymousxwrites.blogspot.fr/2012/02/federal-bureau-of-investigation-fbi-yet.html
	-> http://anonymousxwrites.blogspot.sg/2012/02
	-> http://meg-golpistasvirtuais.blogspot.fr/2013/04/update-emails-addresses-scammers-dia.html
[ w ] hit maximum length, total of 35 not displayed
[ i ] dumping all information into json file for further processing
[ i ] information written to: /Users/admin/.whatbreach_home/downloads/json_dumps/cbNcFiXZsU_fbi.com.json
[ i ] searching breached accounts on HIBP related to: [email protected]
[ i ] searching for paste dumps on HIBP related to: [email protected]
[ ! ] email [email protected] was not found in any breach
[ i ] searching breached accounts on HIBP related to: [email protected]
[ i ] searching for paste dumps on HIBP related to: [email protected]
[ ! ] email [email protected] was not found in any breach
[ i ] searching breached accounts on HIBP related to: [email protected]
[ i ] searching for paste dumps on HIBP related to: [email protected]
...

10분 이메일 확인:

python whatbreach.py -l test.txt -cT 

	                                                    _____ 
	   _ _ _ _       _   _____                 _       |___  |
	  | | | | |_ ___| |_| __  |___ ___ ___ ___| |_       |  _|
	  | | | |   | .'|  _| __ -|  _| -_| .'|  _|   |      |_|  
	  |_____|_|_|__,|_| |_____|_| |___|__,|___|_|_|[][][]|_|
	Find emails and their associated leaked databases.. v0.1.5


[ i ] parsing email file: test.txt
[ i ] starting search on a total of 2 email(s)
[ i ] searching breached accounts on HIBP related to: [email protected]
[ i ] searching for paste dumps on HIBP related to: [email protected]
[ i ] found a total of 9 database breach(es) pertaining to: [email protected]
---------------------------------------------------------------------------
Breach/Paste:	     | Database/Paste Link:
Dailymotion          | https://www.dehashed.com/search?query=Dailymotion
500px                | https://www.dehashed.com/search?query=500px
LinkedIn             | https://www.dehashed.com/search?query=LinkedIn
MyFitnessPal         | https://www.dehashed.com/search?query=MyFitnessPal
Bolt                 | https://www.dehashed.com/search?query=Bolt
Dropbox              | https://www.dehashed.com/search?query=Dropbox
Lastfm               | https://www.dehashed.com/search?query=Lastfm
Apollo               | https://www.dehashed.com/search?query=Apollo
OnlinerSpambot       | N/A                           
---------------------------------------------------------------------------
[ w ] email: [email protected] appears to be a ten minute email
[ ? ] would you like to process the email[y/N]: n

이메일과 관련된 프로필 검색:

python whatbreach.py -e [email protected] -cA

                                                            _____ 
           _ _ _ _       _   _____                 _       |___  |
          | | | | |_ ___| |_| __  |___ ___ ___ ___| |_       |  _|
          | | | |   | .'|  _| __ -|  _| -_| .'|  _|   |      |_|  
          |_____|_|_|__,|_| |_____|_| |___|__,|___|_|_|[][][]|_|
        Find emails and their associated leaked databases.. v0.1.8


[ i ] starting search on single email address: [email protected]
[ i ] searching for possible profiles related to [email protected]
[ i ] all data dumped to file for future processing: /Users/admin/.whatbreach_home/downloads/json_dumps/user_emailrep.json
[ i ] found a total of 5 possible profiles associated with [email protected] on the following domains:
        -> Twitter
        -> Instagram
        -> Pastebin
        -> Pinterest
        -> Spotify
...

설치

설치는 매우 쉽습니다. pip install -r requirements.txt를 실행하기만 하면 됩니다.

왜?

정보 기술 분야에서 OSINT 연구를 수행하는 동안 이메일 주소와 비밀번호를 찾을 필요성을 느꼈습니다. 이 작업을 성공적으로 수행하고 프로세스를 빠르고 쉽게 만드는 신뢰할 수 있는 도구를 찾았지만, 정확한 요구 사항을 충족하는 도구는 찾지 못했습니다. 이 도구는 기본적으로 이메일 검색이 작동해야 한다고 생각하는 방식에 대한 개인적인 해석이며, 데이터베이스 검색 및 데이터베이스 다운로드도 함께 결합합니다. 가능한 비밀번호와 이메일이 발견된 모든 알려진 유출 사고를 확보하는 것보다 더 좋은 방법이 있을까요?

감사 인사

NullArray: 해시 검사 및 databases.today 다운로드에 대한 아이디어를 제공해 주셨고, 항상 멋지고 지지해 주셨습니다.
khast3x (또는 h8mail의 창시자로 알려져 있습니다): 지지하고 전반적으로 즐거운 사람이 되어 주셨습니다. 이 도구로 다운로드한 데이터베이스에서 데이터를 찾는 가장 좋은 방법은 h8mail을 사용하는 것입니다. 빠르고 효율적이며 쉽습니다. 확인해 보세요.

WhatBreach

인기

WhatBreach

예제

설치

왜?

감사 인사