How the Adobe Module Uses Password Recovery for Account Detection

The Adobe module determines account existence by exploiting Adobe's password-recovery API flow, analyzing authentication state responses and recovery challenge eligibility to distinguish between non-existent, valid, and restricted accounts.

The holehe/modules/software/adobe.py file implements a specialized reconnaissance technique that leverages Adobe's legitimate identity management infrastructure to verify email registration status without authentication credentials. By orchestrating a two-step handshake against Adobe's authentication services, the module extracts secondary contact details while avoiding the need for valid passwords.

Step 1: Initial Authentication State Validation

The detection process begins with a POST request to https://auth.services.adobe.com/signin/v1/authenticationstate. According to the source code in holehe/modules/software/adobe.py, the module constructs a JSON payload containing "username": email and includes the mandatory header X-IMS-CLIENTID: adobedotcom2.

If the response JSON contains an errorCode field, the module immediately concludes the email is non-existent and terminates the check. This early exit prevents unnecessary subsequent requests and reduces detection footprint.

Step 2: Password Recovery Challenge Verification

When the initial authentication state request succeeds, the module extracts the encrypted authentication state from the response headers. This state token is required for subsequent recovery operations and is added to the request headers for the next phase.

The module then issues a GET request to https://auth.services.adobe.com/signin/v2/challenges with the query parameter purpose=passwordRecovery. This endpoint specifically targets Adobe's password-recovery workflow to test account recovery eligibility.

Interpreting Challenge Responses

The module analyzes the JSON response from the recovery challenge endpoint to determine account status:

• Non-existent accounts: Detected in Step 1 via errorCode in the authentication state response.
• Existing accounts with recovery disabled: Return an errorCode during the challenge phase, indicating the account exists but password recovery is unavailable (potentially due to enterprise locks or security restrictions).
• Existing accounts with recovery enabled: Return a valid challenge object containing secondaryEmail (mapped to emailrecovery) and securityPhoneNumber (mapped to phoneNumber), confirming active registration.

Error Handling and Rate Limit Detection

If any network exception, HTTP error, or unexpected response structure occurs during either phase, the module catches the exception and flags the result as rate-limited or unknown. This prevents false negatives during temporary service interruptions or when Adobe implements anti-automation measures, allowing the Holehe orchestrator to handle retry logic appropriately.

Practical Implementation Examples

To execute the Adobe password-recovery check programmatically:

import asyncio
from holehe import core

async def check_adobe(email: str):
    # Initialise the aiohttp client used by Holehe

    async with core.get_client() as client:
        results = []
        # Directly invoke the Adobe module

        await core.modules.software.adobe(email, client, results)
        return results

# Usage

if __name__ == "__main__":
    email_to_test = "example@example.com"
    result = asyncio.run(check_adobe(email_to_test))
    print(result)

For command-line execution targeting only the Adobe module:

holehe -u example@example.com -m adobe

The output contains a JSON object with fields exists, emailrecovery, and phoneNumber reflecting the detection outcome and any recovered contact metadata.

Summary

• The Adobe module sends a POST request to /signin/v1/authenticationstate to validate if an email exists in Adobe's systems.
• Valid accounts trigger a second GET request to /signin/v2/challenges?purpose=passwordRecovery to test recovery eligibility.
• Secondary contact information (backup email and phone number) is extracted from successful recovery challenge responses.
• An errorCode in the initial response indicates a non-existent account, while an errorCode in the challenge response indicates an existing but restricted account.
• All exceptions are handled as potential rate limits, marking results as unknown rather than false negatives.

Frequently Asked Questions

What specific Adobe endpoints does the module target?

The module targets two primary Adobe identity management endpoints: auth.services.adobe.com/signin/v1/authenticationstate for initial email validation and auth.services.adobe.com/signin/v2/challenges for password-recovery capability verification.

How does the module distinguish between non-existent and disabled accounts?

Non-existent accounts return an errorCode during the initial authentication state request, while disabled or locked accounts pass the initial check but return an errorCode during the recovery challenge phase.

What account metadata can be extracted beyond simple existence?

When password recovery is enabled, the module extracts the account's registered secondary email address (secondaryEmail) and phone number (securityPhoneNumber) from the challenge response, providing additional reconnaissance value.

How does the module handle Adobe's rate limiting?

Any network errors, HTTP exceptions, or unexpected response formats trigger the exception handler in holehe/modules/software/adobe.py, which marks the check result as rate-limited or unknown rather than returning a definitive false negative.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}