infobyte / emploleaks

An OSINT tool that helps detect members of a company with leaked credentials

🔎 EmploLeaks

This is a tool designed for Open Source Intelligence (OSINT) purposes, which helps to gather information about employees of a company.

🚀 How it Works

The tool starts by searching through LinkedIn to obtain a list of employees of the company. Then, it looks for their social network profiles to find their personal email addresses. Finally, it uses those email addresses to search through a custom COMB database to retrieve leaked passwords. You an easily add yours and connect to through the tool.

💻 Installation

To use this tool, you'll need to have Python 3.10 installed on your machine. Clone this repository to your local machine and install the required dependencies using pip in the cli folder:

cd cli
pip install -r requirements.txt

OSX

We know that there is a problem when installing the tool due to the psycopg2 binary. If you run into this problem, you can solve it running:

cd cli
python3 -m pip install psycopg2-binary`

📈 Basic Usage

To use the tool, simply run the following command:

python3 cli/emploleaks.py

If everything went well during the installation, you will be able to start using EmploLeaks:

___________              .__         .__                 __
\_   _____/ _____ ______ |  |   ____ |  |   ____ _____  |  | __  ______
 |    __)_ /     \____  \|  |  /  _ \|  | _/ __ \__   \ |  |/ / /  ___/
 |        \  Y Y  \  |_> >  |_(  <_> )  |_\  ___/ / __ \|    <  \___ \
/_______  /__|_|  /   __/|____/\____/|____/\___  >____  /__|_ \/____  >
        \/      \/|__|                         \/     \/     \/     \/

OSINT tool 🕵  to chain multiple apis
emploleaks>

Right now, the tool supports two functionalities:

• Linkedin, for searching all employees from a company and get their personal emails.
  • A GitLab extension, which is capable of finding personal code repositories from the employees.
• If defined and connected, when the tool is gathering employees profiles, a search to a COMB database will be made in order to retrieve leaked passwords.

Retrieving Linkedin Profiles

First, you must set the plugin to use, which in this case is linkedin. After, you should set your authentication tokens and the run the impersonate process:

emploleaks> use --plugin linkedin
emploleaks(linkedin)> setopt JSESSIONID
JSESSIONID: 
[+] Updating value successfull
emploleaks(linkedin)> setopt li-at
li-at: 
[+] Updating value successfull
emploleaks(linkedin)> show options
Module options:

Name        Current Setting                      Required    Description
----------  -----------------------------------  ----------  -----------------------------------
hide        yes                                  no          hide the JSESSIONID field
JSESSIONID  **************************           no          active cookie session in browser #1
li-at       AQEDAQ74B0YEUS-_AAABilIFFBsAAAGKdhG  no          active cookie session in browser #1
            YG00AxGP34jz1bRrgAcxkXm9RPNeYIAXz3M
            cycrQm5FB6lJ-Tezn8GGAsnl_GRpEANRdPI
            lWTRJJGF9vbv5yZHKOeze_WCHoOpe4ylvET
            kyCyfN58SNNH
emploleaks(linkedin)> run impersonate
[+] Using cookies from the browser
Setting for first time JSESSIONID
Setting for first time li_at

li_at and JSESSIONID are the authentication cookies of your LinkedIn session on the browser. You can use the Web Developer Tools to get it, just sign-in normally at LinkedIn and press right click and Inspect, those cookies will be in the Storage tab.

Now that the module is configured, you can run it and start gathering information from the company:

emploleaks(linkedin)> run find EvilCorp
⠙ Gathering Information[+] Added 1 new names.
💻 Listing profiles:
 0: 
	full name: Joaquin Rodriguez Viruliento
	profile name: joaquinrodriguezviruliento
	occupation: Security Researcher at EvilCorp
	public identifier: joaquinrodriguezviruliento
	urn: urn:li:member:15736913
✔ Getting and processing contact info of "Joaquin Rodriguez Viruliento"
	Contact info:
		website 0. http://www.evilcorp.com
		twitter 0. limpiamicerca

✔ Done

Get Linkedin accounts + Leaked Passwords

We created a custom workflow, where with the information retrieved by Linkedin, we try to match employees' personal emails to potential leaked passwords. In this case, you can connect to a database (in our case we have a custom indexed COMB database) using the connect command, as it is shown below:

emploleaks(linkedin)> connect --user myuser --passwd mypass123 --dbname mydbname --host 1.2.3.4
[+] Connecting to the Leak Database...
[*] version: PostgreSQL 12.15

Once it's connected, you can run the workflow. With all the users gathered, the tool will try to search in the database if a leaked credential is affecting someone:

emploleaks(linkedin)> run_pyscript workflows/check_leaked_passwords.py EvilCorp
[-] Failing login... trying again!
[-] Failing login... trying again!
[+] Connected to the LinkedIn api successfull
The following command could take a couple of minutes, be patient
 Listing profiles:
✔ Getting and processing contact info of "señor girafales"
✔ Getting and processing contact info of "kiko"
✔ Getting and processing contact info of "el chavo del 8"
[...]
[+] Password for "señor girafales" exists
[*] Email: [email protected]
+------------------+
| passwords leaked |
+------------------+
| laFQqAOSL69      |
+------------------+

As a conclusion, the tool will generate a console output with the following information:

• A list of employees of the company (obtained from LinkedIn)
• The social network profiles associated with each employee (obtained from email address)
• A list of leaked passwords associated with each email address.

📰 How to build the indexed COMB database

An imortant aspect of this project is the use of the indexed COMB database, to build your version you need to download the torrent first. Be careful, because the files and the indexed version downloaded requires, at least, 400 GB of disk space available.

Once the torrent has been completelly downloaded you will get a file folder as following:

├── count_total.sh
├── data
│   ├── 0
│   ├── 1
│   │   ├── 0
│   │   ├── 1
│   │   ├── 2
│   │   ├── 3
│   │   ├── 4
│   │   ├── 5
│   │   ├── 6
│   │   ├── 7
│   │   ├── 8
│   │   ├── 9
│   │   ├── a
│   │   ├── b
│   │   ├── c
│   │   ├── d
│   │   ├── e
│   │   ├── f
│   │   ├── g
│   │   ├── h
│   │   ├── i
│   │   ├── j
│   │   ├── k
│   │   ├── l
│   │   ├── m
│   │   ├── n
│   │   ├── o
│   │   ├── p
│   │   ├── q
│   │   ├── r
│   │   ├── s
│   │   ├── symbols
│   │   ├── t

At this point, you could import all those files with the command create_db:

emploleaks> create_db --dbname leakdb --user leakdb_user --passwd leakdb_pass --comb /home/pasta/Downloads/comb
[*] The full database occups more than 200 GB, take this in account
[*] Creating the database
ERROR:  database "leakdb" already exists
ERROR:  role "leakdb_user" already exists 
ALTER ROLE
ALTER DATABASE
GRANT
ALTER SYSTEM
ALTER SYSTEM
ALTER SYSTEM
ALTER SYSTEM
ALTER SYSTEM
ALTER SYSTEM
ALTER SYSTEM
ALTER SYSTEM
ALTER SYSTEM
ALTER SYSTEM
[+] Connecting to the Leak Database...
[+] Importing from /home/pasta/Downloads/comb/data/1/m
[+] Importing from /home/pasta/Downloads/comb/data/1/d
[+] Importing from /home/pasta/Downloads/comb/data/1/v
[+] Importing from /home/pasta/Downloads/comb/data/1/0
[+] Importing from /home/pasta/Downloads/comb/data/1/8
[+] Importing from /home/pasta/Downloads/comb/data/1/u
[+] Importing from /home/pasta/Downloads/comb/data/1/k
[+] Importing from /home/pasta/Downloads/comb/data/1/r
[+] Importing from /home/pasta/Downloads/comb/data/1/7
[+] Importing from /home/pasta/Downloads/comb/data/1/h
[+] Importing from /home/pasta/Downloads/comb/data/1/o
[+] Importing from /home/pasta/Downloads/comb/data/1/t
[+] Importing from /home/pasta/Downloads/comb/data/1/f
[+] Importing from /home/pasta/Downloads/comb/data/1/n
[+] Importing from /home/pasta/Downloads/comb/data/1/symbols
[+] Importing from /home/pasta/Downloads/comb/data/1/g
[+] Importing from /home/pasta/Downloads/comb/data/1/q
[+] Importing from /home/pasta/Downloads/comb/data/1/a
[+] Importing from /home/pasta/Downloads/comb/data/1/e
[+] Importing from /home/pasta/Downloads/comb/data/1/l                            
[+] Importing from /home/pasta/Downloads/comb/data/1/y                            
[+] Importing from /home/pasta/Downloads/comb/data/1/s                            
[+] Importing from /home/pasta/Downloads/comb/data/1/3                            
[+] Importing from /home/pasta/Downloads/comb/data/1/6                            
[*] Creating index... 

The importer takes a lot of time for that reason we recommend to run it with patience.

📌 Next Steps

We are integrating other public sites and applications that may offer about a leaked credential. We may not be able to see the plaintext password, but it will give an insight if the user has any compromised credential:

• Integration with Have I Been Pwned?
• Integration with Firefox Monitor
• Integration with Leak Check
• Integration with BreachAlarm

Also, we will be focusing on gathering even more information from public sources of every employee. Do you have any idea in mind? Don't hesitate to reach us:

• Javi Aguinaga: [email protected]
• Gabi Franco: [email protected]

Or you con DM at @pastacls or @gaaabifranco on Twitter.

📝 License

This tool is licensed under the MIT License. See the LICENSE file for more information.

emploleaks's Issues

Issues with module "cmd2"

Hello,

First of all, thank you for sharing this tool, looks like interesting.

I was trying to test this tool, but seems when I try to run, I receive an output regarding a missing modulde:

python3 cli/emploleaks.py

However, as you can see, module it´s already installed, along with the other requirements:

C:\Users\usuario.regular\Desktop\emploleaks>pip3 list installed
Package Version

---

altgraph 0.17.3
attrs 23.1.0
beautifulsoup4 4.12.2
certifi 2023.5.7
cffi 1.15.1
charset-normalizer 3.1.0
cmd2 2.4.3
colorama 0.4.6
coloramma 4.5
cryptography 39.0.1
fernet 1.0.1
halo 0.0.31
idna 3.4
linkedin-api 2.0.1
log-symbols 0.0.14
lxml 4.9.2
Naked 0.1.32
oauthlib 3.2.2
pefile 2023.2.7
pip 23.2.1
prettytable 3.7.0
psycopg2 2.9.6
pyaes 1.6.1
pycparser 2.21
pycryptodome 3.17
pygrabshot 1.0.2
pyinstaller 5.13.0
pyinstaller-hooks-contrib 2023.6
pynput 1.7.6
pyperclip 1.8.2
pypiwin32 223
pyreadline3 3.4.1
python-cryptography-fernet-wrapper 1.0.4
pywin32 305
pywin32-ctypes 0.2.2
PyYAML 6.0
requests 2.31.0
requests-oauthlib 1.3.1
setuptools 65.5.0
shellescape 3.8.1
six 1.16.0
soupsieve 2.4.1
spinners 0.0.24
tabulate 0.9.0
termcolor 2.3.0
tweepy 4.14.0
urllib3 2.0.2
wcwidth 0.2.6

Environment:
Windows 11 x64 21H2
Python 3.11.4

I also tried pip3 install -r requirements.txt, and we I don´t see any error.

Anyway, I was able to reproduce this same issue on Linux Mint 21.1 (Vera) with python 3.10.12:

Regards.

FEATURE - Detect companies in Linkedin/Apollo without Security hire

Report as an issue when a company doesn't have any job description about security head security, ciso, security,etc

Company Name does not exist on LinkedIn

Hello,

I've configured the module as described with JSESSIONID and li-at. However, whenever i'm trying to run command "run find CompanyName", it shows company name does not exist on LinkedIn.

Could you please help?

Unable to login to LinkedIn

When attempting to follow the steps in the readme, I enter my credentials as instructed and perform "run login" to see the following result:

emploleaks(linkedin)> run login
[-] LinkedIn has a message for you that you need to address.
[*] Please log in using a web browser first, and then come back and try again.
[-] Session could not be established.

I then open LinkedIn in my browser and see no message. I log out and back in and get the same result. I log in on other browsers on my machine, and get the same result.

I have "set debug true" but do not see any additional debug information regarding the problem establishing a session. I do have 2FA enabled, but I have it set to an authenticator app which generates a code.

I am running on an Intel MacBook Pro, Mac OS 13.4.1 (c) (22F770820d), Python 3.10.12 from homebrew, and I had to modify the requirements.txt to "psycopg2-binary==2.9.6" in order to be able to install. I plan on testing this on my M2 machine tomorrow to see if there is any difference.

Please let me know if there are any additional details needed.

What I should do?

emploleaks(linkedin)> run find

[-] Yikes, got an HTTP 400. This is not normal
Bailing from loops, but you should troubleshoot.
💻 Listing profiles:
emploleaks(linkedin)>

How to set output file and output format?

Unexpected HTTP response code 500 when trying to get the company info: the company name does not exist at LinkedIn

I'm getting an error after running a scan. It finds the employees just fine now but if I run another scan I am getting this http 500 error. Could just be that i am making to many requests?

Do I have to run this find command first to get the list and then run the workflow next? or can I just run the workflow on its own?

Thanks!

HTTP 400

Error message when using 'run find companyname'

[-] Yikes, got an HTTP 400. This is not normal
Bailing from loops, but you should troubleshoot.
💻 Listing profiles:

Not sure what to troubleshoot. impersonation seems to be working and this error comes when it starts hitting the LI API.

Export support for json/xml

Support for Apollo.io for guessing information/email

Exception triggered when executing 'run find'

When I try to make a 'run find [company]', I get this error:

emploleaks(linkedin)> run find faraday
⠸ Gathering Information[+] Added 25 new names.
⠹ Gathering Information[+] Added 25 new names.
⠸ Gathering Information[+] Added 25 new names.
⠧ Gathering Information[+] Added 25 new names.
⠏ Gathering Information[+] Added 25 new names.
⠏ Gathering Information[+] Added 25 new names.
⠇ Gathering Information[+] Added 25 new names.
⠧ Gathering Information[+] Added 25 new names.
⠏ Gathering Information[+] Added 25 new names.
⠏ Gathering Information[+] Added 25 new names.
⠏ Gathering Information[+] Added 25 new names.
⠇ Gathering Information[+] Added 25 new names.
⠧ Gathering Information[+] Added 25 new names.
⠴ Gathering Information[+] Added 25 new names.
⠸ Gathering Information[+] Added 25 new names.
⠙ Gathering Information[+] Added 25 new names.
⠋ Gathering Information[+] Added 25 new names.
⠇ Gathering Information[+] Added 25 new names.
⠦ Gathering Information[+] Added 25 new names.
⠦ Gathering Information[+] Added 25 new names.
⠴ Gathering Information[+] Added 25 new names.
⠸ Gathering Information[+] Added 25 new names.
⠦ Gathering Information[+] Added 25 new names.
⠴ Gathering Information[+] Added 25 new names.
⠸ Gathering Information[+] Added 25 new names.
⠇ Gathering InformationTraceback (most recent call last):
  File "/opt/homebrew/lib/python3.10/site-packages/cmd2/cmd2.py", line 2399, in onecmd_plus_hooks
    stop = self.onecmd(statement, add_to_history=add_to_history)
  File "/opt/homebrew/lib/python3.10/site-packages/cmd2/cmd2.py", line 2850, in onecmd
    stop = func(statement)
  File "/Users/0x1gab/Desktop/tools/emploleaks/cli/emploleaks.py", line 98, in wrapper
    func(*args)
  File "/Users/0x1gab/Desktop/tools/emploleaks/cli/emploleaks.py", line 265, in do_run
    profiles = self.plugin_instance.do_loops(found_id, outer_loops, depth)
  File "/Users/0x1gab/Desktop/tools/emploleaks/cli/plugins/linkedin.py", line 139, in do_loops
    found_profiles = self.find_employees(result.text)
  File "/Users/0x1gab/Desktop/tools/emploleaks/cli/plugins/linkedin.py", line 197, in find_employees
    'occupation': profile['occupation'],
KeyError: 'occupation'
EXCEPTION of type 'KeyError' occurred with message: 'occupation

feature request for twitter plugin

Hi, I thought that the twitter version could be useful

Could you add this plugin?

Creating index Error

This is the error I got after waiting a hour + for the COMB to import lol. I am running kali linux. The data folder does exist.

By the way. Do i have to import this COMB each time or where do I find it at on my linux system?

TypeError

Traceback (most recent call last):
File "/usr/lib/python3/dist-packages/cmd2/cmd2.py", line 2399, in onecmd_plus_hooks
stop = self.onecmd(statement, add_to_history=add_to_history)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/cmd2/cmd2.py", line 2852, in onecmd
stop = func(statement)
^^^^^^^^^^^^^^^
File "/root/Documents/emploleaks/cli/emploleaks.py", line 109, in wrapper
func(*args)
File "/root/Documents/emploleaks/cli/emploleaks.py", line 305, in do_run
style(f"\n{self.emojis['check']} Done", fg='green')
File "/usr/lib/python3/dist-packages/cmd2/ansi.py", line 1004, in style
raise TypeError("fg must be a subclass of FgColor")
TypeError: fg must be a subclass of FgColor

I get this error running as a regular user as well. I tried to set debug true but didn't help.

Where do we find the databases that are made using the create_db? So that I can delete the databases off of the hard drive and start over? I believe I used up a lot of space trying to get the comb going. I had it going but I would still get this error.

Could not find that company name

If it doesn't find a company name the tool gets stuck on
Gathering information and will let you use other commands still.

Only way to get out of that bug is type "quit" but then you have to start the tool up again.

Plugin Emploleak for github.com/infobyte/faraday-plugins