Pentest & Bug Bounty Resources and Techniques
  • Pentest & Bug Bounty Resources and Techniques
    • Introduction
    • Tests Checklist
    • OSINT
    • Communications Security
      • SSL/TLS
    • Networking
      • Subdomains Discovery
        • DNS & OSINT
        • DNS Brute force
          • Second DNS Brute-Force Round
      • Subdomain Takeover
      • Network Host Scan/Discovery
        • External/Internal
        • Internal only
      • Network Vulnerability Scanning
      • Network Hacking
      • Parsing
      • Reporting
    • Brute Force
      • Wordlists
      • Databases
      • SSH
    • Web
      • Endpoint Discovery
      • Infrastructure & Configuration
        • Headers
        • WAF Detection/ Evasion
      • Injection
        • GraphQL
        • Cross-Site Scripting (XSS)
        • SQL Injection
        • Payloads
      • SSRF & XXE
        • Labs & Resources
        • Tools
        • SVG SSRF Cheatsheet
        • XXE - XEE - XML External Entity
      • JWT Vulnerabilities (Json Web Tokens)
      • HTTP/S DoS
    • Mobile
      • Both
        • SAST
          • MobSF
        • DAST
          • Installing Frida and Objection
      • Android
        • Create a Lab
          • Rooting Android Emulator
          • Rooting Android Emulator Cheat Sheet
        • APK Certificates
        • SAST
          • APKs
            • Get Information from APK
            • GDA (GJoy Dex Analysizer)
            • Scanning APK for URIs, endpoints & secrets
            • Google Maps API Scanner
        • DAST
          • Rooting the Android Studio AVDs
          • non-Rooted devices
            • Bypass SSL Pinning - non-rooted devices
              • Method 1: apk-mitm
              • Instrumentation with Frida and Objection
                • Bypass SSL Pinning - Method 2: With Objection Explore
                • Bypass SSL Pinning - Method 3: With root_bypass.js
          • Rooted Devices
            • Run frida-server in the emulator or device
            • Inject Frida
            • Bypass SSL Pinning - rooted devices
              • Install Burp CA as a system-level CA on the device
      • iOS
        • SAST
          • Building a reverse iOS engineering environment for free
          • Test Vulnerabilities
  • Lets Practice
    • Virtual Machines
    • Vulnerable App
    • Guided Labs
    • CTFs
  • Group 1
    • AI
Powered by GitBook
On this page
  • h8mail
  • Karma
  • Install
  • Search emails with the password: 123456789
  • Search emails with the local-part: johndoe
  • Search emails with the domain: hotmail.com
  • Search email password: johndoe@unknown.com
  1. Pentest & Bug Bounty Resources and Techniques

OSINT

PreviousTests ChecklistNextCommunications Security

Last updated 3 months ago

pip3 install h8mail
h8mail -g
nano h8mail_config.ini
h8mail -t target@example.com

Find leaked emails with your passwords.

Install

sudo apt install tor python3 python3-pip
git clone https://github.com/decoxviii/karma.git ; cd karma
sudo -H pip3 install -r requirements.txt
python3 bin/karma.py --help

Search emails with the password: 123456789

sudo service tor start
/karma/bin/./karma search '123456789' --password -o output1

Search emails with the local-part: johndoe

sudo service tor start
/karma/bin/./karma search 'johndoe' --local-part -o output2

Search emails with the domain: hotmail.com

sudo service tor start
karma/bin/./karma search 'hotmail.com' --domain -o output3

Search email password: johndoe@unknown.com

sudo service start tor
python3 bin/karma.py target 'johndoe@unknown.com' -o output4
h8mail
Karma