How `--no-password-recovery` Filters Password Recovery Modules in holehe

The --no-password-recovery flag excludes four specific modules—adobe, mail_ru, odnoklassniki, and samsung—by checking their source code for those identifiers and omitting them from the active scan list.

holehe is an open-source OSINT tool by megadose/holehe that checks for account registrations across hundreds of websites using email addresses. Some modules employ password recovery methods rather than direct registration checks, which may trigger security alerts or account lockouts. The --no-password-recovery flag lets users skip these higher-risk modules entirely.

Where the Flag Is Parsed in holehe

The flag processing happens in holehe/core.py, where the CLI argument parser defines -NP as the short form:

parser.add_argument("-NP","--no-password-recovery",
                    default=False, required=False,
                    action="store_true",
                    dest="nopasswordrecovery",
                    help="Do not try password recovery on the websites")

When present, args.nopasswordrecovery becomes True and propagates through the module selection logic.

How Module Filtering Works

holehe discovers all submodules under holehe/modules via import_submodules(), then builds the execution list in get_functions(). The filtering logic checks each module's source code as a string:

if args.nopasswordrecovery == True:
    if  "adobe" not in str(modu.__dict__[site]) \
        and "mail_ru" not in str(modu.__dict__[site]) \
        and "odnoklassniki" not in str(modu.__dict__[site]) \
        and "samsung" not in str(modu.__dict__[site]):
        websites.append(modu.__dict__[site])
else:
    websites.append(modu.__dict__[site])

This string-based check is case-sensitive and relies on the module's __dict__ representation containing those specific identifier substrings.

The Four Password Recovery Modules Excluded

Module	File Path	Method Declaration
Adobe	holehe/modules/software/adobe.py	method = "password recovery"
Mail.ru	holehe/modules/mails/mail_ru.py	method = "password recovery"
Odnoklassniki	holehe/modules/social_media/odnoklassniki.py	method = "password recovery"
Samsung	holehe/modules/products/samsung.py	method = "password recovery"

Each of these modules sets method = "password recovery" at line 8 of their respective files, making them easy to identify programmatically through string inspection.

Command-Line Usage Examples

Run holehe with full module coverage (default behavior):

holehe target@example.com

Disable password recovery checks to reduce detection risk:

holehe target@example.com --no-password-recovery

Or use the short flag:

holehe target@example.com -NP

Programmatic Access to Filtered Modules

You can replicate the flag's behavior in Python scripts by mocking the argument namespace:

from holehe.core import import_submodules, get_functions

# Load all available modules

modules = import_submodules("holehe.modules")

# Simulate --no-password-recovery flag

class Args:
    nopasswordrecovery = True

args = Args()
filtered_modules = get_functions(modules, args)

# Verify exclusion

print([m.__name__ for m in filtered_modules])

# adobe, mail_ru, odnoklassniki, samsung will NOT appear

Summary

• The --no-password-recovery flag sets args.nopasswordrecovery = True in holehe/core.py
• When enabled, get_functions() performs string inspection on module source code
• Four modules containing "adobe", "mail_ru", "odnoklassniki", or "samsung" are excluded from the websites list
• This prevents password recovery API calls that may trigger rate limits or security notifications
• Both long form (--no-password-recovery) and short form (-NP) are supported

Frequently Asked Questions

What is the difference between standard modules and password recovery modules in holehe?

Standard modules query registration databases or login endpoints directly. Password recovery modules exploit the "forgot password" flow, submitting the target email to determine if an account exists. This method carries higher risk of detection and potential account lockouts.

Why does holehe use string matching instead of checking the method attribute directly?

The filtering logic in holehe/core.py inspects str(modu.__dict__[site]) rather than accessing method attributes programmatically. This implementation choice simplifies the check but ties module exclusion to specific hardcoded identifiers in the source code.

Can I exclude other modules using the same flag?

No. The --no-password-recovery flag only excludes the four specific modules with hardcoded identifier checks. To exclude other modules, you would need to modify the filtering logic in holehe/core.py or use the tool's module selection features if available in your version.

Is the password recovery method less reliable than other checks?

Password recovery methods can be equally or more reliable for determining account existence, but they interact with security-sensitive endpoints. Some platforms monitor these flows more aggressively, making the --no-password-recovery flag valuable for stealth-conscious reconnaissance.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}