Mailfoguess

OSINT tool to guess and verify (experimental) the email address of a person from information such as firstname, middlename, lastname, username...

The script

Operation

An email address is made up from local-part, the symbol @, and a domain. This script does :

• Create a lot of possible local-part from informations given and following generation level
• Add @domain to all local-part respecting the conditions of creation of mail of these domains
• Optional: Verify these mails (only for "gmail","laposte","protonmail","yahoo")

WARNING: Mailfoguess uses holehe to verify the generated mails. It can lead to false results due to rate limit or else.

Installation

Download files and dependencies

git clone https://github.com/WildSiphon/Mailfoguess
cd Mailfoguess
pip3 install -r requirements.txt

Use

Usual use

usage: mailfoguess.py [-h] [-f [FIRSTNAME]] [-m [MIDDLENAME]] [-l [LASTNAME]] [-u [USERNAME]] [-n [NUMBER]] [--yes] [--level {min,low,high,max}] [--resume [RESUME_PATH]] [--separators [SEPARATORS]] [--print]
                      [--output [OUTPUT_LOCATION]] [--nb-localparts [NB_PRINT_LOCALPARTS]] [--nb-emails [NB_PRINT_EMAILS]] [--nb-verified [NB_PRINT_VERIFIED]]

python script to guess the potentials email adress of someone

optional arguments:
  -h, --help            show this help message and exit

Target:
  Set known parameters concerning the target

  -f [FIRSTNAME]        set target's firstname
  -m [MIDDLENAME]       set target's middlename
  -l [LASTNAME]         set target's lastname
  -u [USERNAME]         set target's username
  -n [NUMBER]           set a number to use (year of birth, locality...)

Generation:
  Set parameters concerning the generation

  --verify, -V          tries to verify the addresses using holehe (https://github.com/megadose/holehe)
  --yes, -Y             assumes "yes" as the answer to all questions of validation
  --level {min,low,high,max}, -L {min,low,high,max}
                        choose level of generation (default 'min')
  --resume [RESUME_PATH], -r [RESUME_PATH]
                        select a json file to resume or enrich wich new options
  --separators [SEPARATORS], -s [SEPARATORS]
                        set separators used for the generation of local-parts (default are '-._')

Output:
  Select how the data will be displayed and/or saved

  --print, -P           print generated informations on screen (local-part, emails and verified emails)
  --output [OUTPUT_LOCATION], -O [OUTPUT_LOCATION]
                        choose output location (default is "./output")
  --nb-localparts [NB_PRINT_LOCALPARTS]
                        set the maximum of local-part printed when informations are displayed (default is 20)
  --nb-emails [NB_PRINT_EMAILS]
                        set the maximum of emails printed per domain when informations are displayed (default is 4)
  --nb-verified [NB_PRINT_VERIFIED]
                        set the maximum of verified emails printed per domain when informations are displayed (default is all)

No interactions mod

You enter the No interactions mod when you specify the parameters in the command line.

EXAMPLE

~$ python3 mailfoguess.py -f Pierre -l Croce --print --yes

Interactions mod

You enter Interactions mod when no indication are provided to generate potentials emails.

EXAMPLE

$ python3 mailfoguess.py
$ python3 mailfoguess.py --level high
$ python3 mailfoguess.py --yes

You will get the same result after this part.

Caution

Generating email address is very fast but the verification part can last a long time. For example the command below, (a very bad realistic test case), took me almost 6 hours to verify the 10 000 email address generated from 2300 local-part.

~$ python3 mailfoguess.py -f Bill -m "The Gater" -l Gates -u billythekid -n 1955 --level max --yes

If the verification is to long for you, you can at any time press [ctrl+c] to stop the script. This will save all the data so you can resume the verification using the –resume or -r options.

Output

Results are displayed in console, but everything is recorded and stored by default in ./output/ in a json file.

Example

pierrecroce.json

{
  "firstname": "pierre",
  "middlename": null,
  "lastname": "croce",
  "username": null,
  "number": null,
  "local-parts": [
    "croce",
    "p-croce",
    "p.croce",
    "p_croce",
    "pcroce",
    "pierre",
    "pierre-c",
    "pierre-croce",
    "pierre.c",
    "pierre.croce",
    "pierre_c",
    "pierre_croce",
    "pierrec",
    "pierrecroce"
  ],
  "emails": {
    "gmail.com": {
      "[email protected]": true,
      "[email protected]": true,
      "[email protected]": false,
      "[email protected]": true,
      "[email protected]": true,
      "[email protected]": true,
      "[email protected]": true
    },
    "yahoo.com": {
      "[email protected]": false,
      "[email protected]": false,
      "[email protected]": false,
      "[email protected]": false,
      "[email protected]": false,
      "[email protected]": false,
      "[email protected]": false,
      "[email protected]": false,
      "[email protected]": false,
      "[email protected]": false,
      "[email protected]": false
    },
    "yahoo.fr": {
      "[email protected]": false,
      "[email protected]": false,
      "[email protected]": false,
      "[email protected]": false,
      "[email protected]": false,
      "[email protected]": false,
      "[email protected]": false,
      "[email protected]": false,
      "[email protected]": false,
      "[email protected]": false,
      "[email protected]": false
    },
    "laposte.net": {
      "[email protected]": false,
      "[email protected]": false,
      "[email protected]": false,
      "[email protected]": false,
      "[email protected]": false,
      "[email protected]": false,
      "[email protected]": false,
      "[email protected]": false,
      "[email protected]": false,
      "[email protected]": false,
      "[email protected]": false,
      "[email protected]": false,
      "[email protected]": false,
      "[email protected]": false
    },
    "protonmail.com": {
      "[email protected]": true,
      "[email protected]": true,
      "[email protected]": true,
      "[email protected]": true,
      "[email protected]": true,
      "[email protected]": true,
      "[email protected]": true,
      "[email protected]": true,
      "[email protected]": true,
      "[email protected]": true,
      "[email protected]": true,
      "[email protected]": true,
      "[email protected]": true,
      "[email protected]": true
    }
  }
}

Generation level

Each level includes the previous ones.

Processing each part

Creating lists of names based on given informations:

Generating local-part

• first,middle,last,user represents firstname,middlename,lastname,username
• fini,mini,lini represents the initials of firstname, middlename or lastname
  • If the name is composed, the initials are the concatenation of all initials' part
• ° represent a separator (by default they are '', '-', '.', '_')

Stuff to add

• Colors in the printed output (feel free to help me with that)
• Creation of email
• Verification on email
• Add options to change separators
• Add options to choose providers to use
• Option to choose a country to define the list of domains
• Possibility to stop and resume the script

References

• This tool which help me to verify email address : https://github.com/megadose/holehe

License

GNU General Public License v3.0