What Is the Forgotten Password Function in Holehe and How Does It Work?

The forgotten password function in Holehe is an OSINT technique that abuses password-reset endpoints to verify whether an email address is registered on a service without authenticating.

Holehe is an open-source reconnaissance tool developed by megadose that determines email address presence across hundreds of online platforms. Rather than attempting login brute-forcing, it exploits a common service behavior: password-reset endpoints typically validate email addresses and return distinct responses for registered versus unknown accounts. This article explains how Holehe implements this technique, with reference to actual source code from the repository.

Why Services Expose Email Verification via Password Reset

Most web applications provide a "Forgot Password" flow to help users regain account access. These endpoints accept an email address and return a success message if the account exists, or an error if it does not. Holehe capitalizes on this discrepancy to perform email enumeration at scale without triggering account lockouts or rate limits associated with authentication attempts.

According to the repository's own description in setup.py:

"holehe allows you to check if the mail is used on different sites like twitter, instagram, snapchat and will retrieve information on sites with the forgotten password function."

This capability is reiterated in the README, which lists as a core feature: "+ Retrieves information using the forgotten password function."

How the Forgotten Password Check Is Implemented

Each Holehe module targets a specific service and implements its own password-reset probing logic. The general pattern involves:

1. Constructing a request to the service's password-reset endpoint
2. Parsing the response for indicators of account existence
3. Returning a structured result indicating whether the email is registered

Concrete Example: The Samsung Module

The Samsung module demonstrates this technique explicitly. Located at holehe/modules/products/samsung.py, it sends a POST request to Samsung's password-reset endpoint and interprets the response.

Key implementation details from lines 75-94:

• Endpoint: https://account.samsung.com/accounts/v1/DCGLIT/resetPassword
• Method: POST with email in request body
• Detection logic: Response status code and body content distinguish between registered and unknown emails

The module structure follows this pattern:

# Conceptual representation based on samsung.py implementation

async def check_email(self, email, client):
    """Probe Samsung account existence via password reset endpoint."""
    
    # Prepare payload for password reset request

    payload = {
        "email": email,
        # Additional required parameters (CSRF tokens, etc.)

    }
    
    # Send request to Samsung's reset endpoint

    response = await client.post(
        "https://account.samsung.com/accounts/v1/DCGLIT/resetPassword",
        data=payload,
        follow_redirects=True
    )
    
    # Parse response indicators

    if response.status_code == 200:
        # Check response body for success/failure markers

        result_text = await response.text()
        return {
            "exists": "account exists" in result_text.lower() or 
                      "verification" in result_text.lower(),
            "source": "forgotten_password_endpoint"
        }
    
    return {"exists": False, "source": "forgotten_password_endpoint"}

Core Architecture: How Modules Are Orchestrated

The holehe/core.py file manages module execution. It coordinates concurrent checks across all configured services, aggregating results into a unified output. When you invoke Holehe programmatically:

import asyncio
from holehe.core import Core

# Initialize with target email

core = Core("target@example.com")

# Execute all module checks concurrently

results = asyncio.run(core.run())

# Process results

for platform, data in results.items():
    if data.get("exists"):
        print(f"[+] Account found on {platform}")
        print(f"    Confidence: {data.get('confidence', 'medium')}")
        print(f"    Source: {data.get('source', 'unknown')}")

Each module in holehe/modules/ follows a consistent interface, implementing an asynchronous check_email or similar method that returns a standardized dictionary with keys including exists, source, and optionally profile_info.

Common Response Patterns Across Services

Different services leak email existence through varying mechanisms. Holehe modules account for these variations:

Pattern	Detection Method	Example Services
Direct confirmation message	String match on "password reset sent"	Generic PHP-based platforms
Response timing	Time-based side channel (registered = slower)	Some Django applications
Status code differentiation	HTTP 200 vs 404/400	REST API-based services
Redirect behavior	URL path changes on success	Legacy ASP.NET applications
Error code specificity	Distinct error codes for unknown emails	Enterprise SSO providers

Module authors reverse-engineer these behaviors through manual testing and traffic analysis, then encode the detection logic in Python.

Practical Usage Example

To run Holehe against a target email from the command line:

# Installation

pip install holehe

# Basic usage - checks all supported platforms

holehe target@example.com

# Output includes source of detection

# [+] samsung.com - Account found (source: forgotten_password)

# [+] twitter.com - Account found (source: forgotten_password)

# [-] instagram.com - No account detected

The --output flag allows structured export (JSON/CSV) for further analysis in threat intelligence workflows.

Security and Ethical Considerations

Holehe's forgotten password enumeration technique is passive and non-destructive—it does not modify account state or trigger actual password reset emails in most implementations. However, users should note:

• Some services do send emails during probing; use test accounts when validating
• Rate limiting may apply; the tool includes configurable delays
• This technique violates most platforms' Terms of Service; use only on authorized targets

Summary

• Primary purpose: The forgotten password function in Holehe enables email enumeration across services by exploiting password-reset endpoint responses
• Implementation location: Service-specific modules in holehe/modules/*/*.py, with holehe/modules/products/samsung.py serving as a reference implementation
• Core mechanism: HTTP POST to reset endpoints with response analysis for account-existence indicators
• Orchestration: holehe/core.py manages concurrent execution across all platform modules
• Documentation: Explicitly described in setup.py (line 12) and README.md (line 18) as a core reconnaissance technique

Frequently Asked Questions

How does Holehe's forgotten password technique differ from traditional credential stuffing?

Credential stuffing involves submitting known username-password pairs from breached databases. Holehe's forgotten password enumeration requires no password knowledge—it probes whether an email is registered by analyzing how services respond to reset requests. This produces fewer security alerts and avoids account lockout policies.

Can services prevent this type of email enumeration?

Services can mitigate this by returning identical responses regardless of email registration status (e.g., "If an account exists, a reset email has been sent"). However, timing side channels and out-of-band email delivery often still leak information. Proper implementation requires careful attention to response uniformity, timing consistency, and logging behavior.

Does Holehe trigger actual password reset emails when probing?

Behavior varies by module implementation. Most Holehe modules use null-routed or test-mode parameters where possible, or analyze pre-submit validation responses. Some services, however, send emails regardless. The Samsung module specifically (lines 75-94) targets an endpoint that validates email format and existence before triggering email dispatch.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}