diff --git a/README.md b/README.md index 7f14846..e1517b4 100755 --- a/README.md +++ b/README.md @@ -3,23 +3,23 @@

OSINT Tool for Finding Passwords of Compromised Email Accounts

- Twitter - - - Telegram + Created by Lohitya Pushkar (thewhiteh4t).
+ Twitter - Blog

-| Available | in | | -|-|-|-| -| [BlackArch Linux](https://blackarch.org/) | [SecBSD](https://secbsd.org/) | [Tsurugi Linux](https://tsurugi-linux.org/) | -| ![](https://i.imgur.com/1wJVDV5.png) | ![](https://i.imgur.com/z36xL8c.png) | ![Tsurugi Linux](https://i.imgur.com/S1ylcp7.jpg) | +| Available | in | | +| ----------------------------------------- | ------------------------------------ | ------------------------------------------------- | +| [BlackArch Linux](https://blackarch.org/) | [SecBSD](https://secbsd.org/) | [Tsurugi Linux](https://tsurugi-linux.org/) | +| ![](https://i.imgur.com/1wJVDV5.png) | ![](https://i.imgur.com/z36xL8c.png) | ![Tsurugi Linux](https://i.imgur.com/S1ylcp7.jpg) | --- pwnedOrNot works in two phases. In the **first** phase it tests the given email address using [**`HaveIBeenPwned v3 API`**](https://haveibeenpwned.com/API/v3) to find if the account have been breached in the past and in the **second** phase it searches the **password** in available **public dumps**. -**`An API Key is required to use the tool. You can purchase a key from HIBP website linked below`** +> [!IMPORTANT] +> An API Key is required to use the tool. You can purchase a key from HIBP website linked below https://haveibeenpwned.com/API/v3 @@ -27,9 +27,9 @@ https://haveibeenpwned.com/API/v3 ## Featured -**> OSINT Collection Tools for Pastebin - Jake Creps** +OSINT Collection Tools for Pastebin - Jake Creps -**> eForensics Magazine May 2020** +eForensics Magazine May 2020 --- @@ -43,33 +43,35 @@ https://github.com/thewhiteh4t/pwnedOrNot/wiki/Changelog [**haveibeenpwned**](https://haveibeenpwned.com/API/v3) offers a lot of information about the compromised email, pwnedOrNot displays most useful information such as : -* Name of Breach -* Domain Name -* Date of Breach -* Fabrication status -* Verification Status -* Retirement status -* Spam Status +- Name of Breach +- Domain Name +- Date of Breach +- Fabrication status +- Verification Status +- Retirement status +- Spam Status ### About Passwords The chances of finding passwords depends upon the following factors : -* If public dumps are available for the email address -* If the public dumps are accessible - * Sometimes the dumps are removed -* If the public dump contains password - * Sometimes a dump contains only email addresses +- If public dumps are available for the email address +- If the public dumps are accessible + - Sometimes the dumps are removed +- If the public dump contains password + - Sometimes a dump contains only email addresses #### Tested on -* **Kali Linux** -* **BlackArch Linux** -* **Kali Nethunter** -* **Termux** + +- **Kali Linux** +- **BlackArch Linux** +- **Kali Nethunter** +- **Termux** > Windows users are suggested to use Kali Linux WSL2 or a VM ## Installation + **Ubuntu / Kali Linux / Nethunter / Termux** ```bash @@ -94,59 +96,92 @@ docker run -it pon ``` ## Updates + ```bash cd pwnedOrNot git pull ``` ## Usage + ```bash python3 pwnedornot.py -h +usage: pwnedornot.py [-h] [-e EMAIL] [-f FILE] [-s SAVE] [-d DOMAIN] [-b BREACH] + [-n] [-l] [-c CHECK] [-k KEY] -usage: pwnedornot.py [-h] [-e EMAIL] [-f FILE] [-d DOMAIN] [-n] [-l] - [-c CHECK] +options: + -h, --help show this help message and exit + -e, --email EMAIL Email address + -f, --file FILE input file with multiple email addresses + -s, --save SAVE Output file for pwned email addresses + -d, --domain DOMAIN Filter results by domain name + -b, --breach BREACH Get info about a breach by breach name + -n, --nodumps Only Check Breach Info and Skip Password Dumps + -l, --list Get List of all pwned Domains + -c, --check CHECK Check if your Domain is pwned + -k, --key KEY API Key +``` -optional arguments: - -h, --help show this help message and exit - -e EMAIL, --email EMAIL Email Address You Want to Test - -f FILE, --file FILE Load a File with Multiple Email Addresses - -d DOMAIN, --domain DOMAIN Filter Results by Domain Name - -n, --nodumps Only Check Breach Info and Skip Password Dumps - -l, --list Get List of all pwned Domains - -c CHECK, --check CHECK Check if your Domain is pwned +### Add API key -# Examples +``` +# Using ENV variable : +export PWNED_API_KEY="" + +# Using CLI argument : + +python3 pwnedornot.py -e test@example.com -k + + +# Using config file : + +nano ~/.config/pwnedornot/config.json +{ + "api_key": "" +} +``` + +### Examples + +``` # Check Single Email + python3 pwnedornot.py -e #OR python3 pwnedornot.py --email # Check Multiple Emails from File + python3 pwnedornot.py -f #OR python3 pwnedornot.py --file # Filter Result for a Domain Name [Ex : adobe.com] + python3 pwnedornot.py -e -d #OR python3 pwnedornot.py -f --domain # Get only Breach Info, Skip Password Dumps + python3 pwnedornot.py -e -n #OR python3 pwnedornot.py -f --nodumps # Get List of all Breached Domains + python3 pwnedornot.py -l #OR python3 pwnedornot.py --list # Check if a Domain is Pwned + python3 pwnedornot.py -c #OR python3 pwnedornot.py --check ``` -## Demo [ YouTube ] -[![Youtube](https://i.imgur.com/aSM6dKc.png)](https://www.youtube.com/watch?v=R_Y_QzVmERA) +## Demo + +[![Youtube](https://i.imgur.com/aSM6dKc.png)](https://odysee.com/@thewhiteh4t:2/pwnedornot-find-passwords-of-compromised:1)