Giter VIP home page Giter VIP logo

pwned's Introduction

logo

pwned

A command-line tool for querying Troy Hunt's Have I been pwned? service using the hibp Node.js module.

npm Version Build Status Code Coverage

Installation

Download and install Node.js, then install pwned globally using npm:

npm install pwned -g

Alternatively, you can run it on-demand using the npx package runner:

npx pwned

Protected Commands

On July 18th, 2019, the haveibeenpwned.com API moved several services behind authentication, requiring an API key. See Troy's blog post for rationale and a full explanation. In order to use some of pwned commands (e.g. ba, pa, and search), you will need to get an API key and run pwned apiKey to configure pwned. The other commands do not require an API key and you may use them without obtaining one.

Usage

pwned <command>

Commands:
  pwned apiKey [key]            set the API key to be used for authenticated requests
  pwned ba <account|email>      get all breaches for an account (username or email address)
  pwned breach <name>           get a single breached site by breach name
  pwned breaches                get all breaches in the system
  pwned dc                      get all data classes in the system
  pwned pa <email>              get all pastes for an account (email address)
  pwned pw <password>           securely check a password for public exposure
  pwned search <account|email>  search breaches and pastes for an account (username or email
                                address)
  pwned subStatus               get the subscription status of your API key

Options:
  -h, --help     Show help                                                                 [boolean]
  -v, --version  Show version number                                                       [boolean]

Examples

Get all breaches for an account:

$ pwned ba [email protected]
✔ Good news — no pwnage found!

Get all breaches in the system, filtering results to just the 'adobe.com' domain:

$ pwned breaches -d adobe.com
-
  Title:        Adobe
  Name:         Adobe
  Domain:       adobe.com
  BreachDate:   2013-10-04
  AddedDate:    2013-12-04T00:00:00Z
  ModifiedDate: 2013-12-04T00:00:00Z
  PwnCount:     152445165
  Description:  In October 2013, 153 million Adobe accounts were breached with each containing an internal ID, username, email, <em>encrypted</em> password and a password hint in plain text. The password cryptography was poorly done and <a href="http://stricture-group.com/files/adobe-top100.txt" target="_blank" rel="noopener">many were quickly resolved back to plain text</a>. The unencrypted hints also <a href="http://www.troyhunt.com/2013/11/adobe-credentials-and-serious.html" target="_blank" rel="noopener">disclosed much about the passwords</a> adding further to the risk that hundreds of millions of Adobe customers already faced.
  DataClasses:
    - Email addresses
    - Password hints
    - Passwords
    - Usernames
  IsVerified:   true
  IsFabricated: false
  IsSensitive:  false
  IsActive:     true
  IsRetired:    false
  IsSpamList:   false
  LogoType:     svg

Get a single breached site by breach name:

$ pwned breach MyCompany
✔ No breach found by that name.

Get all the data classes in the system, returning raw JSON results for external/chained consumption:

$ pwned dc --raw
["Account balances","Address book contacts","Age groups","Ages","Apps installed on devices","Astrological signs","Auth tokens","Avatars","Bank account numbers","Banking PINs","Beauty ratings","Biometric data","Browser user agent details","Buying preferences","Car ownership statuses","Career levels","Cellular network names","Charitable donations","Chat logs","Credit card CVV","Credit cards","Credit status information","Customer feedback","Customer interactions","Dates of birth","Deceased date","Deceased statuses","Device information","Device usage tracking data","Drinking habits","Drug habits","Eating habits","Education levels","Email addresses","Email messages","Employers","Ethnicities","Family members' names","Family plans","Family structure","Financial investments","Financial transactions","Fitness levels","Genders","Geographic locations","Government issued IDs","Health insurance information","Historical passwords","Home ownership statuses","Homepage URLs","IMEI numbers","IMSI numbers","Income levels","Instant messenger identities","IP addresses","Job titles","MAC addresses","Marital statuses","Names","Nationalities","Net worths","Nicknames","Occupations","Parenting plans","Partial credit card data","Passport numbers","Password hints","Passwords","Payment histories","Payment methods","Personal descriptions","Personal health data","Personal interests","Phone numbers","Physical addresses","Physical attributes","Political donations","Political views","Private messages","Professional skills","Profile photos","Purchases","Purchasing habits","Races","Recovery email addresses","Relationship statuses","Religions","Reward program balances","Salutations","School grades (class levels)","Security questions and answers","Sexual fetishes","Sexual orientations","Smoking habits","SMS messages","Social connections","Social media profiles","Spoken languages","Support tickets","Survey results","Time zones","Travel habits","User statuses","User website URLs","Usernames","Utility bills","Vehicle details","Website activity","Work habits","Years of birth","Years of professional experience"]

Get all pastes for an email address:

$ pwned pa [email protected]
-
  Source:     Pastebin
  Id:         YrpQA60S
  Title:      null
  Date:       2018-01-24T07:54:15Z
  EmailCount: 16476
-
  Source:     Pastebin
  Id:         suPshHZ1
  Title:      null
  Date:       2017-09-06T03:41:33Z
  EmailCount: 20444
-
  Source:     Pastebin
  Id:         xyb8vavK
  Title:      null
  Date:       2015-06-01T00:16:46Z
  EmailCount: 8
-
  Source:     Pastebin
  Id:         DaaFj8Be
  Title:      CrackingCore - Redder04
  Date:       2015-04-05T22:22:39Z
  EmailCount: 116
-
  Source:     Pastebin
  Id:         9MAAgecd
  Title:      IPTV Yabancı Combolist
  Date:       2015-02-07T15:21:00Z
  EmailCount: 244
-
  Source:     Pastebin
  Id:         QMx1dPUT
  Title:      null
  Date:       2015-02-02T20:45:00Z
  EmailCount: 6607
-
  Source:     Pastebin
  Id:         zUFSee4n
  Title:      nethingoez
  Date:       2015-01-21T15:13:00Z
  EmailCount: 312
-
  Source:     AdHocUrl
  Id:         http://siph0n.in/exploits.php?id=4560
  Title:      BuzzMachines.com 40k+
  Date:       null
  EmailCount: 36959
-
  Source:     AdHocUrl
  Id:         http://siph0n.in/exploits.php?id=4737
  Title:      PayPalSucks Database 102k
  Date:       null
  EmailCount: 82071
-
  Source:     AdHocUrl
  Id:         http://balockae.online/files/BlackMarketReloaded_users.sql
  Title:      balockae.online
  Date:       null
  EmailCount: 10547

Securely check a password to see if it has been exposed in a data breach:

$ pwned pw Password1234
⚠ Oh no — pwned 3360 times!

Search both breaches and pastes for an account (truncating breach data):

$ pwned search nobody
breaches:
  -
    Name: BattlefieldHeroes
  -
    Name: CannabisForum
  -
    Name: Forbes
  -
    Name: Gawker
  -
    Name: HackForums
  -
    Name: LoungeBoard
  -
    Name: PokemonCreed
  -
    Name: Win7Vista
pastes:   null

License

This tool is distributed under the MIT License.

pwned's People

Contributors

dependabot[bot] avatar github-actions[bot] avatar renovate-bot avatar renovate[bot] avatar wkovacs64 avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

pwned's Issues

Failed to query

npx pwned

pwned

Commands:
pwned ba <account|email> get all breaches for an account (username or email address)
pwned breach get a single breached site by breach name
pwned breaches get all breaches in the system
pwned dc get all data classes in the system
pwned pa get all pastes for an account (email address)
pwned pw securely check a password for public exposure
pwned search <account|email> search breaches and pastes for an account (username or email
address)

Options:
-h, --help Show help [boolean]
-v, --version Show version number [boolean]

Not enough non-option arguments: got 0, need at least 1

npx pwned breach xxxx.com

✖ (0 , _hibp.breach) is not a function

pwned ba [email protected]

✖ (0 , _hibp.breachedAccount) is not a function

pwned-sqlite3

Hi,

I wanted to introduce my pwned-sqlite3 package to you.

Should we cross reference our products in the README.md?

cool

I like it, pretty useful ;)

apiKey command should prompt for input

I dislike the fact that the apiKey command takes the API key as a parameter because then it's likely to show up in your shell command history. It would be more secure if it prompted you for input instead, or at least as an alternative.

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

This repository currently has no open or pending branches.

Detected dependencies

github-actions
.github/workflows/ci.yml
  • actions/checkout v4
  • actions/setup-node v4
  • actions/checkout v4
  • actions/setup-node v4
  • actions/checkout v4
  • actions/setup-node v4
  • actions/checkout v4
  • actions/setup-node v4
  • codecov/codecov-action v4
  • actions/checkout v4
  • actions/setup-node v4
  • actions/checkout v4
  • actions/setup-node v4
  • changesets/action v1
npm
package.json
  • common-tags ^1.8.2
  • conf ^12.0.0
  • fs-extra 11.2.0
  • hibp ^14.0.0
  • ora ^8.0.0
  • prettyjson ^1.2.5
  • prompts 2.4.2
  • source-map-support ^0.5.21
  • yargs ^17.7.2
  • @babel/cli 7.24.5
  • @babel/core 7.24.5
  • @babel/parser 7.24.5
  • @babel/preset-env 7.24.5
  • @babel/preset-typescript 7.24.1
  • @changesets/changelog-github 0.5.0
  • @changesets/cli 2.27.1
  • @types/common-tags 1.8.4
  • @types/debug 4.1.12
  • @types/node 20.12.8
  • @types/prettyjson 0.0.33
  • @types/prompts 2.4.9
  • @types/ws 8.5.10
  • @types/yargs 17.0.32
  • @vitest/coverage-v8 1.6.0
  • @wkovacs64/prettier-config 3.0.3
  • cross-env 7.0.3
  • eslint 8.57.0
  • eslint-plugin-wkovacs64 16.2.0
  • msw 2.2.14
  • npm-run-all2 6.1.2
  • prettier 3.2.5
  • rimraf 5.0.5
  • type-fest 4.18.1
  • typescript 5.4.5
  • vitest 1.6.0
  • node >=18.0.0
  • typescript 5.4.5
nvm
.nvmrc
  • node 20

  • Check this box to trigger a request for Renovate to run again on this repository

IP(?) block

After the first query I got:

$ npx pwned ba [email protected]
npx: installed 85 in 9.007s
✖ Request blocked, contact haveibeenpwned.com if this continues (Ray ID: xxxxxxxxxxxxxxxx-BUD)

Maybe I'm really blocked? That was my first try :) If yes, I'm gonna reach hibp directly.

[OUTPUT] 'pwned pw' output cannot be redirected or piped in Bash

I use pwned into a set of tools and I need to parse all tools commands outputs.

When I run for example 'pwned ba email' I'm able to parse the result output correctly.
But, with the password option (pwned pw password) I cannot pipe or redirect anything, the output is always empty.

For example :

"pwned pw qwerty | grep -o 'times' " will not output grep results as expected.

"pwned pw qwerty &> /tmp/test" will results with an empty file.

I suspect that the cause of this issue is the special character present at the beginning of the output ( ⚠ or ✔ ) but I'm not sure.

I'm using Debian 9 stable and Bash as shell.

Hope you can reproduce the issue and find a reliable solution.

Action Required: Fix Renovate Configuration

There is an error with this repository's Renovate configuration that needs to be fixed. As a precaution, Renovate will stop PRs until it is resolved.

Error type: undefined. Note: this is a nested preset so please contact the preset author if you are unable to fix it yourself.

Error when running any command

Trying to run any command or even just "pwned" in the terminal results in the following error:

file:///usr/local/lib/node_modules/pwned/node_modules/conf/dist/source/index.js:109
                if (value?.default) {
                          ^

SyntaxError: Unexpected token '.'
    at Loader.moduleStrategy (internal/modules/esm/translators.js:133:18)

Yes, I've tried running using sudo and even root, but it still gives me the error.
I've also tried older versions of nodejs as it gives warnings that the nodejs version used in this code is waay outdates (like 4 entire versions back) with no result.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.