Python for OSINT: Find Google Accounts with GHunt

This post will walk through how to use the Python script GHunt via gitpod.io, which lets you search an email address to find the associated Google Account and pulls relevant information from it. Google account

GHunt is located at https://github.com/mxrch/GHunt , and was developed by mxrch on Github.

Running GHunt

1 – Go to:

https://gitpod.io/#https://github.com/mxrch/GHunt

2 – type the following command and then hit enter:

docker pull mxrch/ghunt

3 – copy and paste in this next command and then hit enter:

docker run -v ghunt-resources:/usr/src/app/resources -ti mxrch/ghunt check_and_gen.py

4 – The file will ask you one at a time to input your google cookies, you only have to do this once.

You get the following prompt to find your google cookie “SID”

Find Google Cookies (using Firefox or Chrome)

a.) Log in to accounts.google.com

b.) After that, open the Dev Tools window and navigate to the Storage tab (Shift + F9 on Firefox)
If you don’t know how to open it, just right-click anywhere and click “Inspect Element”.

c.) For Google Chrome (sorry, not sure about Firefox) you click on application

d.) Then on the left side click the triangle next to Cookies so it is directed down. Then click on

https://myaccount.google.com

e.) Now your cookies appear in the menu to the right.

f.) For each cookie that you need, the script will identify its by the cookie name, which you can find in the Name column.

g.) So the first cookie that was asked for was SID:

So we go to the menu and under Name we find SID

h.) Then we copy the Value and paste it in where the file asked in gitpod

j.) You will be prompted to find and input the cookies named SID, SSID, APISID, SAPISID, and HSID.

Now lets return to step 5 in the process of running GHunt.

5 – Now in order to search for the Google Account of an email address, type in the following command (but with the email address where it says “<email_address>” (also remove the carrots)) and hit enter:

docker run -v ghunt-resources:/usr/src/app/resources -ti mxrch/ghunt ghunt.py email <email_address>

SIDENOTE: GHunt can also research a Google Doc. To do so, get the document link and run the following command:

docker run -v ghunt-resources:/usr/src/app/resources -ti mxrch/ghunt ghunt.py doc

And here is the kind of results you may receive (name, location, photos, etc.):

When I click on the Google Maps link (gitpod requires you to hold down Ctrl while you click on the link), I get the account’s profile photo and a review on Google Maps at a specific location.

Don’t forget to hit Save within the Gitpod workspace so that you do not need to input your cookies in the future!

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s