# GHunt | Enumerate Gmails | Extract Information From Any Google Account Using An Email **URL:** \ **Category:** Tools & Scripts\ **Tags:** tools, email, trading\ **Created:** [November 16, 2020, 8:00am UTC](https://onehack.st/t/ghunt-enumerate-gmails-extract-information-from-any-google-account-using-an-email/162735 "2020-11-16T08:00:31Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Aina](https://onehack.st/user_avatar/onehack.st/aina/32/167469_2.png) [@Aina](https://onehack.st/u/Aina)\ **Post date:** [November 16, 2020, 8:00am UTC](https://onehack.st/t/ghunt-enumerate-gmails-extract-information-from-any-google-account-using-an-email/162735/1 "2020-11-16T08:00:31Z")
![image](https://onehack.st/uploads/default/original/3X/d/8/d857aaa303cab43f5d66e0094f0a40500e49fdb3.png) [![Python minimum version](https://camo.githubusercontent.com/86c5161afcc6b4af41f0f757c829f92145a74bcc3eed0ee505f4e3a37186c61e/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f507974686f6e2d332e382532422d627269676874677265656e)](https://camo.githubusercontent.com/86c5161afcc6b4af41f0f757c829f92145a74bcc3eed0ee505f4e3a37186c61e/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f507974686f6e2d332e382532422d627269676874677265656e) [![Docker Cloud Build Status](https://camo.githubusercontent.com/d37f9559cd688f64bba3beadda788243ac1ab6c5decda4d50e45e42bbee72164/68747470733a2f2f696d672e736869656c64732e696f2f646f636b65722f636c6f75642f6275696c642f6d787263682f6768756e74)](https://camo.githubusercontent.com/d37f9559cd688f64bba3beadda788243ac1ab6c5decda4d50e45e42bbee72164/68747470733a2f2f696d672e736869656c64732e696f2f646f636b65722f636c6f75642f6275696c642f6d787263682f6768756e74) [![GitHub Workflow Status](https://camo.githubusercontent.com/b7a1b03c3d9324e33848975f4ac90eaaa90473ee84f8f8788823244df3d2d99d/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f776f726b666c6f772f7374617475732f6d787263682f6768756e742f436f6465514c3f6c6162656c3d436f6465514c)](https://camo.githubusercontent.com/b7a1b03c3d9324e33848975f4ac90eaaa90473ee84f8f8788823244df3d2d99d/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f776f726b666c6f772f7374617475732f6d787263682f6768756e742f436f6465514c3f6c6162656c3d436f6465514c) # Description GHunt is a modulable OSINT tool designed to evolve over the years, and incorporates many techniques to investigate Google accounts, or objects. It currently has **email** , **document** , **youtube** and **gaia** modules. 🔥 _ **GHunt is being completely refactored** _, to allow use as a Python library, removing Selenium and Google Chrome dependencies, using definition types and async, to prepare for v2. You can track the progress on this project here: [https://github.com/mxrch/GHunt/projects/1](https://github.com/mxrch/GHunt/projects/1) And on this branch : [https://github.com/mxrch/GHunt/tree/refactor](https://github.com/mxrch/GHunt/tree/refactor) Please understand that the activity of the master branch will now be reduced, and therefore the pull requests too. ## What can GHunt find ? 🗺 **Email** module: - Owner’s name - Gaia ID - Last time the profile was edited - Profile picture (+ detect custom picture) - If the account is a Hangouts Bot - Activated Google services (YouTube, Photos, Maps, News360, Hangouts, etc.) - Possible YouTube channel - Possible other usernames - Google Maps reviews (M) - Possible physical location (M) - Events from Google Calendar (C) - Organizations (work & education) (A) - Contact emails (A) - Contact phones (A) - Addresses (A) - ~~Public photos (P)~~ - ~~Phones models (P)~~ - ~~Phones firmwares (P)~~ - ~~Installed softwares (P)~~ 🗺 **Document** module: - Owner’s name - Owner’s Gaia ID - Owner’s profile picture (+ detect custom picture) - Creation date - Last time the document was edited - Public permissions - Your permissions 🗺 **Youtube** module: - Owner’s Gaia ID (through Wayback Machine) - Detect if the email is visible - Country - Description - Total views - Joined date - Primary links (social networks) - All infos accessible by the Gaia module 🗺 **Gaia** module: - Owner’s name - Profile picture (+ detect custom picture) - Possible YouTube channel - Possible other usernames - Google Maps reviews (M) - Possible physical location (M) - Organizations (work & education) (A) - Contact emails (A) - Contact phones (A) - Addresses (A) The features marked with a **(P)** require the target account to have the default setting of `Allow the people you share content with to download your photos and videos` on the Google AlbumArchive, or if the target has ever used Picasa linked to their Google account. More info [here](https://github.com/mxrch/GHunt#%EF%B8%8F-protecting-yourself). Those marked with a **(M)** require the Google Maps reviews of the target to be public (they are by default). Those marked with a **(C)** require user to have Google Calendar set on public (default it is closed). Those marked with a **(A)** require user to have the additional info set [on profile](https://myaccount.google.com/profile) with privacy option “Anyone” enabled. # Screenshots [![](https://camo.githubusercontent.com/6d4e7897b453b811d372ed34663af8a30ed64d4c2a936d36e11a9c57bff05194/68747470733a2f2f66696c65732e636174626f782e6d6f652f327a62317a392e706e67)](https://camo.githubusercontent.com/6d4e7897b453b811d372ed34663af8a30ed64d4c2a936d36e11a9c57bff05194/68747470733a2f2f66696c65732e636174626f782e6d6f652f327a62317a392e706e67) ## 📰 Latest news - **02/10/2020** : Since a few days ago, Google returns a 404 when we try to access someone’s Google Photos public albums, we can only access it if we have a link to one of their albums. Either this is a bug and this will be fixed, either it’s a protection that we need to find how to bypass. - **03/10/2020** : Successfully bypassed. 🕺 (commit 01dc016) It requires the “Profile photos” album to be public (it is by default) - **20/10/2020** : Google WebArchive now returns a 404 even when coming from the “Profile photos” album, so **the photos scraping is temporary (or permanently) disabled.** (commit e762543) - **25/11/2020** : Google now removes the name from the Google Maps profile if the user has 0 reviews (or contributions, even private). I did not find a bypass for the moment, so **all the help in the research of a bypass is appreciated.** - **20/03/2021** : Successfully bypassed. 🕺 (commit b3b01bc) # Installation ## Manual installation - Make sure you have Python 3.8+ installed. (I developed it with Python 3.8.1) - Some Python modules are required which are contained in `requirements.txt` and will be installed below. ### 1. Chromedriver & Google Chrome This project uses Selenium and automatically downloads the correct driver for your Chrome version. ⚠ So just make sure to have Google Chrome installed. ### 2. Cloning Open your terminal, and execute the following commands : git clone [https://github.com/mxrch/ghunt](https://github.com/mxrch/ghunt) cd ghunt ### 3. Requirements In the GHunt folder, run: python3 -m pip install -r requirements.txt Adapt the command to your operating system if needed. ## Docker The Docker image is automatically built and pushed to Dockerhub after each push on this repo. You can pull the Docker image with: ```auto docker pull ghcr.io/mxrch/ghunt ``` Then, you can use the `docker_check_and_gen.sh` and `docker_hunt.sh` to invoke GHunt through Docker, or you can use these commants : ```auto docker run -v ghunt-resources:/usr/src/app/resources -ti ghcr.io/mxrch/ghunt check_and_gen.py docker run -v ghunt-resources:/usr/src/app/resources -ti ghcr.io/mxrch/ghunt ghunt.py ``` # Usage For the first run and sometime after, you’ll need to check the validity of your cookies. To do this, run `check_and_gen.py`. If you don’t have cookies stored (ex: first launch), you will be asked for the required cookies. If they are valid, it will generate the Authentication token and the Google Docs & Hangouts tokens. Then, you can run the tool like this: python3 ghunt.py email [larry@google.com](mailto:larry@google.com) python3 ghunt.py doc [https://docs.google.com/spreadsheets/d/1BxiMVs0XRA5nFMdKvBdBZjgmUUqptlbs74OgvE2upms](https://docs.google.com/spreadsheets/d/1BxiMVs0XRA5nFMdKvBdBZjgmUUqptlbs74OgvE2upms) ⚠ I suggest you make an empty account just for this or use an account where you never login because depending on your browser/location, re-logging in into the Google Account used for the cookies can deauthorize them. # Where I get these cookies ? ## Auto (faster) You can download the GHunt Companion extension that will automate the cookies extraction in 1-click ! [![Firefox](https://camo.githubusercontent.com/3c0a89735040dd44920d65251137a3de810d05123b3eef240179709817f78fa2/68747470733a2f2f666670346731796c796974336a64797469316871637674622d7770656e67696e652e6e6574646e612d73736c2e636f6d2f6164646f6e732f66696c65732f323031352f31312f6765742d7468652d6164646f6e2e706e67)](https://addons.mozilla.org/fr/firefox/addon/ghunt-companion/) [![Chrome](https://camo.githubusercontent.com/63a0f5533a0293c613006e343d768a49c62839ddf3f39ecfd91da9e5242fe496/68747470733a2f2f73746f726167652e676f6f676c65617069732e636f6d2f7765622d6465762d75706c6f6164732f696d6167652f576c443877433667386b685957504a5573516365516b6858536c76312f55563443347962654254735a74343355347869732e706e67)](https://chrome.google.com/webstore/detail/ghunt-companion/dpdcofblfbmmnikcbmmiakkclocadjab) [![Edge](https://user-images.githubusercontent.com/11660256/111323589-4f4c7c00-866a-11eb-80ff-da7de777d7c0.png)](https://microsoftedge.microsoft.com/addons/detail/ghunt-companion/jhgmpcigklnbjglpipnbnjhdncoihhdj) You just need to launch the check\_and\_gen.py file and choose the extraction mode you want to use, between putting GHunt in listening mode, or copy/paste the encoded cookies in base64. ## Manual 1. Be logged-in to [myaccount.google.com](http://myaccount.google.com) 2. After that, open the Dev Tools window and navigate to the Network tab If you don’t know how to open it, just right-click anywhere and click “Inspect Element”. 3. Go to [myaccount.google.com](http://myaccount.google.com), and in the browser requests, select the GET on “[accounts.google.com](http://accounts.google.com)” that gives a 302 redirect 4. Then you’ll find every cookie you need in the “cookies” section. [![cookies](https://camo.githubusercontent.com/ea35fde5c24bbb595dd449ad30df4a0bb59d41198e1fdcc7a532f14065b2e671/68747470733a2f2f66696c65732e636174626f782e6d6f652f31356a3870672e706e67)](https://camo.githubusercontent.com/ea35fde5c24bbb595dd449ad30df4a0bb59d41198e1fdcc7a532f14065b2e671/68747470733a2f2f66696c65732e636174626f782e6d6f652f31356a3870672e706e67) # 🛡 Protecting yourself Regarding the collection of metadata from your Google Photos account: Given that Google shows **“X require access”** on [your Google Account Dashboard](https://myaccount.google.com/intro/dashboard), you might imagine that you had to explicitly authorize another account in order for it to access your pictures; but this is not the case. Any account can access your AlbumArchive (by default): [![account-dashboard](https://camo.githubusercontent.com/7d10d0c3bfa5faa616c4a923d46b21ce267a7f19043b6e7acb2f05d0710a105f/68747470733a2f2f66696c65732e636174626f782e6d6f652f7566716339672e6a7067)](https://camo.githubusercontent.com/7d10d0c3bfa5faa616c4a923d46b21ce267a7f19043b6e7acb2f05d0710a105f/68747470733a2f2f66696c65732e636174626f782e6d6f652f7566716339672e6a7067) Here’s how to check and fix the fact that you’re vulnerable (which you most likely are): Go to [https://get.google.com/albumarchive/](https://get.google.com/albumarchive/) while logged in with your Google account. You will be **automatically** redirected to your correct albumarchive URL (`https://get.google.com/albumarchive/YOUR-GOOGLE-ID-HERE`). After that, click the three dots on the top left corner, and click on **setting** [![three-dots-setting](https://camo.githubusercontent.com/3ca6101f835ab9e05f8b84cc3dc12b37ffbe53ed87fe504c4945cffd46b9eae9/68747470733a2f2f66696c65732e636174626f782e6d6f652f7275366b63692e6a7067)](https://camo.githubusercontent.com/3ca6101f835ab9e05f8b84cc3dc12b37ffbe53ed87fe504c4945cffd46b9eae9/68747470733a2f2f66696c65732e636174626f782e6d6f652f7275366b63692e6a7067) Then, uncheck the only option there: [![setting](https://camo.githubusercontent.com/88c30abe7eeca6461aec736e161bc5e18c76f63dd9c523ebd51522cb558ca356/68747470733a2f2f66696c65732e636174626f782e6d6f652f62383837396c2e6a7067)](https://camo.githubusercontent.com/88c30abe7eeca6461aec736e161bc5e18c76f63dd9c523ebd51522cb558ca356/68747470733a2f2f66696c65732e636174626f782e6d6f652f62383837396c2e6a7067) On another note, the target account will **also** be vulnerable if they have ever used **Picasa** linked to their Google account in any way, shape or form. For more details on this, read PinkDev1’s comment on [issue #10](https://github.com/mxrch/GHunt/issues/10). For now, the only (known) solution to this is to delete the Picasa albums from your AlbumArchive. # Thanks This tool is based on [Sector’s research on Google IDs](https://sector035.nl/articles/getting-a-grasp-on-google-ids) and completed by my own as well. If I have the motivation to write a blog post about it, I’ll add the link here ! - Palenath (for the name bypass) ## GitHub: > **[GitHub - mxrch/GHunt: 🕵️‍♂️ Offensive Google framework.](https://github.com/mxrch/GHunt)** > > 🕵️‍♂️ Offensive Google framework. ---
**Author:** ![nabiscojones](https://onehack.st/user_avatar/onehack.st/nabiscojones/32/80526_2.png) [@nabiscojones](https://onehack.st/u/nabiscojones)\ **Post date:** [December 27, 2021, 8:40am UTC](https://onehack.st/t/ghunt-enumerate-gmails-extract-information-from-any-google-account-using-an-email/162735/3 "2021-12-27T08:40:20Z")
Bravo! Thank you for this intel @Aina!