DOCSEARCHbyAlgolia
Submit Docs

h8mail Documentation

repository·master·Indexed 26 days ago

https://github.com/khast3x/h8mail

An email OSINT and breach hunting tool designed to identify leaked credentials and related information. h8mail supports querying reconnaissance services, local cleartext breaches, and compressed (.gz) breach files. Key features include email extraction from URLs, custom queries for usernames, IPs, hashes, and domains, and the ability to chase related emails via API services. It supports outputting results to CSV and JSON formats.

Tokens
1.4K
Snippets
7
Records
12
Agent score
40%

What's inside h8mail

  1. Overview of h8mail features

    master

    h8mail is an Email OSINT and password breach hunting tool used to find passwords through various breach and reconnaissance services or local breach files (like the Breached Compilation torrent).

    Key capabilities include:

    • Pattern Matching: Supports regular expressions for email pattern matching and loose patterns (e.g., "john.smith", "evilcorp") for local searches.
    • Search Modes: Supports CLI input or bulk file-reading for targeting. It can search local .txt and .gz files using multiprocessing (compatible with "Collection#1").
    • Email Discovery: Ability to get related emails and chase/target those related emails in ongoing searches.
    • Data Management: Regroups breach results for all targets and methods, and supports outputting results to CSV files.
    • Advanced Features: Supports premium lookup services and is compatible with "Breach Compilation" torrent scripts.

  2. Import the maintainer's PGP keys

    master

    The project code is signed with the maintainer's (ktx) Keybase PGP key. You can import these keys using curl and gpg, or via the Keybase app.

    # curl + gpg pro tip: import ktx's keys
curl https://keybase.io/ktx/pgp_keys.asc | gpg --import

# the Keybase app can push to gpg keychain, too
keybase pgp pull ktx

  3. Chase related emails

    master

    Expand your search by adding related emails found via APIs to your ongoing target list.

    • Use -ch [CHASE_LIMIT] or --chase [CHASE_LIMIT] to define how many related emails to chase per target. Requires a Hunter.io private API key.
    • Use --power-chase to add related emails from ALL supported API services to the target list.

  5. Generate h8mail configuration template

    master
    Use the --gen-config or -g flag to generate a configuration file template (h8mail_config.ini) in your current working directory. This file can be used to store API keys for various services. Note that running this command will overwrite any existing h8mail_config.ini file.

  7. Search local Breach Compilation data

    master

    Search for targets against a local copy of the Breach Compilation torrent using the -bc or --breachcomp flag. You can pass API keys via the -k flag using the format K=V.

    h8mail -t targets.txt -bc ../Downloads/BreachCompilation/ -k "snusbase_token=$snusbase_token"

  8. Search local compressed (.gz) breaches

    master

    Search through local .tar.gz (gzip) compressed breach files using the -gz or --gzip flag. This uses multiprocessing to scan files efficiently.

    h8mail -t targets.txt -gz /tmp/Collection1/ -sk

  10. Perform custom queries (Username, IP, Hash, Domain)

    master

    Use the -q or --custom-query flag to specify the type of query. Supported types include username, password, ip, hash, and domain. When searching locally, this performs an implicit "loose" search.

    h8mail -t JSmith89 -q username -k "dehashed_email=user@email.com" "dehashed_key=ABCDE123"

h8mail -t 42.202.0.42 -q ip -c h8mail_config_priv.ini -ch 2 --power-chase

  11. Query multiple targets and output to CSV

    master

    Search for a list of targets provided in a file, use a configuration file for API keys, and save the results to a CSV file using -o or --output.

    h8mail -t targets.txt -c config.ini -o pwned_targets.csv

  12. h8mail CLI Reference

    master

    Target and URL Selection

    • -t, --targets USER_TARGETS: String inputs or files. Supports email pattern matching, filepath globbing, and multiple arguments.
    • -u, --url USER_URLS: String inputs or files. Parses URLs for emails. Requires http:// or https://.

    Query and Search Modes

    • -q, --custom-query USER_QUERY: Perform custom query (username, password, ip, hash, domain).
    • --loose: Disable email pattern recognition; use spaces as pattern separators.
    • -sk, --skip-defaults: Skips Scylla and HunterIO checks. Ideal for local scans.

    Configuration and API Keys

    • -c, --config CONFIG_FILE: Configuration file for API keys (Snusbase, WeLeakInfo, Leak-Lookup, HaveIBeenPwned, Emailrep, Dehashed, hunterio).
    • -k, --apikey CLI_APIKEYS: Pass config options via CLI in K=V,K=V format.

    Output

    • -o, --output OUTPUT_FILE: Write CSV output.
    • -j, --json OUTPUT_JSON: Write JSON output.
    • --hide: Only shows the first 4 characters of found passwords (useful for demos).

    Local Breach Scanning

    • -bc, --breachcomp BC_PATH: Path to Breach Compilation torrent folder (uses query.sh).
    • -lb, --local-breach LOCAL_BREACH_SRC: Scan local cleartext breaches. Supports file/folder and globbing.
    • -gz, --gzip LOCAL_GZIP_SRC: Scan local .tar.gz breaches. Supports file/folder and globbing.
    • -sf, --single-file: Enables progress bar for large files; disables concurrent searching for stability.

    Advanced Search

    • -ch, --chase [CHASE_LIMIT]: Add related emails from Hunter.io to target list.
    • --power-chase: Add related emails from ALL API services to target list.
    • --debug: Print request debug information.