WEBDIENSTE/pwnedOrNot
1
0
Fork 0
mirror of https://github.com/thewhiteh4t/pwnedOrNot.git synced 2026-08-17 18:35:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

readme updated

Browse Source
This commit is contained in:
thewhiteh4t
2026-03-28 12:04:02 +05:30
parent 9495929a1c
commit c388d26ca3
1 changed files with 74 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+74 -39
View File
@@ -3,23 +3,23 @@
<h4 align="center">OSINT Tool for Finding Passwords of Compromised Email Accounts</h4>
<p align="center">
<a href="https://twitter.com/thewhiteh4t"><b>Twitter</b></a>
<span> - </span>
<a href="https://t.me/thewhiteh4t"><b>Telegram</b></a>
Created by Lohitya Pushkar (thewhiteh4t).<br>
<a href="https://x.com/thewhiteh4t"><b>Twitter</b></a>
<span> - </span>
<a href="https://thewhiteh4t.github.io"><b>Blog</b></a>
</p>
| Available | in | |
|-|-|-|
| [BlackArch Linux](https://blackarch.org/) | [SecBSD](https://secbsd.org/) | [Tsurugi Linux](https://tsurugi-linux.org/) |
| ![](https://i.imgur.com/1wJVDV5.png) | ![](https://i.imgur.com/z36xL8c.png) | ![Tsurugi Linux](https://i.imgur.com/S1ylcp7.jpg) |
| Available | in | |
| ----------------------------------------- | ------------------------------------ | ------------------------------------------------- |
| [BlackArch Linux](https://blackarch.org/) | [SecBSD](https://secbsd.org/) | [Tsurugi Linux](https://tsurugi-linux.org/) |
| ![](https://i.imgur.com/1wJVDV5.png) | ![](https://i.imgur.com/z36xL8c.png) | ![Tsurugi Linux](https://i.imgur.com/S1ylcp7.jpg) |
---
pwnedOrNot works in two phases. In the **first** phase it tests the given email address using [**`HaveIBeenPwned v3 API`**](https://haveibeenpwned.com/API/v3) to find if the account have been breached in the past and in the **second** phase it searches the **password** in available **public dumps**.
**`An API Key is required to use the tool. You can purchase a key from HIBP website linked below`**
> [!IMPORTANT]
> An API Key is required to use the tool. You can purchase a key from HIBP website linked below
https://haveibeenpwned.com/API/v3
@@ -27,9 +27,9 @@ https://haveibeenpwned.com/API/v3
## Featured
<a href="https://jakecreps.com/2019/05/08/osint-collection-tools-for-pastebin/">**> OSINT Collection Tools for Pastebin - Jake Creps**</a>
<a href="https://jakecreps.com/2019/05/08/osint-collection-tools-for-pastebin/">OSINT Collection Tools for Pastebin - Jake Creps</a>
<a href="https://eforensicsmag.com/download/open-source-forensic-tools/">**> eForensics Magazine May 2020**</a>
<a href="https://eforensicsmag.com/download/open-source-forensic-tools/">eForensics Magazine May 2020</a>
---
@@ -43,33 +43,35 @@ https://github.com/thewhiteh4t/pwnedOrNot/wiki/Changelog
[**haveibeenpwned**](https://haveibeenpwned.com/API/v3) offers a lot of information about the compromised email, pwnedOrNot displays most useful information such as :
* Name of Breach
* Domain Name
* Date of Breach
* Fabrication status
* Verification Status
* Retirement status
* Spam Status
- Name of Breach
- Domain Name
- Date of Breach
- Fabrication status
- Verification Status
- Retirement status
- Spam Status
### About Passwords
The chances of finding passwords depends upon the following factors :
* If public dumps are available for the email address
* If the public dumps are accessible
* Sometimes the dumps are removed
* If the public dump contains password
* Sometimes a dump contains only email addresses
- If public dumps are available for the email address
- If the public dumps are accessible
- Sometimes the dumps are removed
- If the public dump contains password
- Sometimes a dump contains only email addresses
#### Tested on
* **Kali Linux**
* **BlackArch Linux**
* **Kali Nethunter**
* **Termux**
- **Kali Linux**
- **BlackArch Linux**
- **Kali Nethunter**
- **Termux**
> Windows users are suggested to use Kali Linux WSL2 or a VM
## Installation
**Ubuntu / Kali Linux / Nethunter / Termux**
```bash
@@ -94,59 +96,92 @@ docker run -it pon
```
## Updates
```bash
cd pwnedOrNot
git pull
```
## Usage
```bash
python3 pwnedornot.py -h
usage: pwnedornot.py [-h] [-e EMAIL] [-f FILE] [-s SAVE] [-d DOMAIN] [-b BREACH]
[-n] [-l] [-c CHECK] [-k KEY]
usage: pwnedornot.py [-h] [-e EMAIL] [-f FILE] [-d DOMAIN] [-n] [-l]
[-c CHECK]
options:
-h, --help show this help message and exit
-e, --email EMAIL Email address
-f, --file FILE input file with multiple email addresses
-s, --save SAVE Output file for pwned email addresses
-d, --domain DOMAIN Filter results by domain name
-b, --breach BREACH Get info about a breach by breach name
-n, --nodumps Only Check Breach Info and Skip Password Dumps
-l, --list Get List of all pwned Domains
-c, --check CHECK Check if your Domain is pwned
-k, --key KEY API Key
```
optional arguments:
-h, --help show this help message and exit
-e EMAIL, --email EMAIL Email Address You Want to Test
-f FILE, --file FILE Load a File with Multiple Email Addresses
-d DOMAIN, --domain DOMAIN Filter Results by Domain Name
-n, --nodumps Only Check Breach Info and Skip Password Dumps
-l, --list Get List of all pwned Domains
-c CHECK, --check CHECK Check if your Domain is pwned
### Add API key
# Examples
```
# Using ENV variable :
export PWNED_API_KEY="<hibp-api-key>"
# Using CLI argument :
python3 pwnedornot.py -e test@example.com -k <hibp-api-key>
# Using config file :
nano ~/.config/pwnedornot/config.json
{
"api_key": "<hibp-api-key>"
}
```
### Examples
```
# Check Single Email
python3 pwnedornot.py -e <email>
#OR
python3 pwnedornot.py --email <email>
# Check Multiple Emails from File
python3 pwnedornot.py -f <file name>
#OR
python3 pwnedornot.py --file <file name>
# Filter Result for a Domain Name [Ex : adobe.com]
python3 pwnedornot.py -e <email> -d <domain name>
#OR
python3 pwnedornot.py -f <file name> --domain <domain name>
# Get only Breach Info, Skip Password Dumps
python3 pwnedornot.py -e <email> -n
#OR
python3 pwnedornot.py -f <file name> --nodumps
# Get List of all Breached Domains
python3 pwnedornot.py -l
#OR
python3 pwnedornot.py --list
# Check if a Domain is Pwned
python3 pwnedornot.py -c <domain name>
#OR
python3 pwnedornot.py --check <domain name>
```
## Demo [ YouTube ]
[![Youtube](https://i.imgur.com/aSM6dKc.png)](https://www.youtube.com/watch?v=R_Y_QzVmERA)
## Demo
[![Youtube](https://i.imgur.com/aSM6dKc.png)](https://odysee.com/@thewhiteh4t:2/pwnedornot-find-passwords-of-compromised:1)