h8mail

h8mail (github.com/khast3x/h8mail) is an email OSINT and password-breach hunting tool by khast3x. It locates compromised credentials for target emails either by querying online breach services or by searching local breach dumps — including Troy Hunt’s “Collection #1” and the “Breach Compilation” torrent — using multiprocessing to grep through cleartext and .gz-compressed files. It is pip-installable (pip3 install h8mail) with requests as its only dependency.

Capabilities

• Target input flexibility — emails as strings or bulk files, regex email-pattern extraction from arbitrary tool output, and URL crawling (-u) that parses pages for target emails
• Local breach search — point it at a directory of breach dumps (-lb) or gzipped dumps (-gz); --loose enables loose patterns (“john.smith”, “evilcorp”) and it is script-compatible with the Breach Compilation layout
• Breach APIs — HaveIBeenPwned v3 (breaches + pastes), Hunter.io, Snusbase, Leak-Lookup, Emailrep.io, Dehashed, IntelligenceX, Breachdirectory; premium services return cleartext passwords, hashes, salts, usernames, IPs
• Email chasing — pull related emails from results and add them to the ongoing search (-ch, --power-chase)
• Output — CSV or JSON reports, regrouped across targets and methods; --hide masks passwords for demonstrations

Usage sketch

# Search a local directory of breach dumps for a domain's emails
h8mail -t "@$DOMAIN" -lb $BREACH_DIR/ -sk --loose
 
# Query APIs using a config file of keys
h8mail -t targets.txt -c h8mail_config.ini -o results.csv

-sk skips API queries and searches only local sources.

Role in the pipeline

Breached credentials are attack surface twice over: directly (password reuse — try them via hydra or credential stuffing) and as seed material — users repeat base-word patterns, so a target’s breached passwords make an unusually strong input to john-the-ripper’s rules or hashcat’s rule files for generating a targeted mutation list, alongside cupp-common-user-passwords-profiler and cewl-custom-wordlist-generator. For the email-enumeration side, h8mail complements theharvester.

Sources

• h8mail — Email OSINT and Password Breach Hunting Tool
• h8mail 2.5.6 — PyPI
• Have I Been Pwned

Related: theharvester, john-the-ripper, hashcat, hydra, cupp-common-user-passwords-profiler, cewl-custom-wordlist-generator