Holehe Modules Using the Password Recovery Method for OSINT Detection

Only the Adobe, Odnoklassniki, and Samsung modules in the megadose/holehe repository implement the "password recovery" detection method to extract secondary email addresses from account recovery endpoints.

The holehe OSINT framework enumerates platform accounts by exploiting information leakage in password-reset workflows. Among its detection strategies, the Password Recovery method for detection specifically targets services that expose secondary email addresses during forgotten-password verification. Only three modules in the current codebase utilize this particular approach, each located in distinct category directories within the modules folder.

Modules That Implement Password Recovery Detection

The megadose/holehe repository contains three distinct modules that declare method = "password recovery" and leverage password-reset APIs to harvest exposed credentials. These modules span software, social media, and product manufacturing platforms.

Adobe (Software Category)

Located at holehe/modules/software/adobe.py, the Adobe module targets Adobe's authentication services. It initiates a POST request to Adobe's password-recovery endpoint and parses the JSON response for a secondaryEmail field. When present, this value indicates that the account has a recovery email configured, which the module returns under the emailrecovery key.

async def adobe(email, client, out):
    name = "adobe"
    domain = "adobe.com"
    method = "password recovery"        # Detection method declaration

    # ... request setup ...

    r = await client.post(...)          # Adobe password-recovery endpoint

    j = r.json()
    if "secondaryEmail" in j:
        out["emailrecovery"] = j["secondaryEmail"]

Odnoklassniki (Social Media Category)

The holehe/modules/social_media/odnoklassniki.py file contains the implementation for the Russian social network Odnoklassniki. Following the same pattern, it sends a POST request to the platform's recovery endpoint and checks the response for a masked_email field. The module extracts this value and maps it to the standardized emailrecovery output key.

async def odnoklassniki(email, client, out):
    name = "odnoklassniki"
    domain = "ok.ru"
    method = "password recovery"        # Detection method declaration

    # ... request setup ...

    r = await client.post(...)          # Password-recovery request

    if "masked_email" in r.json():
        out["emailrecovery"] = r.json()["masked_email"]

Samsung (Products Category)

Found in holehe/modules/products/samsung.py, the Samsung module interacts with Samsung Account's password-reset flow. It queries the recovery endpoint and examines the JSON response for an email field containing the recovery address. This implementation demonstrates how hardware manufacturers' account systems can leak information through standard password recovery mechanisms.

async def samsung(email, client, out):
    name = "samsung"
    domain = "samsung.com"
    method = "password recovery"        # Detection method declaration

    # ... request setup ...

    r = await client.post(...)          # Samsung password-reset flow

    if "email" in r.json():
        out["emailrecovery"] = r.json()["email"]

How Password Recovery Detection Works in Holehe

Each module follows a consistent three-phase workflow to extract intelligence from password-reset endpoints:

1. Method Declaration: The module explicitly sets method = "password recovery" to identify its detection strategy to the holehe framework.

2. Endpoint Exploitation: Using the client object (an HTTPX async client), the module sends crafted POST requests to the target service's password-recovery or account-recovery API endpoints.

3. Response Parsing: The code parses the JSON response for fields containing recovery email addresses (secondaryEmail, masked_email, or email) and assigns these values to out["emailrecovery"] for standardized output.

This pattern exposes a vulnerability class where services reveal account recovery information without proper authentication, allowing OSINT operators to correlate primary email addresses with secondary recovery addresses.

Summary

• Adobe, Odnoklassniki, and Samsung are the only three modules in megadose/holehe that utilize the Password Recovery detection method.
• Each module declares the detection strategy via method = "password recovery" in its respective function.
• The modules target password-reset endpoints at auth.services.adobe.com, ok.ru, and samsung.com respectively.
• Extracted recovery emails are standardized under the emailrecovery output key across all implementations.
• Source files are located in holehe/modules/software/adobe.py, holehe/modules/social_media/odnoklassniki.py, and holehe/modules/products/samsung.py.

Frequently Asked Questions

What is the Password Recovery detection method in holehe?

The Password Recovery detection method in holehe refers to a specific OSINT technique where modules query a platform's password-reset or account-recovery endpoints to extract secondary email addresses associated with target accounts. Modules using this method declare method = "password recovery" and parse responses for fields like secondaryEmail or masked_email that indicate exposed recovery information.

How does holehe extract email addresses from password recovery endpoints?

Holehe modules send asynchronous POST requests to platform-specific recovery endpoints using an HTTPX client. They parse the JSON response for specific keys—such as secondaryEmail in Adobe, masked_email in Odnoklassniki, or email in Samsung—and return these values under the standardized emailrecovery dictionary key. This extraction occurs without authentication, exploiting information leakage in the password-reset flow.

Are there other modules in holehe that use similar detection methods?

While holehe contains hundreds of modules using various detection strategies (such as registration checks, login form analysis, or API enumeration), only Adobe, Odnoklassniki, and Samsung currently implement the specific "password recovery" string in their method declarations. Other modules may use similar HTTP techniques but classify them under different detection categories like "login" or "registration".

Where are the Password Recovery modules located in the holehe codebase?

The three Password Recovery modules reside in distinct category directories within the repository: holehe/modules/software/adobe.py for Adobe Creative Cloud services, holehe/modules/social_media/odnoklassniki.py for the OK.ru social network, and holehe/modules/products/samsung.py for Samsung Account services. Each file contains an async function matching the service name that implements the detection logic.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}