Versions 1 and 2 of the API for searching breaches and pastes by email address will be disabled in 4 weeks from today on August 18.

Entities

• cmlh.linkAnalysis
• cmlh.error
• haveibeenpwned.breach

Transform Sets

• Breached email addresses
• Pwned Passwords

Maltego Machines

• @HaveIBeenPwned Pwned Passwords
• @HaveIBeenPwned v3 E-Mail Address
• @HaveIBeenPwned Pwned Passwords

• Support hibp-api-key Request Header
• Support hibp-api-key Transform Setting
• Support "Have I Been Pwned?" API v3 "Get all breaches of an e-mail address"
• Support "Have I Been Pwned?" API v3 "Get all truncated breaches of an e-mail address"
• Support "Have I Been Pwned?" API v3 "Get all breaches of an alias"
• Support "Have I Been Pwned?" API v3 "Get all truncated breaches of an alias"
• Support "Have I Been Pwned?" API v3 "Get all pastes of an e-mail address"
• Support "Have I Been Pwned?" API v3 "Getting a single breached site"
• Support "Have I Been Pwned?" API v3 "Getting all breached sites in the system" domain parameter.
• Support "Have I Been Pwned?" API v3 "Getting all breached sites in the system"
• Support "Have I Been Pwned?" API v3 Transform Set
• Support "Have I Been Pwned?" API v3 Machines
• Insert Wiki Page

Support Pwned Passwords API v2 endpoint.

References

• https://www.troyhunt.com/introducing-306-million-freely-downloadable-pwned-passwords/
• https://haveibeenpwned.com/Passwords

Implementation

• maltego.Hash
• haveibeenpwned.Password

Versions 1 and 2 of the API for searching breaches and pastes by email address will be disabled in 4 weeks from today on August 18.

• Deprecate "Have I Been Pwned?" API v2 "Get all breaches of an e-mail address"
• Deprecate "Have I Been Pwned?" API v2 "Get all truncated breaches of an e-mail address"
• Deprecate "Have I Been Pwned?" API v2 "Get all breaches of an alias"
• Deprecate "Have I Been Pwned?" API v2 "Get all truncated breaches of an alias"
• Deprecate "Have I Been Pwned?" API v2 "Get all pastes of an e-mail address"
• Deprecate "Have I Been Pwned?" API v2 "Getting a single breached site"
• Deprecate "Have I Been Pwned?" API v2 "Getting all breached sites in the system" domain parameter.
• Deprecate "Have I Been Pwned?" API v2 "Getting all breached sites in the system"
• Deprecate "Have I Been Pwned?" API v2 Transform Set
• Deprecate "Have I Been Pwned?" API v2 Machines
• Insert Wiki Page

https://twitter.com/troyhunt/status/1688457030150062080
https://www.troyhunt.com/welcome-to-the-new-have-i-been-pwned-domain-search-subscription-service/
https://haveibeenpwned.com/API/v3?ref=troyhunt.com#MostRecentBreach

Support NTLM Hash as an Output Entity.

• Support Input NTLM Hash
• Return NTLM Hashes
• Publish Maltego Machine

https://haveibeenpwned.com/API/v3#PwnedPasswordsNTLM
https://twitter.com/troyhunt/status/1623594549733097472
https://www.troyhunt.com/pwned-passwords-adds-ntlm-support-to-the-firehose/

Available to Maltego Classic and [Maltego] XL are:

• All breaches for an account i.e. e-mail address and alias
• All pastes for an e-mail address
• https://haveibeenpwned.com/API/v3#AllDataClasses
• https://haveibeenpwned.com/API/v3#AllBreaches (with/without domain parameter)
• https://haveibeenpwned.com/API/v3#SingleBreach

Therefore, Maltego CE will be limited to

• https://haveibeenpwned.com/API/v3#AllBreaches (with domain parameter).
• https://haveibeenpwned.com/API/v3#SingleBreach

Refer to @troyhunt Blog Post for further information

Support NTLM Hash as an Input Entity.

https://haveibeenpwned.com/API/v3#PwnedPasswordsNTLM

Support Phone Number as an Input Entity when implemented in the upstream API.

Screenshot reproduced below from https://www.troyhunt.com/the-facebook-phone-numbers-are-now-searchable-in-have-i-been-pwned/

Hi, thanks for your awesome Maltego transform! Unfortunately, I have an issue with it. I have an email adress (available non-publicly on demand) that resolves in Maltego as not breached. If I input the address manually at haveibeenpwned.com, it is found in three breaches: exploit.in, Collection #1 and AntiPuiblic. I copied the address from maltogo to haveibeenpwned.com to avoid typos. I did it several times, first time togerther with other addresses that returned breach results. Secondly on its own, but the breaches are never found. Another email address returns the trillian breach but also ommits Collection #1.

When i launch the HIBP transform i get the error "responded with an HTTP 503, we wanted a 200!" is there a way to remove the popup form showing up and blocking my research?

https://twitter.com/troyhunt/status/1688457030150062080
https://www.troyhunt.com/welcome-to-the-new-have-i-been-pwned-domain-search-subscription-service/
https://haveibeenpwned.com/API/v3#BreachesForDomain