search

thewhiteh4t / pwnedOrNot

OSINT Tool for Finding Passwords of Compromised Email Addresses
MIT License
2.19k stars 318 forks source link

Could not collect tokens #10

Closed STFURTFMLAGG closed 5 years ago

STFURTFMLAGG commented 5 years ago

ERROR:root:'https://haveibeenpwned.com/api/v2/breachedaccount/test@example.com' returned an error. Could not collect tokens. Traceback (most recent call last): File "pwnedornot.py", line 221, in main() File "pwnedornot.py", line 86, in main cookies, user_agent = cfscrape.get_tokens('https://haveibeenpwned.com/api/v2/breachedaccount/test@example.com', user_agent='pwnedornot') File "/home/nic/.local/lib/python2.7/site-packages/cfscrape/init.py", line 178, in get_tokens resp.raise_for_status() File "/usr/lib/python2.7/dist-packages/requests/models.py", line 935, in raise_for_status raise HTTPError(http_error_msg, response=self) requests.exceptions.HTTPError: 403 Client Error: Forbidden for url: https://haveibeenpwned.com/api/v2/breachedaccount/test@example.com

thewhiteh4t commented 5 years ago

looks like you are using something like tor, i was able to reproduce this using both torsocks and proxychains, looking into it

thewhiteh4t commented 5 years ago

try visiting https://haveibeenpwned.com/api/v2/breachedaccount/test@example.com with whatever service you are using for example tor, if you are getting captcha then this issue cannot be resolved, because if i visit the page from a browser i am getting captha and cfscrape cannot bypass it

Reaper-Oni commented 5 years ago

I have the same issue with osrframework and when using the link suggested, I get the following output:

This version of the API has been discontinued, please use V3: https://www.troyhunt.com/authentication-and-the-have-i-been-pwned-api/

Can you tell me where in the osrframework to edit this or is this going to be updated using apt upgrade?

thewhiteh4t commented 5 years ago

@Reaper-Oni this issue is already fixed in pwnedOrNot long ago, I saw osrframework repo and last commit was 10 months ago so they are not updating it, hibp now uses API v3, all the endpoint urls will have to be changed according to the new documentation and hibp now requires an API key which is paid