aeondave/holehe
offensive-tools/osint/holehe/SKILL.md
Check if an email address is registered on 120+ websites using account-recovery probes (not login attempts). Use during OSINT to enumerate a target's active accounts from a known email, confirm email validity, or map digital footprint before phishing/social engineering.
$ install --global
skillsauthnpx skillsauth add aeondave/malskill holeheInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 19, 2026, 4:50 AM181.4s2 files scanned
SKILL.md
- name:
- holehe
- description:
- Check if an email address is registered on 120+ websites using account-recovery probes (not login attempts). Use during OSINT to enumerate a target's active accounts from a known email, confirm email validity, or map digital footprint before phishing/social engineering.
- license:
- MIT
- compatibility:
- Python 3; pip install holehe; Linux/macOS/Windows; github.com/megadose/holehe
- author:
- AeonDave
- version:
- 1.1
Holehe
Email-to-account mapper — check if an email is registered across 120+ services.
Quick Start
pip install holehe
# Check a single email
holehe [email protected]
# Output only registered sites
holehe [email protected] --only-used
# JSON output
holehe [email protected] --only-used --json > results.json
Core Flags
| Flag | Purpose |
|------|---------|
| --only-used | Show only sites where email is registered |
| --no-color | Disable color output |
| --json | JSON output |
| -T N | Timeout per request |
Sites Checked (examples)
Google · Twitter/X · GitHub · Instagram · LinkedIn · Reddit · Snapchat · Spotify · Adobe · Airbnb · Amazon · Dropbox · Flickr · Pinterest · Tumblr + 100 more
Common Workflows
OSINT on target email:
holehe [email protected] --only-used --json | tee email_presence.json
Batch check from file:
cat emails.txt | xargs -I {} holehe {} --only-used
Combine with username pivot:
# If target email is [email protected], extract username
holehe [email protected] --only-used --json | jq '.[] | .name' | \
xargs -I {} echo "sherlock johndoe --site {}"
How It Works
Holehe uses account-recovery flows (password reset) — not login attempts. Most sites respond differently to "email not found" vs "reset link sent", so holehe detects registration without credentials. Low noise, does not lock accounts.
Email Sources for OSINT
# From company domain — harvest emails with theHarvester first
theHarvester -d target.com -b google,bing,linkedin -l 200
# From breach databases
# dehashed.com, haveibeenpwned.com, intelx.io
# From GitHub commits
curl "https://api.github.com/repos/<owner>/<repo>/commits" | \
jq '.[].commit.author.email' | sort -u
Resources
| File | When to load |
|------|--------------|
| references/email-osint.md | Email harvesting sources, breach lookup APIs, pivot from email to full profile |
Related Skills
aeondave/offensive-linux-role
data-ai
VerifiedTrustedCommunity
Scoped routing: Linux operator; hosts, sessions, users, services, packages, logs, containers, SSH, network paths, privilege evidence.
4SKILL.mdUpdated Jun 5, 2026
aeondave/ics-technique
development
VerifiedTrustedCommunity
Offensive methodology for ICS/OT/SCADA environments in authorized industrial penetration testing and red team operations. Use when assessing PLCs, RTUs, HMIs, engineering workstations, historians, or field devices running Modbus, DNP3, EtherNet/IP, S7comm/S7+, Profinet, IEC 60870-5-104, BACnet, or OPC-UA. Covers passive OT network enumeration, protocol-level device interrogation, PLC coil/register read-write attacks, HMI session exploitation, historian and engineering workstation compromise, and safe escalation rules for critical infrastructure scope. Does not cover: general IT network exploitation (network-technique), physical hardware interfaces UART/JTAG/SPI (hardware-technique), wireless sensor network attacks (wireless-technique), RF/SDR signal analysis (hardware-ctf or wireless-technique), or CTF-framed ICS lab tasks (ics-ctf).
4SKILL.mdUpdated Jun 2, 2026
aeondave/game-technique
tools
VerifiedTrustedCommunity
Offensive methodology for authorized game security assessments, game client security research, and game-adjacent penetration testing in real-world engagements. Use when assessing game clients for cheating vulnerabilities, testing anti-cheat effectiveness, auditing game server protocols for score manipulation or economic fraud, reverse engineering game DRM or license validation, analyzing game save file protection, or assessing game mod/plugin security. Covers: process memory scanning and manipulation (Cheat Engine methodology), game binary reversing for license and DRM bypass, game network protocol analysis and packet replay, anti-cheat mechanism analysis, save file format reversing and tampering, speed hack and value injection techniques. Does NOT cover: CTF game challenges (game-ctf), game engine source code auditing (web-exploit-technique or vuln-search-technique for the backend), or general binary exploitation (pwn-ctf or reversing-technique).
4SKILL.mdUpdated Jun 2, 2026
aeondave/hardware-technique
development
VerifiedTrustedCommunity
Auth assessment: hardware/embedded methodology; UART/JTAG/SWD/SPI/I2C, firmware extraction, boot/debug paths, embedded OS evidence.
4SKILL.mdUpdated Jun 2, 2026