PEPE - Post Exploitation Pastebin Emails

Coleta informações sobre endereços de e-mail vazados do Pastebin

Sobre

O script analisa dumps de e-mail:senha do Pastebin e coleta informações sobre cada endereço de e-mail. Ele suporta Google, Trumail, Pipl, FullContact e HaveIBeenPwned. Além disso, permite enviar um e-mail informativo para a pessoa sobre sua senha vazada; no final, todas as informações vão para o Elasticsearch para exploração posterior.

Ele suporta apenas um formato - email:password.

Qualquer outra coisa não funcionará!

Por enquanto, a notificação funciona quando encontra uma correspondência no FullContact e, em seguida, envia o endereço de e-mail e as contas de redes sociais associadas.

Requisitos:

Python 3
API FullContact https://www.fullcontact.com/developer/
Google
API Pipl https://pipl.com/api/
HaveIBeenPwned
SafePush (para notificação - opcional - Em andamento) https://www.pushsafer.com/
Trumail https://trumail.io/
Conta Gmail (para envio de e-mails)
Elasticsearch (opcional)

pip install -r requirements

Config

{"domains": 
	{ #domínios para lista de permissão ou bloqueio
	"whitelist": [""],
	"blacklist": ["yahoo.com"]
},
"keys": 
	{ #CHAVES DE API
	"pushsafer": "API_KEY",
	"fullcontact": "API_KEY",
	"pipl": "API_KEY"
},
"gmail": 
	{ #Credenciais GMAIL e mensagem informativa que será enviada
	"username": "[email protected]",
	"password": "password",
	"message": "Hey,\n\nI am a security researcher and I want to inform you that your password !PASSWORD! has been leaked and you should change it immediately.\nThis email is part of the research, you can find more about it on https://medium.com/@wojciech\n\nStay safe!"},
"elasticsearch":
	{ #Informações de conexão do ElasticSearch
	"host": "127.0.0.1",
	"port": 9200}
}

Uso

root@kali:~/PycharmProjects/pepe# python pepe.py -h
usage: pepe.py [-h] [--file FILE] [--stream] [--interactive]
                 [--modules MODULES [MODULES ...]] [--elasticsearch]
                 [--whitelist] [--blacklist]

                            ,=.
              ,=''''==.__.="  o".___
        ,=.=="                  ___/
  ,==.,"    ,          , \,===""
 <     ,==)  "'"=._.==)    `==''    `"           `

  clover/snark^
  http://ascii.co.uk/art/platypus
  
  Post Exploitation Pastebin Emails
  github.com/woj-ciech
  medium.com/@woj_ciech
  
  Example:
  python pepe.py --file <dump.txt> --interactive --whitelist
  python pepe.py --file <dump.txt> --modules hibp google trumail --elasticsearch --blacklist

optional arguments:
  -h, --help            show this help message and exit
  --file FILE           Load file
  --stream              Stream Pastebin
  --interactive         Interactive mode
  --modules MODULES [MODULES ...]
                        Modules to check in non-interactive mode
  --elasticsearch       Output to ElasticSearch
  --whitelist           Whitelist
  --blacklist           Blacklist

Exemplo

Modo interativo, cada e-mail é verificado individualmente e um módulo específico é executado.

root@kali:~/PycharmProjects/pepe# python pepe.py --file paste.txt --interactive --blacklist

-----------------------Found email [REDACTED]@hotmail.com with password [REDACTED]-----------------------
[A] Add domain hotmail.com to blacklist
[T] Test
[G] Google search
[H] HaveIBeenPwned
[P] Pipl
[F] FullContact
[I] Inform
[N] Next
> G
---Google Search---
http://[REDACTED]
http://[REDACTED]
http://[REDACTED]

[A] Add domain gmail.com to blacklist
[T] Test
[G] Google search
[H] HaveIBeenPwned
[P] Pipl
[F] FullContact
[I] Inform
[N] Next
> N
-----------------------Found email [REDACTED].[REDACTED]@gmail.com with password [REDACTED]-----------------------
[A] Add domain gmail.com to blacklist
[T] Test
[G] Google search
[H] HaveIBeenPwned
[P] Pipl
[F] FullContact
[I] Inform
[N] Next
> F
---FullContact---
[REDACTED] [REDACTED]
https://twitter.com/[REDACTED]
https://facebook.com/[REDACTED]
https:/linkedin.com/[REDACTED]
[A] Add domain gmail.com to blacklist
[T] Test
[G] Google search
[H] HaveIBeenPwned
[P] Pipl
[F] FullContact
[I] Inform
[N] Next
> P
---Pipl---
Name: [REDACTED]
[REDACTED] years old
Jobs:
Quality Control [REDACTED] (since 2018)
[REDACTED] Review [REDACTED] (2017-2018)
[REDACTED] Attorney [REDACTED] (2017-2018)
[REDACTED] Attorney at [REDACTED] (2017-2017)
...
[REDACTED] (2012-2012)
[REDACTED] Assistant at [REDACTED] (2012-2012)
Author/Founder at [REDACTED] (2009-2011)
https://www.linkedin.com/in/[REDACTED]
http://www.facebook.com/people/[REDACTED]
http://twitter.com/[REDACTED]
http://pinterest.com/[REDACTED]
https://plus.google.com/[REDACTED]

...
[REDACTED]

Modo não interativo, quando apenas os módulos escolhidos são executados nos endereços de e-mail.

root@kali:~/PycharmProjects/# python pepe.py --file pastetest.txt --blacklist --modules hibp google fullcontact trumail --elasticsearch
-----------------------Found email [REDACTED]@hotmail.com with password [REDACTED]-----------------------
---Google Search---
https://pastebin.com/[REDACTED]
---Have I Been Pwned---
LinkedIn
---FullContact---
No results
---Trumail---
Email test passed
-----------------------Found email charlie.[REDACTED]@live.com with password [REDACTED]-----------------------
---Google Search---
https://justpaste.it/[REDACTED]
https://pastebin.com/[REDACTED]
---Have I Been Pwned---
MyHeritage
RiverCityMedia
Tumblr
YouveBeenScraped
---FullContact---
Charlie [REDACTED]
https://twitter.com/[REDACTED]
[REDACTED]
---Trumail---
Email test passed
-----------------------Found email [REDACTED].[REDACTED]@gmail.com with password [REDACTED]-----------------------
---Google Search---
http://[REDACTED]
http://[REDACTED]
http://[REDACTED]
https://pastebin.com/[REDACTED]
---Have I Been Pwned---
BTSec
Exactis
HauteLook
Houzz
LinkedIn
---FullContact---
[REDACTED] [REDACTED]
https://www.facebook.com/[REDACTED]
[REDACTED]
---Trumail---
Email test passed
-----------------------Found email [REDACTED].[REDACTED]@gmail.com with password [REDACTED]-----------------------
---Google Search---
https://[REDACTED]
https://[REDACTED]
https://[REDACTED]
https://pastebin.com/[REDACTED]
---Have I Been Pwned---
Lastfm
LinkedIn
MySpace
Trillian
Tumblr
---FullContact---
[REDACTED] [REDACTED] [REDACTED].
https://www.facebook.com/[REDACTED]
https://plus.google.com/[REDACTED]
https://www.linkedin.com/in/[REDACTED]
http://www.pinterest.com/[REDACTED]
https://twitter.com/[REDACTED]
https://youtube.com/user/[REDACTED]
[REDACTED]