osint-email

What this skill does

Collects OSINT information based on an email address. Performs email format validation, breach history lookup via the Have I Been Pwned API, and social/service account existence detection using holehe.

When to use

• Checking an email's exposure history before phishing simulations
• Verifying whether employee emails were included in data breaches
• Assessing social engineering attack potential
• Auditing the digital footprint of an individual or organization

Prerequisites

• Install curl
• Install holehe (social account checking):

  pip install holehe
  

• Obtain a Have I Been Pwned API key: https://haveibeenpwned.com/API/Key
• Set environment variables:
  • SECSKILL_TARGET_EMAIL: email address to query
  • SECSKILL_HIBP_API_KEY: Have I Been Pwned API key

Inputs

Variable	Required	Description
SECSKILL_TARGET_EMAIL	Required	Email address to query
SECSKILL_HIBP_API_KEY	Required	HIBP API key (for breach history lookup)
SECSKILL_OUTPUT_DIR	Optional	Output directory for results (default: ./output)
SECSKILL_RUN_HOLEHE	Optional	Set to true to run holehe (default: false)

Workflow

Step 1: Email format validation

export EMAIL="${SECSKILL_TARGET_EMAIL:?Set the SECSKILL_TARGET_EMAIL environment variable}"
export HIBP_KEY="${SECSKILL_HIBP_API_KEY:-}"
export OUTDIR="${SECSKILL_OUTPUT_DIR:-./output}"
export RUN_HOLEHE="${SECSKILL_RUN_HOLEHE:-false}"
mkdir -p "$OUTDIR"

SAFE_EMAIL=$(echo "$EMAIL" | tr '@.' '__')
OUTFILE="$OUTDIR/osint_email_${SAFE_EMAIL}.txt"

echo "===== Email OSINT: $EMAIL =====" > "$OUTFILE"
echo "Query time: $(date -u '+%Y-%m-%dT%H:%M:%SZ')" >> "$OUTFILE"

# Format validation
if echo "$EMAIL" | grep -qE '^[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}$'; then
  echo "[+] Valid email format: $EMAIL" | tee -a "$OUTFILE"
  DOMAIN=$(echo "$EMAIL" | cut -d'@' -f2)
  USER=$(echo "$EMAIL" | cut -d'@' -f1)
  echo "[*] Domain: $DOMAIN | User: $USER"
else
  echo "[-] Invalid email format: $EMAIL"
  exit 1
fi