viralmaniar / xposedornot Goto Github PK

XposedOrNot (XoN) tool is to search an aggregated repository of xposed passwords comprising of ~850 million real time passwords. Usage of such compromised passwords is detrimental to individual account security.

Python 100.00%

osint osinttool password-leak credentials-gathering reconnaissance recon penetration-testing-tools intelligence-gathering password-breach breach-compilation

xposedornot's Introduction

XposedOrNot

Screenshot

What is Xposed Passwords?

The main aim of this project is to give a free platform for the general public to check if their password is exposed and compromised.

This massive password collection is an accumulation of real passwords exposed in various data breaches around the world. Passwords are curated from exposed breaches like Collection #1, Yahoo, etc. Adding to that, passwords are also commonly exposed in "pastes" in pastebin.com. We have taken more than 40,000 such exposures and that is again added to this huge list.

The collated passwords are hashed with a highly secure hashing algorithm SHA-3 ( Keccak-512 ), and stored in a one way hash for verification. No passwords are stored in plain text and the process of checking anonymously is explained in detail in our blog post, 850 million passwords for free explaining the technical and operational controls enforced for enhancing the security posture. Feel free to go through the same.

How to install?

git clone https://github.com/Viralmaniar/XposedOrNot.git
cd XposedOrNot
pip install -r requirements.txt
python XposedorNot.py

How to interpret an output?

The output will consist of JSON output for easy reference. Primary reasons for giving an output in JSON instead of a yes/no is to ensure that this can be further used by people to develop and improve on the huge list of real time exposed passwords aggregated here.

Alright, the first element "anon" is added to all password hashes stored in XoN for enabling privacy conscious users to search as well. Second element "char" is a list of characteristics of the password, which can be further used for understanding the strength of the password to know if this will meet the requirements of applications in need. Many websites have policies on the use of selecting passwords based on number of characters, mixture of alphabets, numbers and special characters.

The following table explains a bit more about the characteristics in simple terms :

Alphabet	Description
Digits	Count of numbers
Alphabets	Count of alphabets
Special chars	Count of special chars
Length	Length of the password

The last one "count" denotes the number of times, this password was observed in the collected xposed data breaches. For a comprehensive list of all xposed websites, please visit Xposed websites-XoN.

Also, one another point to note is the use of Keccak-512 hashing for searching and storing data in XoN. Traditional hashing algorithms like MD5 and SHA1 are currently deprecated and also considering the enormous number of records exposed, I have gone ahead with Keccak-512 hashes.

Yes, Keccak-512 is 128 characters long and it consumes more storage.

Two sample Keccak-512 hashes given for easy reference: test - 1e2e9fc2002b002d75198b7503210c05a1baac4560916a3c6d93bcce3a50d7f00fd395bf1647b9abb8d1afcc9c76c289b0c9383ba386a956da4b38934417789e pass - adf34f3e63a8e0bd2938f3e09ddc161125a031c3c86d06ec59574a5c723e7fdbe04c2c15d9171e05e90a9c822936185f12b9d7384b2bedb02e75c4c5fe89e4d4 Sample output on not finding the matching password hash:

 {
  "Error": "Not found"
}

Collected Passwords timeline - thanks to DevaOnBreaches

Detailed list can be seen here: https://xposedornot.com/xposed

Questions?

Twitter: @ManiarViral
LinkedIn: https://au.linkedin.com/in/viralmaniar

Contribution & License

This work is licensed under a Creative Commons Attribution 4.0 International License.
Want to contribute? Please fork it and hit up with a pull request.

Any suggestions or ideas for this tool are welcome - just tweet me on @ManiarViral

Credit

XposedOrNot is maintained by DevaOnBreaches. Big thanks for creating an API for your service. You can connect with him at https://www.devaonbreaches.com/

xposedornot's People

Contributors

Stargazers

Watchers

xposedornot's Issues

Install Issue

ERROR: Command errored out with exit status 1:
command: /usr/bin/python3 -c 'import sys, setuptools, tokenize; sys.argv[0] = '"'"'/tmp/pip-install-7fc294_z/hashlib/setup.py'"'"'; file='"'"'/tmp/pip-install-7fc294_z/hashlib/setup.py'"'"';f=getattr(tokenize, '"'"'open'"'"', open)(file);code=f.read().replace('"'"'\r\n'"'"', '"'"'\n'"'"');f.close();exec(compile(code, file, '"'"'exec'"'"'))' egg_info --egg-base /tmp/pip-install-7fc294_z/hashlib/pip-egg-info
cwd: /tmp/pip-install-7fc294_z/hashlib/
Complete output (62 lines):
Traceback (most recent call last):
File "", line 1, in
File "/home/user1/.local/lib/python3.6/site-packages/setuptools/init.py", line 18, in
import setuptools.version
File "/home/user1/.local/lib/python3.6/site-packages/setuptools/version.py", line 1, in
import pkg_resources
File "/home/user1/.local/lib/python3.6/site-packages/pkg_resources/init.py", line 36, in
import email.parser
File "/usr/lib/python3.6/email/parser.py", line 12, in
from email.feedparser import FeedParser, BytesFeedParser
File "/usr/lib/python3.6/email/feedparser.py", line 27, in
from email._policybase import compat32
File "/usr/lib/python3.6/email/_policybase.py", line 9, in
from email.utils import _has_surrogates
File "/usr/lib/python3.6/email/utils.py", line 28, in
import random
File "/usr/lib/python3.6/random.py", line 46, in
from hashlib import sha512 as _sha512
File "/tmp/pip-install-7fc294_z/hashlib/hashlib.py", line 80
raise ValueError, "unsupported hash type"
^
SyntaxError: invalid syntax
Error in sys.excepthook:
Traceback (most recent call last):
File "/usr/lib/python3/dist-packages/apport_python_hook.py", line 63, in apport_excepthook
from apport.fileutils import likely_packaged, get_recent_crashes
File "/usr/lib/python3/dist-packages/apport/init.py", line 5, in
from apport.report import Report
File "/usr/lib/python3/dist-packages/apport/report.py", line 12, in
import subprocess, tempfile, os.path, re, pwd, grp, os, time
File "/usr/lib/python3.6/tempfile.py", line 184, in
from random import Random as _Random
File "/usr/lib/python3.6/random.py", line 46, in
from hashlib import sha512 as _sha512
File "/tmp/pip-install-7fc294_z/hashlib/hashlib.py", line 80
raise ValueError, "unsupported hash type"
^
SyntaxError: invalid syntax

Original exception was:
Traceback (most recent call last):
  File "<string>", line 1, in <module>
  File "/home/user1/.local/lib/python3.6/site-packages/setuptools/__init__.py", line 18, in <module>
    import setuptools.version
  File "/home/user1/.local/lib/python3.6/site-packages/setuptools/version.py", line 1, in <module>
    import pkg_resources
  File "/home/user1/.local/lib/python3.6/site-packages/pkg_resources/__init__.py", line 36, in <module>
    import email.parser
  File "/usr/lib/python3.6/email/parser.py", line 12, in <module>
    from email.feedparser import FeedParser, BytesFeedParser
  File "/usr/lib/python3.6/email/feedparser.py", line 27, in <module>
    from email._policybase import compat32
  File "/usr/lib/python3.6/email/_policybase.py", line 9, in <module>
    from email.utils import _has_surrogates
  File "/usr/lib/python3.6/email/utils.py", line 28, in <module>
    import random
  File "/usr/lib/python3.6/random.py", line 46, in <module>
    from hashlib import sha512 as _sha512
  File "/tmp/pip-install-7fc294_z/hashlib/hashlib.py", line 80
    raise ValueError, "unsupported hash type"
                    ^
SyntaxError: invalid syntax
----------------------------------------

ERROR: Command errored out with exit status 1: python setup.py egg_info Check the logs for full command output.

pwnedpasswords

what's the advantage of this versus https://haveibeenpwned.com/Passwords API?

even if the interface seems to be the same...

Python3

App is not working with python3 and pip3.