Looking for email finding feature details

[amartya89]

Hi Team,

Thanks for this awesome tool. Just to understand better, i am trying to use the tool to find any breached e-mail address against a domain. So can i? If so, would you please in short guide me on the process?

Regards

[bcoles]

The following modules return EMAILADDR_COMPROMISED data:

• modules/sfp_binaryedge.py
• modules/sfp_haveibeenpwned.py
• modules/sfp_citadel.py
• modules/sfp_emailrep.py
• modules/sfp_scylla.py

However, most of these modules require EMAILADDR data as input, so you'll need to run additional modules.

sfcli can be used to invoke individual or multiple modules, but you'll probably want to play around with the modules first to figure out a configuration which works for you, which is more easily done using the web interface.

When you create a scan, you can choose which modules or module types to run. There's a By Required Data tab, which allows you to chose which modules should be run, based on the returned data type. Selecting Email Address and Hacked Email Address, then entering you domain of interest as input, will get you in the right direction.

Alternatively, you can simply select a Passive scan By Use Case. This will return a lot of information, including email addresses and compromised email addresses.

[amartya89]

Thanks a lot for this detailed reply. My intention is to find out all the leaked or publicly available email address per domain and finding if the same is compromised.

[bcoles]

Unfortunately most of the modules which return EMAILADDR_COMPROMISED events requires an input list of email addresses, so the results are dependent on which email addresses are identified during the scan. Alternatively, you can run the scan on a list of email addresses one-by-one using the command line.

python3 ./sf.py -t EMAILADDR_COMPROMISED,PASSWORD_COMPROMISED,HASH_COMPROMISED -s email@localhost.local

One exception is the sfp_scylla module which queries Scylla by domain. You can achieve this with:

python3 ./sf.py -m sfp_scylla -s your.domain

Also, here's example command line usage for haveibeenpwned.com :

• https://asciinema.org/a/128731

The command line format has changed a bit between Spiderfoot 2.x and 3.x, but should be fairly similar.