Listen to this Post
Introduction:
Open Source Intelligence (OSINT) is the art of collecting and analyzing publicly available data to uncover security flaws, data leaks, and exposed credentials. As highlighted in recent LinkedIn discussions—including the teased “numéro 3” and upcoming tribune in Les Echos—the intersection of OSINT and data leaks has never been more critical for defenders and attackers alike. This article transforms those teasers into actionable technical knowledge, giving you verified commands, tool configurations, and step‑by‑step workflows to detect, verify, and mitigate credential exposures across Linux, Windows, and cloud environments.
Learning Objectives:
- Master OSINT reconnaissance to locate leaked credentials and data dumps using open sources.
- Automate username, email, and domain exposure checks with theHarvester, Sherlock, and DeHashed API.
- Apply mitigation strategies including password rotation, MFA enforcement, and cloud hardening against leaked secrets.
You Should Know
- Passive Email & Domain Harvesting with theHarvester (Linux)
theHarvester is a go‑to tool for gathering emails, subdomains, and virtual hosts from public search engines, PGP key servers, and SHODAN. It directly supports data‑leak discovery by revealing which email addresses have appeared in breaches or public repositories.
What this does:
It queries sources like Google, Bing, Baidu, LinkedIn (deprecated), and especially the PGP key server and SHODAN to collect exposed email addresses and hostnames associated with a domain. This helps you map an organization’s attack surface before an adversary does.
Step‑by‑step guide:
- Install theHarvester (Kali Linux or any Debian‑based distro):
sudo apt update && sudo apt install theharvester -y
For Windows (WSL2 recommended) or macOS, use `pip` or clone from GitHub.
-
Basic domain search – gather emails from Google and Bing:
theHarvester -d example.com -b google,bing -l 500
-
Target PGP key servers – often reveal old or leaked corporate emails:
theHarvester -d example.com -b pgp -l 200
-
Use SHODAN to find exposed devices (requires SHODAN API key):
theHarvester -d example.com -b shodan
5. Export results to HTML for reporting:
theHarvester -d example.com -b all -f results.html
Pro tip:
Combine theHarvester with `curl` and `jq` to parse JSON output for automation:
theHarvester -d example.com -b google -f out.json && jq '.emails[]' out.json
2. Username OSINT with Sherlock – Cross‑Platform (Linux/Windows)
Sherlock hunts for a given username across hundreds of social networks and forums. If a username appears on a breached forum or paste site, it’s a strong indicator of credential exposure.
What this does:
Sherlock queries APIs and HTML endpoints of over 300 websites to see if a username is registered. Attackers use it to pivot from a single leaked username to multiple profiles; defenders use it to find where employee usernames have been reused.
Step‑by‑step guide (Linux):
1. Install Sherlock:
git clone https://github.com/sherlock-project/sherlock.git cd sherlock python3 -m pip install -r requirements.txt
2. Run a scan:
python3 sherlock.py johndoe
3. Output to CSV for analysis:
python3 sherlock.py johndoe --csv output.csv
Windows (PowerShell) alternative – using Invoke‑OSINT module:
Install-Module -Name PSInt -Force Find-Username -Username "johndoe" -OutputFile results.txt
Interpretation:
Any positive hit on a forum that suffered a known data leak (e.g., BreachForums, RaidForums archive) means that username and its associated hash or plaintext password may be circulating. Immediately check `https://haveibeenpwned.com` for the corresponding email.
- Leak Detection with DeHashed API (Authenticated – Python)
DeHashed is a commercial engine that indexes breached credentials. Its API allows programmatic searches for emails, domains, IPs, and hashed passwords. This section shows how to query it using Python.
Prerequisites:
- A DeHashed API key (paid plan required for full access).
- Python 3 with `requests` library.
Step‑by‑step guide:
1. Set up your script:
import requests
import json
api_key = "YOUR_API_KEY"
headers = {"X-API-Key": api_key}
base_url = "https://api.dehashed.com/search"
Search by email
query = "email:[email protected]"
response = requests.get(base_url, headers=headers, params={"query": query})
data = response.json()
for entry in data['entries']:
print(f"Source: {entry['source']} | Password: {entry.get('password', 'N/A')}")
- Search by domain to see all breached accounts:
query = "domain:example.com"
-
Automate checks against a list of employee emails:
emails = ["[email protected]", "[email protected]"] for email in emails: r = requests.get(base_url, headers=headers, params={"query": f"email:{email}"}) if r.status_code == 200 and len(r.json().get('entries', [])) > 0: print(f"BREACH: {email} found in {r.json()['entries'][bash]['source']}")
Mitigation action:
If a password hash appears, immediately force a password reset and enable MFA for that account. Also check for reused passwords across other services.
- Windows PowerShell: OSINT on Active Directory & Leaked Credentials
Attackers often test leaked credentials against an organization’s VPN, OWA, or RDP. Defenders can simulate this using PowerShell to validate which leaked passwords are still active.
What this does:
The script below checks if a given password (from a leak) is still valid for a user account via LDAP or ADSI. Use only on your own infrastructure with proper authorization.
Step‑by‑step guide (PowerShell as Administrator):
1. Load the credential check function:
function Test-LeakedCredential {
param($Username, $Password)
$SecurePass = ConvertTo-SecureString $Password -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential($Username, $SecurePass)
try {
$null = Invoke-Command -ComputerName "DC01" -ScriptBlock { whoami } -Credential $Cred -ErrorAction Stop
Write-Host "CRITICAL: $Username still uses leaked password!" -ForegroundColor Red
} catch {
Write-Host "Password changed or invalid." -ForegroundColor Green
}
}
- Run against a list of users and leaked passwords from a breach (e.g.,
leaks.csv):$leaks = Import-Csv leaks.csv columns: User,Password foreach ($leak in $leaks) { Test-LeakedCredential -Username $leak.User -Password $leak.Password } -
Remediation – Force password change via Group Policy or:
Set-ADUser -Identity "john.doe" -ChangePasswordAtLogon $true
-
Google Dorks for Data Leaks – Find Open Directories & Configs
Google Dorks are advanced search operators that reveal publicly exposed files, logs, and credentials. This is pure OSINT; no API required.
What this does:
Craft queries to locate `.env` files, Git repositories, backup archives, or Excel sheets containing passwords on public web servers.
Step‑by‑step guide:
Use these dorks in Google (or Bing):
| Purpose | Dork |
|||
| Exposed `.env` with secrets | `filename:.env “DB_PASSWORD”` |
| Git folder containing credentials | `”–BEGIN RSA PRIVATE KEY–” “git”` |
| Excel files with “password” | `filetype:xls “password”` |
| Open directory of logs | `intitle:”index of” “access.log”` |
| PHP info pages (reveals env vars) | `intitle:”phpinfo()” “SERVER_NAME”` |
Automation with `googlesearch-python`:
pip install google
python -c "from googlesearch import search; list(search('filetype:log password', num_results=10))"
Ethical warning:
Do not access or download any file without explicit permission from the owner. Use these dorks only to audit your own domains or authorized targets.
6. OSINT Framework & Automated Leak Monitoring (Linux)
The OSINT Framework (https://osintframework.com`) categorizes hundreds of OSINT tools. For leak monitoring, automate periodic checks usingcurl,cron`, and HaveIBeenPwned (HIBP) v3 API.
What this does:
A bash script that queries HIBP for a list of corporate emails and alerts if any new breach appears.
Step‑by‑step guide:
- Get HIBP API key (free for low volume).
2. Create `check_hibp.sh`:
!/bin/bash API_KEY="your_api_key" EMAILS_FILE="emails.txt" while read email; do response=$(curl -s -H "hibp-api-key: $API_KEY" "https://haveibeenpwned.com/api/v3/breachedaccount/$email") if [[ "$response" != "[]" ]]; then echo "[bash] $email appears in breaches: $response" Send alert via webhook, email, or syslog fi done < "$EMAILS_FILE"
3. Schedule daily at 9 AM:
chmod +x check_hibp.sh crontab -e Add line: 0 9 /home/user/check_hibp.sh
Cloud hardening tie‑in:
If a breach includes IAM user credentials, immediately rotate AWS keys using AWS CLI:
aws iam create-access-key --user-name leaked_user aws iam delete-access-key --access-key-id OLD_KEY_ID --user-name leaked_user
- API Security: Testing for Leaked Tokens in Public Repos (GitHub OSINT)
Developers often accidentally commit API keys, tokens, and secrets to public GitHub repositories. Tools like `truffleHog` and `gitleaks` scan commit history for high‑entropy strings.
What this does:
Recursively searches a GitHub repo (or org) for secrets by analyzing commit diffs and regex patterns.
Step‑by‑step guide (Linux):
1. Install truffleHog:
pip install truffleHog
2. Scan a public repository:
trufflehog https://github.com/example/repo.git
- Scan your entire GitHub organization (requires token with `repo` scope):
trufflehog --org example_org --token ghp_xxxx
-
Mitigation – If a live token is found:
– Immediately revoke the token from the service (AWS, Slack, Stripe, etc.).
– Use `git filter-branch` or BFG Repo‑Cleaner to purge history.
– Enforce pre‑commit hooks to prevent future leaks:
pip install pre-commit pre-commit install
What Undercode Say
- Key Takeaway 1: OSINT is a double‑edged sword; the same techniques attackers use to find leaks are your best defense to discover them first. Automated scanning with theHarvester, Sherlock, and HIBP API should be part of every blue team’s weekly routine.
- Key Takeaway 2: Data leaks are not just about passwords—exposed API keys, environment files, and Git histories cause catastrophic cloud breaches. Mitigation must include secrets rotation, MFA, and continuous monitoring of public code repositories.
Analysis: The LinkedIn conversation teasing “numéro 3” and the upcoming Les Echos tribune underscores a growing awareness that OSINT and data leaks are no longer niche. As regulatory frameworks like NIS2 and DORA demand proactive incident prevention, organizations must shift from reactive breach notification to continuous external monitoring. The commands and workflows above are not theoretical—they are used daily by offensive and defensive teams across the globe. Ignoring them means leaving your credentials on the digital street corner for anyone to pick up.
Prediction
Within 18 months, AI‑driven OSINT agents will autonomously correlate leaked credentials from paste sites, dark web forums, and public repos, then trigger automated password resets and account lockouts without human intervention. Regulatory bodies will mandate quarterly OSINT audits as part of compliance (NIS2, CRA, DORA). Simultaneously, the rise of “OSINT as a Service” platforms will democratize leak detection for SMEs, but also fuel a surge in targeted credential‑stuffing attacks—making passwordless authentication and hardware tokens the new baseline for enterprise security. The “numéro 3” teased today will be remembered as the turning point when OSINT moved from hacker hobby to corporate necessity.
▶️ Related Video (68% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Marc Antoine – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
