OSINT › Module 4 › Lesson 4
Lab — Check YOUR Email Footprint
HIBP official + holehe notes + MX/harvester skip-or-run — viewer
Visual · email_footprint_lab
Lab: YOUR email on haveibeenpwned.com. Bind
Opening
The footprint file is a letter to yourself: where YOUR address still lives.
Open https://haveibeenpwned.com/ and check YOUR email on the official site. Merge holehe notes, Gravatar decision, MX/theHarvester skip-or-results into t12-m04-email-footprint.txt. Serve on curl. chmod 600. No dumps. No classmate emails. Original Cyberlium. GATE Next: Quiz — Email OSINT.
1. HIBP official site, then merge YOUR files
Use the real Have I Been Pwned website. Do not paste YOUR password. Do not use a clone. Write pwned_yes/no/unknown into the footprint file from what the official page showed you.
. Then cat holehe/MX/harvester notes you already created.
Command guide
HIBP official site, then merge YOUR files
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
pipx install theHarvester pipx install holehe sudo apt install curl sudo apt install dnsutils
macOS:
Command — copy this
pipx install theHarvester pipx install holehe
Windows:
Command — copy this
pip install theHarvester pip install holehe
Built-in (PowerShell: Invoke-WebRequest) Use nslookup (built-in)
═══ COMMANDS ═══
Command — copy this
curl -sS -m 8 -I "https://haveibeenpwned.com/" | head -n 10
2. Loopback viewer of the footprint, bind 127.0.0.1:8803
Serve the footprint as text. If a snippet binds 0.0.0.0, refuse — it would publish YOUR breach result on café Wi-Fi.
curl SAFE. Leave HIBP result filled by you, not by a script that scrapes HIBP against terms.
Command guide
Loopback viewer of the footprint, bind 127.0.0.1:8803
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Built-in (PowerShell: Invoke-WebRequest) Download https://python.org/downloads/
═══ COMMANDS ═══
Command — copy this
cat > "$HOME/cyberlium-lab/t12_m04_fp_view.py" << 'PY'
from http.server import BaseHTTPRequestHandler, HTTPServer
from pathlib import Path
HOST, PORT = "127.0.0.1", 8803
if HOST != "127.0.0.1":
raise SystemExit("refusing non-loopback bind")
FP = Path.home() / "cyberlium-lab" / "t12-m04-email-footprint.txt"
class H(BaseHTTPRequestHandler):
def do_GET(self):
body = FP.read_bytes() if FP.exists() else b"missing footprint
"
self.send_response(200); self.send_header("Content-Type", "text/plain; charset=utf-8")
self.send_header("Content-Length", str(len(body))); self.end_headers(); self.wfile.write(body)
def log_message(self, *a):
pass
HTTPServer((HOST, PORT), H).serve_forever()
PYCommand — copy this
grep -n "0.0.0.0" "$HOME/cyberlium-lab/t12_m04_fp_view.py" && echo "FIX"
3. Lock lab note; never dump shops
Write t12-m04-l04-email-lab.txt with hibp official, holehe official, theHarvester official, mxtoolbox named. chmod 600. Stop the pid.
Quiz next. XP is not an email-OSINT cert.
4. What you ship: official HIBP result for YOUR email and a private footprint file
haveibeenpwned.com used as you. Footprint 600. Viewer No dumps. No classmate emails. DEMO GATE.
5. What you record before the next lesson
Date. HIBP result. holehe/MX/harvester merge. curl 8803. File t12-m04-l04-email-lab.txt chmod 600.
6. Wrong vs right: strangers vs identifiers YOU own
Worked failure — same OSINT word, opposite target. Right never needs a classmate or a dump site.
Wrong
Download a dump to “verify HIBP.” holehe the class. Bind 0.0.0.0. Hunter the university.
Right
Official HIBP. Merge YOUR notes. curl loopback. Next: Quiz — Email OSINT.
Mission: official breach check + merged footprint
1) / STOP if router. 2) Check YOUR email on haveibeenpwned.com. 3) Merge notes into t12-m04-email-footprint.txt. 4) Serve on , curl, chmod 600. Never dumps. Never other inboxes.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor what to do if HIBP shows a hit (password change on YOUR accounts) — not where to buy the dump.
Knowledge Check
APPLY: A site named “HIBP checker pro” wants $5 for “full dump search.” You:
Multiple choice
Knowledge Check
APPLY: True or False: The email lab bind is
True or False
Knowledge Check
APPLY: curl http://192.168.0.1/ is Router Admin during the footprint lab. You:
Multiple choice