Lesson 19: Finding Emails, Passwords & More
In the previous lecture, you learned how to check if an email is in a data breach using Have I Been Pwned?. Now, we'll focus on extracting leaked information from databases.
Using DHashed
DHashed (dhashed.com) is a powerful search engine for querying data breaches and leaks. It allows searches by name, email, phone, username, IP, address, VIN, and more — not limited to emails.
Downside: It's a paid service (affordable for OSINT: $5.50/week, $15/month, $180/year). Free alternatives will be covered later.
Setup: Create an account and subscribe to access searches.
Search fields: Email, username, IP, name, address, phone, VIN, or domain scan.
Example: Searching for "Zaid Sabih" (using quotes for exact match) yielded 3 results:
- First: Unrelated, but linked email
ghostofthematrix@yahoo.comassociated with name in mindjolt.com breach. Includes IP, username "Zaid Sabih", and another emailzaidazad@yahoo.com. - Third: Relevant —
zaid@zsecurity.org, name "Zaid Sabih", hashed password, and IP address.
Follow-Up Analysis
IP Lookup: Paste the IP into an IP lookup tool (e.g., first Google result). Revealed Dublin, Ireland — matching ZSecurity's location (verified via Google: "zsecurity dublin").
Cross-Check with HIBP: The email zaid@zsecurity.org was in one breach (promo.com), confirming the data source.
Further Search: Search the email in DHashed: 18 results, revealing multiple passwords (e.g., unique ones like variations with "++"). Note them in your notepad.
IP from Another Result: One IP traced to Jordan; associated username "Zeus".
Verify Username: Google "zsecurity zeus" → Leads to ZLogger tool and Zaid's GitHub (username "zeus" confirms link).
Password Search Tip: Search a unique password in DHashed: 9 results, including the same email but with @gmail.com variant — a new email to note.
This methodology works for any target (e.g., Rishi Cabra could reveal phone, address, SSN, plain-text passwords). We'll cover archived sites in future lectures.