vqkro/higernesa passive OSINT toolkit in python and c++ usernames, emails, domains, ips, phones, hashes. no keys, no logins.
passive osint toolkit in python. no api keys, no accounts, no logging into anything. give it a handle, an email, a domain, an ip, a phone number or a hash and it goes through what's already public.
username sweeps a handle across about 700 sites, using the community WhatsMyName list. each entry in that list knows how to tell a hit from a miss, so the results aren't guesses. email tells you where the address is actually registered - firefox, x, spotify and duolingo right now, plus gravatar - pulls its breach history from xposedornot (breach names, dates, record counts and what leaked), then runs the part before the @ through the username sweep. domain pulls the dns records, the http status and title, subdomains out of certificate transparency and whois. ip gives geo and asn, reverse dns, and scans ports if you ask it to. phone does carrier, region, line type and timezone. hash just tells you what it probably is.
it's all public data. dns, whois, profile pages, cert logs.
there's more on top of the core six. discord tells you if a username is taken, and pulls a profile if you hand it a user id. github, roblox and steam look up profiles. tls dumps a host's certificate. headers shows which security headers a site is missing. proxies scrapes public proxy lists and checks them, writing the live ones to proxies/working.txt.
python higernes.py proxies
pulls seventeen public lists, checks them all at once and keeps the ones that answer, quickest first, with a live bar showing the count and a per-second rate. 142k candidates down to the good ones in about two and a half minutes. pass --thorough to wait longer on the slow ones and keep more of them. anything that takes a proxy file will fall back to proxies/working.txt if you don't hand it one, so dcheck picks them up on its own once you've run this.
needs python 3.9 or newer. then:
pip install -r requirements.txt
that gets you rich, requests, dnspython and aiohttp. phonenumbers comes along too but only the phone module touches it, so you can take it out of the file if you want. without aiohttp the username sweep falls back to threads and gets a lot slower, so keep it.
on windows, if python isn't on your path yet:
winget install --id Python.Python.3.13 -e
git clone https://gitlab.com/vqkro/higernes
cd higernes
pip install -r requirements.txt
python higernes.py
linux and mac are the same thing with python3 instead:
git clone https://gitlab.com/vqkro/higernes
cd higernes
python3 -m pip install -r requirements.txt
python3 higernes.py
on freebsd do pkg install -y python3 first.
if pip complains about an externally managed environment, either make a venv
python3 -m venv .venv && . .venv/bin/activate && pip install -r requirements.txt
or pass --break-system-packages and move on.
no arguments and you get the menu. or go straight at something:
python higernes.py username vqkro
python higernes.py username vqkro --cat coding
python higernes.py email [email protected]
python higernes.py domain example.com
python higernes.py ip 1.1.1.1 --ports
python higernes.py phone +14155552671
python higernes.py hash 5f4dcc3b5aa765d61d8327deb882cf99
python higernes.py scan example.com
python higernes.py scan example.com --all
python higernes.py subs example.com
python higernes.py subs example.com --wordlist names.txt
python higernes.py sweep 192.168.1.0/24 --port 80
python higernes.py revdns 8.8.8.8
python higernes.py whois example.com
python higernes.py http example.com
python higernes.py discord vqkro
python higernes.py discord 80351110224678912
python higernes.py github torvalds
python higernes.py roblox builderman
python higernes.py steam gabe
python higernes.py tls example.com
python higernes.py headers example.com
a category only narrows the username sweep. leave it off and it hits all 700.
domain does the whole lot in one go: dns records, http, subdomains from cert transparency plus a brute pass over common names, and whois.
data/wmn-data.json is the WhatsMyName dataset. swap in a newer copy any time, it gets read at startup. if the file isn't there it falls back to a short list baked into the script so things still run.
the port scanner in python is slow, so that part lives in core/hcore.cpp and compiles to a small binary. higernes looks for it next to itself, in core/, or on path, and shells out. if it isn't there, ip --ports falls back to the slower python version. you only need to build it if you're running from source and want the fast path:
# windows
g++ -O2 -std=c++17 -static -o core/hcore.exe core/hcore.cpp -lws2_32
# linux / mac
g++ -O2 -std=c++17 -o core/hcore core/hcore.cpp -pthread
it stands on its own too:
hcore dns github.com
hcore revdns 8.8.8.8
hcore whois example.com
hcore subs example.com --threads 96
hcore sweep 192.168.1.0/24 --port 80
hcore http example.com --path /
hcore ports example.com --banners
hcore ports example.com --all --threads 1024
that covers dns, reverse dns, whois over port 43, subdomain brute force, a subnet sweep and a plain http fetch. no tls in there, so http is port 80 or whatever you point it at.
the exe on the releases page already has it inside.
core/dcheck.cpp is the bulk discord username checker. it posts to the same
availability endpoint the signup page uses, from as many threads as you give it,
optionally through your own proxies.
dcheck --mode single --value somechosen
dcheck --mode ogu
dcheck --mode 4l --limit 5000 --threads 64
dcheck --mode 5c --threads 128 --proxies proxies.txt --out free.txt
dcheck --mode 4l --proxies proxies.txt --webhook https://discord.com/api/webhooks/...
with --webhook every free name gets posted to that url the moment it's found, so you can leave it running and watch a channel instead of the console. matches print as you go, free in green and taken in red; pass --only-free if you'd rather not see the taken ones scroll past.
modes are 4c and 4l (every 4 character / 4 letter combo), 5l and 5c for
five, ogu for a few hundred short word names, and single or list when you
want to feed it one name or a file.
discord rate limits hard per ip. with no proxies you'll get a wall of 429s and the summary line will tell you so. that's their side, not the checker.
wrapped on the python side too:
python higernes.py dcheck 4l --limit 500 --threads 64 --proxies proxies.txt
build it with winhttp (windows only):
g++ -O2 -std=c++17 -static -o core/dcheck.exe core/dcheck.cpp -lwinhttp
dnspython and requests are worth having. without dnspython only the A record resolves, everything else just gets skipped. ip-api's free endpoint throttles around 45 lookups a minute. crt.sh is slow or down half the time, and when it is the domain scan just says so and carries on.
pip install pyinstaller
pyinstaller --onefile --name higernes --console higernes.py
that's how the one on the releases page was built.
there's a second script, deadman.py, that watches a usb stick and fires when it gets yanked. pick the drive, pick what happens.
python deadman.py --list
python deadman.py --watch E:\ --action shutdown
python deadman.py --watch E:\ --action lock
python deadman.py --watch E:\ --action both --wipe-roots C:\Users\you
actions are shutdown, lock, wipe, both. wipe walks the roots you give it and removes everything under them, then shutdown if you asked for both. it defaults to your home directory if you don't pass --wipe-roots.
be careful with this one. wipe does not ask twice and does not go to the recycle bin. run it in a vm first if you want to see it work.