Email Intelligence

# theHarvester - comprehensive harvesting
theHarvester -d target.com -b all
theHarvester -d target.com -b google,linkedin,twitter,bing
theHarvester -d target.com -b all -l 500  # Limit results

# Search specific sources
theHarvester -d target.com -b linkedin   # LinkedIn profiles
theHarvester -d target.com -b hunter     # Hunter.io (needs API)
theHarvester -d target.com -b anubis     # Anubis DB

# EmailFinder
emailfinder -d target.com

# Infoga
python infoga.py --domain target.com --source all
python infoga.py --info email@target.com  # Single email lookup

# h8mail for breach data
h8mail -t email@target.com
h8mail -t target.com -c h8mail_config.ini  # With API keys

# Hunter.io API (free tier: 25 searches/month)
# Domain search - find all emails for a domain
curl "https://api.hunter.io/v2/domain-search?domain=target.com&api_key=YOUR_KEY"

# Email finder - find specific person's email
curl "https://api.hunter.io/v2/email-finder?domain=target.com&first_name=John&last_name=Smith&api_key=YOUR_KEY"

# Email verifier - check if email exists
curl "https://api.hunter.io/v2/email-verifier?email=john@target.com&api_key=YOUR_KEY"

# Snov.io API
curl "https://api.snov.io/v1/get-domain-emails-with-info" \
  -d "domain=target.com" \
  -d "type=all" \
  -d "access_token=YOUR_TOKEN"

# Clearbit (enrichment)
curl "https://person.clearbit.com/v2/people/find?email=john@target.com" \
  -H "Authorization: Bearer YOUR_KEY"

# Phonebook.cz - free (use browser or scrape)
# https://phonebook.cz - search domain for emails

# Common email naming conventions:
# first.last@company.com     (john.smith@target.com)
# flast@company.com          (jsmith@target.com)
# firstl@company.com         (johns@target.com)
# first_last@company.com     (john_smith@target.com)
# first@company.com          (john@target.com)
# last.first@company.com     (smith.john@target.com)
# lastf@company.com          (smithj@target.com)

# Generate email list from names using CrossLinked
crosslinked -f '{first}.{last}@target.com' "Target Company"
crosslinked -f '{f}{last}@target.com' "Target Company"

# linkedin2username - scrapes LinkedIn for employee names
python linkedin2username.py -u USERNAME -c "Target Company" -s "target.com"

# Manual format testing (be careful - can alert target)
# Use email verification services or check responses

# Email permutator tools
# https://github.com/jakehaddard/email-permutator
# https://metricsparrow.com/toolkit/email-permutator/

# Have I Been Pwned - check if email was in breaches
# Website: https://haveibeenpwned.com
# API (requires subscription for domain search)
curl "https://haveibeenpwned.com/api/v3/breachedaccount/email@target.com" \
  -H "hibp-api-key: YOUR_KEY"

# h8mail with local breach compilation
h8mail -t target.com -lb /path/to/breach_compilation/

# h8mail with APIs configured
h8mail -t email@target.com -c config.ini

# DeHashed (subscription required)
# https://dehashed.com - search by email, domain, username

# IntelX (Intelligence X)
# https://intelx.io - comprehensive breach search

# Snusbase
# https://snusbase.com - breach data search

# LeakCheck
# https://leakcheck.io - check email/username against leaks

# Check specific breaches via HIBP
curl "https://haveibeenpwned.com/api/v3/breach/Adobe" -H "hibp-api-key: KEY"

# SMTP verification (may be logged/blocked)
# Check MX records first
dig target.com MX +short

# Manual SMTP check
nc -v mail.target.com 25
HELO test.com
MAIL FROM:<test@test.com>
RCPT TO:<target@target.com>
# 250 = exists, 550 = doesn't exist, 252 = can't verify

# Python email verifier script
python3 << 'EOF'
import smtplib
import dns.resolver

def verify_email(email):
    domain = email.split('@')[1]
    records = dns.resolver.resolve(domain, 'MX')
    mx_host = str(records[0].exchange)
    
    server = smtplib.SMTP(timeout=10)
    server.connect(mx_host)
    server.helo('verify.com')
    server.mail('verify@verify.com')
    code, msg = server.rcpt(email)
    server.quit()
    return code == 250

# verify_email('john@target.com')
EOF

# Online verification services (safer)
# https://hunter.io/email-verifier
# https://www.emailhippo.com/
# https://www.zerobounce.net/

# Search for emails on target site
site:target.com "@target.com"
site:target.com "email" | "contact"

# Search documents for emails
site:target.com filetype:pdf "@target.com"
site:target.com filetype:doc "@target.com"
site:target.com filetype:xls "@target.com"

# LinkedIn email hunting
site:linkedin.com "@target.com"
site:linkedin.com "target company" email

# GitHub leaks
site:github.com "@target.com"
site:github.com "target.com" password | api_key

# Pastebin leaks
site:pastebin.com "@target.com"
site:pastebin.com "target.com" email

# Conference presentations
site:slideshare.net "@target.com"
site:speakerdeck.com "@target.com"

# Support forums
site:stackoverflow.com "@target.com"
site:reddit.com "@target.com"