webbreacher / whatsmyname

This repository has the JSON file required to perform user enumeration on various websites.

WhatsMyName

What is WhatsMyName? It is a project that Micah "WebBreacher" Hoffman created in 2015 with the goal of discovering if usernames were used on a given website. He was frustrated with the false positives that were present in the username checkers of that time and so he made his own. Fast forward to today and many people have helped this open-source project evolve into what it is today.

If you are an OSINT person that has come here to run the tool, well, you are probably a bit disappointed right now. In May 2023, we decided to remove all checker scripts from the project and just focus on the project's core; its data file (wmn-dat.json).

So, we will keep finding sites and adding them and you can feel free to try any of the checker sites and scripts below that use our data.

How Does It Work?

WhatsMyName (WMN) consists of a JSON file with detections in it. Submissions from people all over the world are included. When a request is made to one of those sites from a tool like the ones in the next section, the server replies with data that will match one of our detections. It'll tell the checker script whether there is a valid user account with the name we specified on their site or not.

For a site to be included in WMN it has to:

1. Be accessible. We cannot check sites behind paywalls or user authentication.
2. Put the username in the URL. If the URL to view a user's profile does not have that username in it, this tool won't work.
3. Not modify the username in the URL. URLs that have added user ID numbers to the username will not work in WMN. Also, sites that take your username and map it to a user ID number and then put that in the URL will not work.

Tools/Web Sites Using WhatsMyName

• https://whatsmyname.app/ - Chris Poulter created this site which draws the project's JSON file into an easy to use web interface.
  • Filters for category and in search results.
  • Exports to CSV and other formats.
  • Pulls the latest version of the project's JSON file when run.
  • Submit a username in the URL using https://whatsmyname.app/?q=USERNAME like https://whatsmyname.app/?q=john
• Blackbird uses the Whats My Name list in its search.
• K2OSINT Bookmarklet - Bookmarklet that lets you enter a username in a popup and then opens a new tab with the WMN results.
• LinkScope uses this in the Whats My Name resolution under the Online Identity category.
• Maltego WhatsMyName Transforms - Maltego Local Transforms that leverage the JSON file and check for usernames in real time.
• Reveal My Name is created by @yooper and is the Python checker tool that was bundled with this project.
• sn0int downloads and uses the JSON file in the kpcyrd/whatsmyname module, see https://twitter.com/sn0int/status/1228046880459907073 for details and instructions.
• Spiderfoot uses this in the sfp_account module. There is also this video showing how to use this project using the Spiderfoot Command Line Interface (CLI).
• WhatsMyName-Python Whats My Name simple Python script made by @C3n7ral051nt4g3ncy
• WMN_screenshooter a helper script that uses Selenium to try and grab screenshots of identified profile pages.
• WhatsMyName-Client a simple Python script with 'request headers' and 'POST requests' support made by @grabowskiadrian. The script also allows you to test the configuration of the wmn-data.json file.

Content

• The https://github.com/WebBreacher/WhatsMyName/wiki/Problem-Removed-Sites page has websites that we have had in the project and are currently not working for some reason. We will retest those sites (in the future) and try to find detections.
• If you would like to help with detections, we are happy to accept them via GitHub pull request or you can create an issue with the details of the site.
• Want to suggest a site to be added? Use this form.

Format

See CONTRIBUTING

Social Media

Come follow us for updates. We are on:

• Mastodon at https://infosec.exchange/@whatsmyname

License

This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.

whatsmyname's Issues

broken site - bitbucket.org

• Looking up https://bitbucket.org/api/2.0/users/test
  ! ERROR: BAD DETECTION STRING. ""username": " was not found on resulting page.
• Looking up https://bitbucket.org/api/2.0/users/WebBreacher
  ! ERROR: BAD DETECTION STRING. ""username": " was not found on resulting page.

Resources consistently fail on all entries

Looks like some are issues with timing out and could be fixed by extending the timeout, but the others seem to be legit bugs.

...
[!] 'check_uri' (thread=Thread-20, object={'name': 'T-Mobile Support', 'check_url': 'https://support.t-mobile.com/people/{account}', 'account_existence_code': '200', 'account_existence_string': 'connections', 'account_missing_string': '404 ERROR', 'account_missing_code': '404', 'known_accounts': ['admin', 'support'], 'category': 'social', 'valid': True}).
...
[!] HTTPSConnectionPool(host='api.zooppa.com', port=443)  Max retries exceeded with url  /api/v3/users?filters%5B%5D=login+is+jason-domke-b2bb4918 (Caused by NewConnectionError('<urllib3.connection.VerifiedHTTPSConnection object at 0x10a7ffcc0>  Failed to establish a new connection  [Errno 8] nodename nor servname provided, or not known',)) (thread=Thread-17, object={'name': 'Zooppa', 'check_uri': 'https://api.zooppa.com/api/v3/users?filters[]=login+is+{account}', 'pretty_uri': 'http://community.zooppa.com/en-us/users/{account}', 'account_existence_code': '200', 'account_existence_string': 'login', 'account_missing_string': 'avatar', 'account_missing_code': '200', 'known_accounts': ['test', 'hacker'], 'category': 'social', 'valid': True}).
...
[!] HTTPConnectionPool(host='www.authorstream.com', port=80)  Read timed out. (read timeout=10) (thread=Thread-18, object={'name': 'authorSTREAM', 'check_uri': 'http://www.authorstream.com/{account}/', 'account_existence_code': '200', 'account_existence_string': 'Presentations on authorSTREAM', 'account_missing_string': '', 'account_missing_code': '404', 'known_accounts': ['test', 'john'], 'category': 'presos', 'valid': True}).
...
[!] HTTPSConnectionPool(host='www.mixcloud.com', port=443)  Read timed out. (read timeout=10) (thread=Thread-14, object={'name': 'Mixcloud', 'check_uri': 'https://www.mixcloud.com/{account}/', 'account_existence_code': '200', 'account_existence_string': 'is on Mixcloud', 'account_missing_string': 'Page Not Found', 'account_missing_code': '404', 'known_accounts': ['test', 'john'], 'category': 'music', 'valid': True}).
...

add https://codefights.com/profile/lanmaster53

Add the https://codefights.com/profile/lanmaster53 site to the project

broken site - haveibeenpwned

• Looking up https://haveibeenpwned.com/api/v2/breachedaccount/john%40example.com
  ! ERROR: BAD CODE AND STRING. Neither the HTTP response code or detection string worked.

broken site - diy

• Looking up https://diy.org/test
  ! ERROR: BAD DETECTION STRING. "Member since" was not found on resulting page.
• Looking up https://diy.org/john
  ! ERROR: BAD DETECTION STRING. "Member since" was not found on resulting page.

add http://smashrun.com/john.young/

http://smashrun.com/john.young/

more sites

https://www.happycow.net/members/profile/AllisonRallison
https://www.zomato.com/tamehameha
https://www.tripadvisor.com/members-reviews/475carlm
http://www.snooth.com/profiles/joshparent/

Add multithreading

Make the python script multithreaded. Options are:

• https://www.tutorialspoint.com/python/python_multithreading.htm
• https://docs.python.org/2.7/library/threading.html
• http://www.python-course.eu/threads.php

add sites

http://openstreetcam.org/user/JackPav
https://www.mapillary.com/app/user/jbthemilker
http://www.openstreetmap.org/user/kemkim

broken site - del.icio.us

• Looking up http://del.icio.us/av2learner
  ! ERROR: BAD CODE AND STRING. Neither the HTTP response code or detection string worked.

broken site - deviantart

• Looking up http://test.deviantart.com/
  ! ERROR: BAD DETECTION STRING. "aboutme-profile-pic-shadow" was not found on resulting page.
• Looking up http://john.deviantart.com/
  ! ERROR: BAD DETECTION STRING. "aboutme-profile-pic-shadow" was not found on resulting page.

Bad site angel.c

• Looking up https://angel.co/sacca
  ! ERROR: BAD CODE AND STRING. Neither the HTTP response code or detection string worked.
• Looking up https://angel.co/rudyadler
  ! ERROR: BAD CODE AND STRING. Neither the HTTP response code or detection string worked.

broken site - meetzur

• Looking up http://www.meetzur.com/john
  ! ERROR: BAD DETECTION STRING. "Last Login" was not found on resulting page.

tinder!

https://www.gotinder.com/@john

web_accounts_list_checker.py follows redirects

Python requests library uses a default value of True for allow_redirects.

web_accounts_list_checker.py does not specifically override the default, rendering the following matches inaccurate:

$ grep -rn 'code" : "302"'  web_accounts_list.json -B 5 | grep name
21-         "name" : "about.me",
43-         "name" : "aNobii",
54-         "name" : "appearoo",
232-         "name" : "cHEEZburger",
320-         "name" : "devRant",
453-         "name" : "fanpop",
464-         "name" : "Fiverr",
532-         "name" : "FriendFinder",
543-         "name" : "FriendFinder-X",
765-         "name" : "ImageShack",
967-         "name" : "meet me",
1011-         "name" : "Mix",
1144-         "name" : "Quora",
1177-         "name" : "Pastebin",
1245-         "name" : "PictureTrail",
1344-         "name" : "ProductHunt",
1356-         "name" : "PSNProfiles",
1499-         "name" : "SmiteGuru",
1642-         "name" : "TF2 Backpack Examiner",
1686-         "name" : "Tripit",
1875-         "name" : "wishlistr",
1897-         "name" : "WordPress",
1919-         "name" : "Xanga",

(Note: the line numbers won't match up with master as I've modified my local web_accounts_list.json file).

Fortunately, each of these matches is for the account_missing_code, and the scanner defaults to presuming the account does not exist, so these matches won't affect web_accounts_list_checker.py; however, they may affect downstream tools utilizing the JSON file, depending on implementation (specifically: are redirects followed).

$ grep -rn '"302"'  web_accounts_list.json
26:         "account_missing_code" : "302",
48:         "account_missing_code" : "302",
59:         "account_missing_code" : "302",
237:         "account_missing_code" : "302",
325:         "account_missing_code" : "302",
458:         "account_missing_code" : "302",
469:         "account_missing_code" : "302",
537:         "account_missing_code" : "302",
548:         "account_missing_code" : "302",
770:         "account_missing_code" : "302",
972:         "account_missing_code" : "302",
1016:         "account_missing_code" : "302",
1149:         "account_missing_code" : "302",
1182:         "account_missing_code" : "302",
1250:         "account_missing_code" : "302",
1349:         "account_missing_code" : "302",
1361:         "account_missing_code" : "302",
1504:         "account_missing_code" : "302",
1647:         "account_missing_code" : "302",
1691:         "account_missing_code" : "302",
1880:         "account_missing_code" : "302",
1902:         "account_missing_code" : "302",
1924:         "account_missing_code" : "302",

broken site - imgur

• Looking up http://imgur.com/user/test
  ! ERROR: BAD DETECTION STRING. "Gallery comments" was not found on resulting page.

more sites

Look at knowem.com and namechk.com for more sites to enum

Fix broken sites

Just ran the web checker script and found the following issues:

 Engadget --> Bad detection string.
 Lanyrd --> Bad detection code and string. Expected Code: 503; Received Code: 200.
 Mixcrate --> Bad detection string.
 diigo --> Bad detection string.
 eBay --> Bad detection string.
 instructables --> Bad detection string.
 theguardian --> Bad detection string.
 tribe --> Bad detection code and string. Expected Code: 500; Received Code: 200.

add repl.it

https://repl.it/@john/

broken site - repl.it

• Looking up https://repl.it/@test
  ! ERROR: BAD DETECTION STRING. "profile?username=" was not found on resulting page.
• Looking up https://repl.it/@admin
  ! ERROR: BAD DETECTION STRING. "profile?username=" was not found on resulting page.
• Looking up https://repl.it/@john
  ! ERROR: BAD DETECTION STRING. "profile?username=" was not found on resulting page.

broken site anobii.com

• Looking up http://www.anobii.com/test/profile
  ! ERROR: BAD DETECTION STRING. "- aNobii" was not found on resulting page.
• Looking up http://www.anobii.com/john/profile
  ! ERROR: BAD DETECTION STRING. "- aNobii" was not found on resulting page.

Incorporate nightly checks of the data

Use https://travis-ci.org/ and https://nightli.es/

broken site - onlyfans

• Looking up https://onlyfans.com/kyliesummers
  ! ERROR: BAD DETECTION STRING. "Posts" was not found on resulting page.
• Looking up https://onlyfans.com/draeaxtell
  ! ERROR: BAD DETECTION STRING. "Posts" was not found on resulting page.

Update instagram

https://www.instagram.com/USERNAME/?__a=1

https://www.instagram.com/webbreacher/?__a=1 <-- output is in JSON

Fix broken sites

Just ran the checker and a number of sites are broken:

• AdultFriendFinder --> Bad detection code and string. Received Code: 404; Expected Code: 200.
• Fotolog --> Bad detection string.
• HaveIBeenPwnd --> Bad detection code and string. Received Code: 429; Expected Code: 200.
• IFTTT --> Bad detection string.
• LinkedIn --> Bad detection code and string. Received Code: 999; Expected Code: 200.
• Mixcloud --> Bad detection code and string. Received Code: 403; Expected Code: 200.
• MyBuilder.com --> Bad detection string.
• Rate Your Music --> Bad detection code and string. Received Code: 503; Expected Code: 200.
• Soup --> Bad detection code and string. Received Code: 503; Expected Code: 200.
• tribe --> Bad detection code and string. Received Code: 503; Expected Code: 200.
• tumblr --> Bad detection string.
• VK --> Bad detection code and string. Received Code: 404; Expected Code: 200.
• WeedLife --> Bad detection code and string. Received Code: 200; Expected Code: 303.
• WeeWorld --> Bad detection code and string. Received Code: 500; Expected Code: 200.

Add to website

https://storycorps.me/user/paul-swider/

https://www.google.com/search?num=40&newwindow=1&site=&source=hp&q=site%3Astorycorps.me+inurl%3A%2Fuser%2F&oq=site%3Astorycorps.me+inurl%3A%2Fuser%2F&gs_l=hp.3...1542.19004.0.19474.44.36.4.0.0.0.438.3440.18j9j1j0j1.29.0....0...1c.1.64.hp..17.4.448.0..0j46j0i131k1j0i46k1.Lb_r36VqHvM

New sites

https://www.seoclerks.com/user/gokudadon

Fix sites

1. Atlassian --> Bad detection string.
2. Basecamp --> Bad detection code and string. Received Code: 404; Expected Code: 200.
3. Bugcrowd --> Bad detection string.
4. Garmin connect --> Bad detection code and string. Received Code: 403; Expected Code: 200.
5. HaveIBeenPwnd --> Bad detection code and string. Received Code: 429; Expected Code: 200.
6. LinkedIn --> Bad detection code and string. Received Code: 999; Expected Code: 200.
7. Periscope --> Bad detection string.
8. Rate Your Music --> Bad detection code and string. Received Code: 503; Expected Code: 200.
9. Twitpic --> Bad detection string.
10. facebook.com --> Bad detection string.
11. theguardian --> Bad detection code and string. Received Code: 404; Expected Code: 200.
12. vidme --> Bad detection string.

Add archive.org

https://archive.org/details/@jason_scott
https://archive.org/details/@webbreacher

broken site - rottentomatoes

• Looking up https://www.rottentomatoes.com/critic/guy-lodge/movies/
  ! ERROR: BAD DETECTION STRING. "Movies Reviews & Previews" was not found on resulting page.
• Looking up https://www.rottentomatoes.com/critic/matthew-lickona/movies/
  ! ERROR: BAD DETECTION STRING. "Movies Reviews & Previews" was not found on resulting page.

Create python link checker

broken site - buzznet

• Looking up https://www.buzznet.com/author/carolinegawlik/
  ! ERROR: BAD DETECTION STRING. ", Author at buzznet</title>" was not found on resulting page.

Add site

https://www.freelancer.com/u/JRafaeLim

add runkeeper

https://runkeeper.com/user/stevewerby/

broken site - canva

• Looking up https://www.canva.com/marketplacedesigners
  ! ERROR: BAD DETECTION STRING. "– Canva</title>" was not found on resulting page.

Validate and Add sites

Submitted anonymously to me:

{
"name" : "Disqus",
"check_uri" : "https://disqus.com/by/{account}/",
"account_existence_code" : "200",
"account_existence_string" : "<title>Disqus Profile",
"account_missing_string" : "<title> Page",
"account_missing_code" : "404",
"known_accounts" : ["carlosharm"],
"category" : "discussion",
"valid" : true,
"comments" : [""]
},

  { 
     "name" : "Free Republic", 
     "check_uri" : "http://www.freerepublic.com/%7E{account}/", 
     "account_existence_code" : "200", 
     "account_existence_string" : "view home page", 
     "account_missing_string" : "This account has been banned or suspended.", 
     "account_missing_code" : "304", 
     "known_accounts" : ["Lurkinanloomin","TigerClaws"], 
     "category" : "political", 
     "valid" : true, 
     "comments" : [""] 
  },

add hacked-emails

https://hacked-emails.com/[email protected]

Isn't this basically Sherlock?

Isn't this basically Sherlock?
https://github.com/sherlock-project/sherlock

But I like your project thought 😄

use all test users

in the python script, if the search string is not found with the first test user, move to the second. could be the first user is no longer good.

mod the script to pick up bad user

broken site - klear

• Looking up http://klear.com/profile/john
  ! ERROR: BAD CODE AND STRING. Neither the HTTP response code or detection string worked.

Handling of '.' in usernames

Some services support usernames containing .. Others do not.

This is problematic for services which make use of a subdomain for profile URLs:

# grep -rn check_uri web_accounts_list.json | grep '//{'
133:         "check_uri" : "http://{account}.blogspot.com",
299:         "check_uri" : "http://{account}.deviantart.com/",
733:         "check_uri" : "http://{account}.insanejournal.com/profile",
866:         "check_uri" : "http://{account}.livejournal.com",
1335:         "check_uri" : "https://{account}.skyrock.com/profil/",
1390:         "check_uri" : "http://{account}.smugmug.com",
1434:         "check_uri" : "http://{account}.soup.io/rss",
1566:         "check_uri" : "http://{account}.tumblr.com",
1766:         "check_uri" : "http://{account}.xanga.com/",

One approach would be to strip all . from usernames only for these services. Other characters such as - and _ may also be problematic.

Alternatively, another approach would be to simply skip these services if the username contains problematic characters.

add site

https://www.wayn.com/profiles/3347648

New sites about POT!

• https://www.google.com/search?q=inurl%3Amassroots.com%2Fuser%2F
• https://www.duby.co/organicannabis/, https://www.duby.co/jonny5/
• https://www.weedlife.com/pothead57

broken site - hubpages

• Looking up http://hubpages.com/@test
  ! ERROR: BAD CODE AND STRING. Neither the HTTP response code or detection string worked.
• Looking up http://hubpages.com/@bob
  ! ERROR: BAD CODE AND STRING. Neither the HTTP response code or detection string worked.

Fix issue with slashdot

➜  python web_accounts_list_checker.py -u mnciitbhu
...
 -  Looking up https://slashdot.org/~mnciitbhu
[+] Found user at https://slashdot.org/~mnciitbhu
...

From https://slashdot.org/~mnciitbhu:

The user you requested does not exist, no matter how much you wish this might be the case.

dos2unix

# ./web_accounts_list_checker.py 
bash: ./web_accounts_list_checker.py: /usr/bin/python^M: bad interpreter: No such file or directory

plz:

dos2unix web_accounts_list_checker.py
git add web_accounts_list_checker.py
git commit -m "dos2unix web_accounts_list_checker.py"
git push

Add site to the project

https://www.patientslikeme.com/members/MSmary

add this site

https://www.vivino.com/users/warren.lap

Add site GPSies

https://www.gpsies.com/mapUser.do?username=woodslover924

--se output files missing

Just ran the newest python script and found that it didn't generate an se- file for every site that failed the check. @lehuff can you look into it? Here is the output and the listing of the dir. I'd expect one se- file for each of the failures, yes?

The following previously "valid" sites had errors:
     AdultFriendFinder --> Bad detection code and string. Received Code: 404; Expected Code: 200.
     Fotolog --> Bad detection string.
     HaveIBeenPwnd --> Bad detection code and string. Received Code: 429; Expected Code: 200.
     IFTTT --> Bad detection string.
     LinkedIn --> Bad detection code and string. Received Code: 999; Expected Code: 200.
     Mixcloud --> Bad detection code and string. Received Code: 403; Expected Code: 200.
     Rate Your Music --> Bad detection code and string. Received Code: 503; Expected Code: 200.
     Soup --> Bad detection code and string. Received Code: 503; Expected Code: 200.
     VK --> Bad detection code and string. Received Code: 404; Expected Code: 200.
     WeedLife --> Bad detection code and string. Received Code: 200; Expected Code: 303.
     tribe --> Bad detection code and string. Received Code: 503; Expected Code: 200.
     tumblr --> Bad detection string.

┌─[18:13:37]─[~/tools/WhatsMyName]
└──> $  ll
total 352
drwxrwxr-x 8 ubuntu  4096 Jan  7 18:06 .git/
-rw-rw-r-- 1 ubuntu  1101 Dec 18 22:05 LICENSE.md
-rw-rw-r-- 1 ubuntu  4600 Jan  7 18:06 README.md
-rw-rw-r-- 1 ubuntu     9 Jan  6 22:01 requirements.txt
-rw-rw-r-- 1 ubuntu 47612 Jan  7 18:08 se-Fotolog.johndoe
-rw-rw-r-- 1 ubuntu 57521 Jan  7 18:08 se-IFTTT.fitbit
-rw-rw-r-- 1 ubuntu 36494 Jan  7 18:12 se-tumblr.test1
-rwxrwxr-x 1 ubuntu  9689 Jan  7 18:06 web_accounts_list_checker.py*
-rw-rw-r-- 1 ubuntu 88239 Jan  7 18:07 web_accounts_list.json