How to Exploit Recycled Credentials with H8mail to Break into User Accounts « Null Byte :: WonderHowTo

Many online users worry about their accounts being breached by some master hacker, but the more likely scenario is falling victim to a bot written to use leaked passwords in data breaches from companies like LinkedIn, MySpace, and Tumblr. For instance, a tool called H8mail can search through over 1 billion leaked credentials to discover passwords that might still be in use today.How Your Password Ends Up in a Data BreachData breaches frequently make headlines, but it's often not apparent to the users impacted how this puts them at risk. Breaches are not all the same and can contain anything from credit reports to a simple email address. The information in a breach can also be stored in different ways, with the worst-case scenario being passwords stored incleartext.The most common alternative to cleartext is storing the information as plaintext in a more secure form like a hash. Unfortunately, a hash does not solve the problem, because many hashes themselves can be brute-forced. Password breaches involving passwords hashed with SHA-1 can still reveal plaintext passwords if they're common or easy-to-guess passwords.Hackers take advantage of these issues by buying and selling lists of stolen user details, with credit card numbers and passwords at the top of the list. Over time, many of the most-traded lists become publicly known.Don't Miss:Use Leaked Password Databases to Create Brute-Force WordlistsIn one instance, a colossal aggregate file called the "Breach Compilatio" was discovered to hold 1.4 billion credentials from various company data breaches. Once leaked to the internet, its aggregated credentials database provided the foundation for widescreen exploitation of accounts belonging to the accounts of users who reuse passwords between accounts.Attacking Recycled Credentials with H8mailH8mail is a tool for finding plaintext passwords from this massive data breach using only a person's email. This is most useful when combined with OSINT tactics like finding all the email addresses in an organization using tools likeTheHarvester, then feeding the resulting list into H8mail. I found this to be extremely effective at finding plaintext passwords for at least one person in a large organization, and the passwords tended to be terrible.Don't Miss:Scrape Target Email Addresses with TheHarvesterroot@nickles:~/h8mail# python3 h8mail.py -t XXXXXXXXX@gmail.com -bc '/media/root/R3DL34D3R/BreachCompilation'  --local

        ._____. ._____.     ;___________;
        | ._. | | ._. |     ; h8mail.py ;
        | |_| |_|_|_| |     ;-----------;
        |___| |_______|  Heartfelt Email OSINT
        .___|_|_| |___.   Use responsibly etc
        | ._____| |_. | ;____________________;
        | |_| | | |_| | ; github.com/khast3x ;
        |_____| |_____| ;--------------------;

 Targets
----------

=> XXXXXXXXX@gmail.com

 Result XXXXXXXXX@gmail.com
-----------------------------

=> breached ✓
---
Breaches found HIBP: 0
Breaches found breachcompilation: 12
Target hostname: gmail.com

---
breachcompilation passwords: ssa123 123456789 18796-0em 1882564 3982262 6 6,91459E+11 asdf1234 jhedgeland kelly23 qwasqw12 rjyatnf777
-------------------------------

✓ DoneThe passwords stored in the database may be somewhat skewed towards bad passwords because data dumps with hashed passwords would likely still contain many passwords too strong to be easily brute-forced. Because of this, most of the email and password pairs extracted from hashed data breaches tend to be the absolute worst passwords.What You'll NeedTo use a tool like H8mail, we'll need the tool itself, and a data source. One perfectly acceptable way of using H8mail is to connect it to an API, but another is to download the entire breach compilation file and configure H8mail to search it locally.As I mentioned previously, the breach compilation database is 1.4 billion credentials organized into a list with no duplicated passwords and split into folders that make it easy and fast to search through. This database also forms the core of theHave I Been Pwneddatabase, although that service merely lets you know a breach has occurred on that email address and what the source of the breach is.Before we start, we'll need to have Python3 installed and be ready to install some prerequisites. I recommend usingKali Linux, and make sure to runapt getupdateto update your system before starting. If you don't, it could cause problems later in the installation.Step 1: Download H8mail & Data SourcesAfter navigating tothe GitHub repository, clone the repository with the following command.git clone https://github.com/khast3x/h8mail.gitYou'll need NodeJS installed for H8mail to work properly, so install it by typing the following in a terminal window.apt-get install nodejsNext, you'll need tochange the directoryto the one just downloaded, and then install the requirements with pip. I recommend using pip3, as pip3 did work for me while pip did not. To do so, type the following into a terminal window and wait for the requirements to finish installing.cd h8mail
pip3 install -r requirements.txtOnce the prerequisites are taken care of, you can run h8mail.py to see the options available. From inside the h8mail folder downloaded, run the Python script with the following command, which will bring up the help menu. Here, you'll see the options available in H8mail.python3 ./h8mail.py -h

python3 h8mail.py -h
usage: h8mail.py -h -t TARGET_EMAILS -c CONFIG_FILE -o OUTPUT_FILE
-bc BC_PATH -v -l -k CLI_APIKEYS

Email information and password finding tool

optional arguments:
-h, --help show this help message and exit
-t TARGET_EMAILS, --targets TARGET_EMAILS
Either single email, or file (one email per line).
REGEXP
-c CONFIG_FILE, --config CONFIG_FILE
Configuration file for API keys
-o OUTPUT_FILE, --output OUTPUT_FILE
File to write output
-bc BC_PATH, --breachcomp BC_PATH
Path to the breachcompilation Torrent.
[https://ghostbin.com/paste/2cbdn ]
-v, --verbose Show debug information
-l, --local Run local actions only
-k CLI_APIKEYS, --apikey CLI_APIKEYS
Pass config options. Format is "K:V,K:V"Step 2: Use H8mail Against a Single EmailWe'll be using the local option, which means downloading the breach compilation for this demonstration. If you prefer to use the API option, you'll need to followthe instructions on GitHubfor adding the API keys for whatever service you wish to use.Downloading the breach compilation is relatively easy to do and only took one Google search and torrenting a 44 GB magnet file. I won't link to the file directly, but any hacker worth their salt can find the breach compilation available from public sources. Once you have the breach compilation file, a basic search can be conducted by using the following string.python3 h8mail.py -t email@tosearch.com -bc 'location_of_your_file/BreachCompilation' --localThis calls Python3 to execute h8mail.py, with the arguments set for targetingemail@tosearch.comas the email for searching,bcfor breach compilation, and then the location of the breach compilation folder on your computer with--localat the end to denote that the files are saved locally. With this command, you can check any email address you want. If you get a hit, it looks like this:Targets
----------

=> aquaunitpatrolsquad@gmail.com

Result aquaunitpatrolsquad@gmail.com
---------------------------

=> breached ✓
---
Breaches found HIBP: 0
Breaches found breachcompilation: 1
Target hostname: gmail.com

---
breachcompilation passwords: handbanana tonight...you
-------------------------------

✓ DoneStep 3: Search for Passwords from Groups of Email AccountsNow that you can search for individual accounts, let's combine what you've learned inpreviousguidesto search for all the emails you can find for an organization. For my example, I'm using priceline.com. First, we'lluse TheHarvesterto gather email addresses from the priceline.com domain.Don't Miss:Use the Buscador OSINT VM for Conducting Online InvestigationsFor whatever reason, a sizable number of Priceline employees use PGP, so running TheHarvester against the PGP keyserver gave me enough email addresses to create a sizable list of company email addresses.theharvester -d priceline.com -l 1000 -b pgpAfter copying the list that is returned, you can create a target file by typing the following and then pasting the found emails into the text editor that opens.nano targets.txtOnce you've done this, typeCtrl-Xand selectYto save your changes, then you can run H8mail against all the emails in your target list at once. To do so, use the following command.python3 h8mail.py -t '/root/h8mail/targets.txt' -bc '~/BreachCompilation' --localThe command may take some time to complete. When it's done, you're likely to find at least some breached passwords from the list of employee emails. Stunningly, we didn't find any from the Priceline list, but if I did, I probably wouldn't be able to publish the results anyway.These examples are just the start of what you can do with H8mail, and you can use your imagination to think of how being able to search for passwords belonging to long lists of people's email addresses might be useful.Password Recycling Is the Biggest Threat to the Average UserNow that we've demonstrated how easy it is to use a list of organizational email addresses to search for password breaches, it's easy to see how important it is not to reuse passwords between websites. The biggest cause for concern is that some of your online accounts may use the same old passwords that have been breached already, opening you up to the risk of bots armed with your email address and an old password taking control of your online accounts.Don't Miss:Use Google's Advanced Protection Program for Extra SecurityThe best way to protect against this vulnerability is touse strong, unique passwordsfor each website. This also means not using patterns that are predictable, because often there are multiple breached passwords for a single email address, meaning a hacker will know if there is an obvious pattern to your passwords.Password managers likeLastPasscan help create and store strong passwords, and the ultimate way of defending against these attacks istwo-factor authentication, preferablywith a hardware key. By using aFIDO security key, any device wanting to log into your account and knowing your password will still need the physical key to log in, making the password the attacker has much less useful.You canset up two-factor authenticationon most online accounts, and I highly recommend doing so if you've been guilty of the bad habit of reusing passwords. Between two-factor authentication and using password managers to maintain and remember strong, unique passwords, the average user can reduce their risk substantially against this kind of attack.I hope you enjoyed this guide to using H8mail to find breached passwords belonging to a targeted email! If you have any questions about this tutorial on H8mail or you have a comment, feel free to reach me in the comments below or on Twitter@KodyKinzie.Buy on Amazon:Feitian MultiPass FIDO Security KeyFollow Null Byte onTwitter,Flipboard, andYouTubeSign up forNull Byte's weekly newsletterFollow WonderHowTo onFacebook,Twitter,Pinterest, andFlipboardWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image by Kody/Null ByteRelatedHack Like a Pro:Metasploit for the Aspiring Hacker, Part 8 (Setting Up a Fake SMB Server to Capture Domain Passwords)How To:Extract Windows Usernames, Passwords, Wi-Fi Keys & Other User Credentials with LaZagneHow To:Protect Yourself from the Biggest Jailbreak Hack in HistoryHow To:Steal Usernames & Passwords Stored in Firefox on Windows 10 Using a USB Rubber DuckyHow To:Set Up Multiple User Profiles on Your Galaxy S5—Or Any Other Android PhoneHow To:Add & Use More Accounts on Instagram for Easy Profile SwitchingNews:How Spammers Can Steal Your Personal Info from SnapchatHow To:Delete Your Bumble Account (Or Snooze It)Hack Like a Pro:Remotely Add a New User Account to a Windows Server 2003 BoxHow To:Hack a Hard Drive into a Hidden Flash Drive, Cell Phone Charger & More!How to Meterpreter:Obtaining User Credentials with PowerShellHacking Windows 10:How to Steal & Decrypt Passwords Stored in Chrome & Firefox RemotelyHow To:Hack WPA/WPA2-Enterprise Part 1How To:You Can Easily Hack Instagram for a Crazy Amount of Likes (But You Totally Shouldn't)News:Encryption Is Not Enough !, Research & Conclusion (Part 1)How To:Manage Stored Passwords So You Don't Get HackedNews:Flaw in Facebook & Google Allows Phishing, Spam & MoreSocial Engineering, Part 2:Hacking a Friend's Facebook PasswordHow To:Advanced Social Engineering, Part 2: Hack Google Accounts with a Google Translator ExploitHow To:Unban Your Xbox LIVE Account That is Banned Until 12/31/9999 by Tricking Microsoft's Banning SystemHow To:Get Free Netflix for LifeGoodnight Byte:HackThisSite Walkthrough, Part 9 - Legal Hacker TrainingNews:Mark and Joe Build a Spaceship - Ultra Recycling!Community Byte:HackThisSite Walkthrough, Part 3 - Legal Hacker TrainingHow To:Hack Mac OS X Lion PasswordsMastering Security, Part 1:How to Manage and Create Strong PasswordsForbes Exploited:XSS Vulnerabilities Allow Phishers to Hijack Sessions & Steal LoginsNews:Advanced Cracking Techniques, Part 1: Custom DictionariesHow To:Remove a Windows Password with a Linux Live CDNews:Recycle from ClothingNews:Recycle books as plantersNews:Remote Chrome Password StealerRoot Exploit:Memodipper Gets You Root Access to Systems Running Linux Kernel 2.6.39+Goodnight Byte:HackThisSite Walkthrough, Part 7 - Legal HackerNews:Eco Friendly Window TreatmentsNews:Recycled BrideNews:Update Facebook from Google+ without an extensionHow To:Is Your Website Vulnerable to XSS Injections? Here's How to Protect Your VisitorsCommunity Byte:HackThisSite Walkthrough, Part 6 - Legal Hacker Training