# Holehe Modules Using the Password Recovery Method for OSINT Detection

> Discover which Holehe modules use password recovery for OSINT detection. Learn how Adobe, Odnoklassniki, and Samsung modules find secondary emails.

- Repository: [Palenath/holehe](https://github.com/megadose/holehe)
- Tags: how-to-guide
- Published: 2026-08-24

---

**Only the Adobe, Odnoklassniki, and Samsung modules in the megadose/holehe repository implement the "password recovery" detection method to extract secondary email addresses from account recovery endpoints.**

The holehe OSINT framework enumerates platform accounts by exploiting information leakage in password-reset workflows. Among its detection strategies, the **Password Recovery method for detection** specifically targets services that expose secondary email addresses during forgotten-password verification. Only three modules in the current codebase utilize this particular approach, each located in distinct category directories within the modules folder.

## Modules That Implement Password Recovery Detection

The megadose/holehe repository contains three distinct modules that declare `method = "password recovery"` and leverage password-reset APIs to harvest exposed credentials. These modules span software, social media, and product manufacturing platforms.

### Adobe (Software Category)

Located at [`holehe/modules/software/adobe.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/software/adobe.py), the Adobe module targets Adobe's authentication services. It initiates a POST request to Adobe's password-recovery endpoint and parses the JSON response for a `secondaryEmail` field. When present, this value indicates that the account has a recovery email configured, which the module returns under the `emailrecovery` key.

```python
async def adobe(email, client, out):
    name = "adobe"
    domain = "adobe.com"
    method = "password recovery"        # Detection method declaration

    # ... request setup ...

    r = await client.post(...)          # Adobe password-recovery endpoint

    j = r.json()
    if "secondaryEmail" in j:
        out["emailrecovery"] = j["secondaryEmail"]

```

### Odnoklassniki (Social Media Category)

The [`holehe/modules/social_media/odnoklassniki.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/social_media/odnoklassniki.py) file contains the implementation for the Russian social network Odnoklassniki. Following the same pattern, it sends a POST request to the platform's recovery endpoint and checks the response for a `masked_email` field. The module extracts this value and maps it to the standardized `emailrecovery` output key.

```python
async def odnoklassniki(email, client, out):
    name = "odnoklassniki"
    domain = "ok.ru"
    method = "password recovery"        # Detection method declaration

    # ... request setup ...

    r = await client.post(...)          # Password-recovery request

    if "masked_email" in r.json():
        out["emailrecovery"] = r.json()["masked_email"]

```

### Samsung (Products Category)

Found in [`holehe/modules/products/samsung.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/products/samsung.py), the Samsung module interacts with Samsung Account's password-reset flow. It queries the recovery endpoint and examines the JSON response for an `email` field containing the recovery address. This implementation demonstrates how hardware manufacturers' account systems can leak information through standard password recovery mechanisms.

```python
async def samsung(email, client, out):
    name = "samsung"
    domain = "samsung.com"
    method = "password recovery"        # Detection method declaration

    # ... request setup ...

    r = await client.post(...)          # Samsung password-reset flow

    if "email" in r.json():
        out["emailrecovery"] = r.json()["email"]

```

## How Password Recovery Detection Works in Holehe

Each module follows a consistent three-phase workflow to extract intelligence from password-reset endpoints:

1. **Method Declaration**: The module explicitly sets `method = "password recovery"` to identify its detection strategy to the holehe framework.

2. **Endpoint Exploitation**: Using the `client` object (an HTTPX async client), the module sends crafted POST requests to the target service's password-recovery or account-recovery API endpoints.

3. **Response Parsing**: The code parses the JSON response for fields containing recovery email addresses (`secondaryEmail`, `masked_email`, or `email`) and assigns these values to `out["emailrecovery"]` for standardized output.

This pattern exposes a vulnerability class where services reveal account recovery information without proper authentication, allowing OSINT operators to correlate primary email addresses with secondary recovery addresses.

## Summary

- **Adobe**, **Odnoklassniki**, and **Samsung** are the only three modules in megadose/holehe that utilize the Password Recovery detection method.
- Each module declares the detection strategy via `method = "password recovery"` in its respective function.
- The modules target password-reset endpoints at `auth.services.adobe.com`, `ok.ru`, and `samsung.com` respectively.
- Extracted recovery emails are standardized under the `emailrecovery` output key across all implementations.
- Source files are located in [`holehe/modules/software/adobe.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/software/adobe.py), [`holehe/modules/social_media/odnoklassniki.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/social_media/odnoklassniki.py), and [`holehe/modules/products/samsung.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/products/samsung.py).

## Frequently Asked Questions

### What is the Password Recovery detection method in holehe?

The Password Recovery detection method in holehe refers to a specific OSINT technique where modules query a platform's password-reset or account-recovery endpoints to extract secondary email addresses associated with target accounts. Modules using this method declare `method = "password recovery"` and parse responses for fields like `secondaryEmail` or `masked_email` that indicate exposed recovery information.

### How does holehe extract email addresses from password recovery endpoints?

Holehe modules send asynchronous POST requests to platform-specific recovery endpoints using an HTTPX client. They parse the JSON response for specific keys—such as `secondaryEmail` in Adobe, `masked_email` in Odnoklassniki, or `email` in Samsung—and return these values under the standardized `emailrecovery` dictionary key. This extraction occurs without authentication, exploiting information leakage in the password-reset flow.

### Are there other modules in holehe that use similar detection methods?

While holehe contains hundreds of modules using various detection strategies (such as registration checks, login form analysis, or API enumeration), only Adobe, Odnoklassniki, and Samsung currently implement the specific "password recovery" string in their method declarations. Other modules may use similar HTTP techniques but classify them under different detection categories like "login" or "registration".

### Where are the Password Recovery modules located in the holehe codebase?

The three Password Recovery modules reside in distinct category directories within the repository: [`holehe/modules/software/adobe.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/software/adobe.py) for Adobe Creative Cloud services, [`holehe/modules/social_media/odnoklassniki.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/social_media/odnoklassniki.py) for the OK.ru social network, and [`holehe/modules/products/samsung.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/products/samsung.py) for Samsung Account services. Each file contains an async function matching the service name that implements the detection logic.