/leak-hunting

name: leak-hunting
description: |
  This skill should be used when the user mentions "hunt leaks", "find breaches", "credential leaks", "data leak", "breach database", "hunt dumps", "leak finder", "leak hunting", "discover leaks", "breached credentials", "combo list", "combolist", "credential dump", "paste site", "pastebin leak", "breach forums", "BreachForums", "Exploit.in", "RaidForums", "Telegram leaks", "leak channel", "h8mail", "dehashed", "LeakCheck", "IntelX", "Intelligence X", "breach correlation", "credential reuse", "credential stuffing list", "breach data", "leaked passwords", "leaked emails", "data broker", "have i been pwned", "HIBP", "combo cloud", "stealer logs", "infostealer", "redline stealer", "raccoon stealer", "leak search", or discusses systematically searching for breached credentials, hunting leaked data across paste sites and forums, correlating breach records across multiple sources, assessing credential reuse exposure, navigating dark web forums for data listings, monitoring Telegram leak channels, using breach search APIs, or building target dossiers from leaked data. Always use this skill when the task involves finding already-breached or already-leaked data about a target — as distinct from discovering live exposed databases (which is the exposed-databases skill). For example, "check if their credentials were in any breaches" or "search for leaks of corp.com emails" should trigger this skill.
version: 2.0.0

Leak Hunting

Systematically discover breached credentials, leaked databases, and dumped data related to a target across paste sites, breach forums, dark web markets, Telegram channels, GitHub repos, and breach search APIs. This skill covers *already-leaked data* — for finding live exposed databases, see the exposed-databases skill.

Workflow

Leak hunting follows five phases. Each phase feeds the next — do not skip triage or you will waste time acquiring junk data.

RECON → HUNT → VALIDATE → TRIAGE → ACQUIRE/HANDOFF
  |        |        |         |           |
  |        |        |         |           +-- open → data-acquisition skill
  |        |        |         |           +-- protected → cross-plugin-pipeline (elliot handoff)
  |        |        |         +-- credibility + freshness + value scoring
  |        |        +-- sample check, domain match, format plausibility
  |        +-- hunt-engine.js (dork, github, forum) + APIs (h8mail, IntelX, HIBP)
  +-- map target surface: domains, emails, brands, subsidiaries

---

Phase 1: Target Reconnaissance

Before generating any queries, map the target's digital footprint to maximize hunt coverage.

Define the Attack Surface

| Element | How to Find | Example | |---------|------------|---------| | Primary domains | Engagement scope, whois, DNS | `corp.com`, `corp.com.br` | | Email patterns | LinkedIn, public org charts, known breach headers | `first.last@corp.com`, `flast@corp.com` | | Brand keywords | Company name, products, internal projects, acquisitions | `CorpTech`, `CorpPay`, `Project Atlas` | | Employee emails | TheHarvester, LinkedIn scraping, prior breach samples | `jane.doe@corp.com` | | Subsidiaries | CNPJ/corporate registries, SEC filings, crunchbase | `sub.corp.com`, `acquired-co.com` |

Configure Hunt Profile

node ${CLAUDE_PLUGIN_ROOT}/scripts/hunt-profile.js show
node ${CLAUDE_PLUGIN_ROOT}/scripts/hunt-profile.js set <profile>

The profile controls which source categories are permitted and what timing delays to apply. See OPSEC section below.

---

Phase 2: Hunt Execution

Execute queries across all source categories, ordered by ROI (signal quality per time invested).

Execution Order

| Priority | Source | Tool / Method | Profile Requirement | |----------|--------|--------------|---------------------| | 1 | Breach search APIs (h8mail, HIBP, IntelX) | CLI / MCP / API | `surface`+ | | 2 | GitHub secret search | `hunt-engine.js github` | `surface`+ | | 3 | Google dorks (paste sites, indexed dumps) | `hunt-engine.js dork` | `surface`+ | | 4 | Breach forums (BreachForums, Exploit.in) | `hunt-engine.js forum` + manual | `deep`+ | | 5 | Telegram leak channels | Manual channel search | `deep`+ | | 6 | Dark web markets (.onion) | Tor Browser, manual | `dark`+ | | 7 | Stealer log markets (Russian Market, Genesis) | Tor Browser, manual | `dark`+ |

Breach Search APIs

**h8mail** (aggregated breach search):

h8mail -t target@corp.com -q domain --all
h8mail -t corp.com -q domain --all -o dumps/h8mail-corp.csv

Searches HIBP, LeakCheck, Snusbase, and other APIs. Configure API keys in `~/.h8mail/h8mail_config.ini`.

**Intelligence X** (full-text breach search):

# Via API
curl -s "https://2.intelx.io/intelligent/search" \
  -H "x-key: $INTELX_API_KEY" \
  -d '{"term":"corp.com","maxresults":100,"media":0,"sort":2,"terminate":[]}'

**Have I Been Pwned** (breach membership check):

# Check single email
curl -s "https://haveibeenpwned.com/api/v3/breachedaccount/user@corp.com" \
  -H "hibp-api-key: $HIBP_API_KEY" \
  -H "user-agent: tyrell-hunter"

Returns list of breaches the email appears in — use to identify which breach databases to hunt for.

Query Generation

node ${CLAUDE_PLUGIN_ROOT}/scripts/hunt-engine.js dork <target> --category leaks
node ${CLAUDE_PLUGIN_ROOT}/scripts/hunt-engine.js github <target> --type secrets
node ${CLAUDE_PLUGIN_ROOT}/scripts/hunt-engine.js forum <target>

Execute generated queries via MCP tools (Brave Search, Shodan MCP, GitHub search). Do not manually construct queries — the engine optimizes them per source type.

GitHub Secret Hunting

Beyond `hunt-engine.js`, use dedicated tools for deeper coverage:

# gitleaks — scan a cloned repo
gitleaks detect --source /path/to/cloned-repo --report-format json --report-path dumps/gitleaks-report.json

# trufflehog — scan GitHub org
trufflehog github --org=target-org --json > dumps/trufflehog-results.jsonl

Look for: database conn