wKovacs64/pwned

# pwned _一个用于查询 [Troy Hunt][troy] 的 [Have I been pwned?][haveibeenpwned] 服务的命令行工具_ 使用 [hibp][hibp] Node.js 模块。 [][npm-url] [][ci-url] [][coverage-url] ## 安装 下载并安装 [Node.js][nodejs]，然后使用 `npm` 全局安装 `pwned`： ``` npm install pwned -g ``` 或者，你可以使用 [`npx`][npx] 包运行器按需运行： ``` npx pwned ``` ## 受保护的命令 2019 年 7 月 18 日，haveibeenpwned.com API 将多项服务移至需要身份验证的接口， 要求使用 API 密钥。若要使用 `pwned` 的部分命令（例如 `ba`、`pa` 和 `search`），你需要 [获取 API 密钥][get-api-key] 并运行 `pwned apiKey` 来配置 `pwned`。其他命令不需要 API 密钥， 你可以在不获取密钥的情况下使用它们。 ## 用法 ``` pwned Commands: pwned apiKey [key] set the API key to be used for authenticated requests pwned ba get all breaches for an account (username or email address) pwned bd get all breached email addresses for a domain pwned breach get a single breached site by breach name pwned breaches get all breaches in the system pwned dc get all data classes in the system pwned lb get the most recently added breach pwned pa get all pastes for an account (email address) pwned pw securely check a password for public exposure pwned sd get all subscribed domains for your account pwned search search breaches and pastes for an account (username or email address) pwned slbe get all stealer log domains for an email address pwned slbed get all stealer log email aliases for an email domain pwned slbwd get all stealer log email addresses for a website domain pwned subStatus get the subscription status of your API key Options: -h, --help Show help [boolean] -v, --version Show version number [boolean] ``` #### 示例 获取账户的所有数据泄露信息： ``` $ pwned ba pleasebeclean@fingerscrossed.tld ✔ Good news — no pwnage found! ``` 获取系统中所有数据泄露信息，仅过滤 `adobe.com` 域的结果： ``` $ pwned breaches -d adobe.com - Title: Adobe Name: Adobe Domain: adobe.com BreachDate: 2013-10-04 AddedDate: 2013-12-04T00:00:00Z ModifiedDate: 2013-12-04T00:00:00Z PwnCount: 152445165 Description: In October 2013, 153 million Adobe accounts were breached with each containing an internal ID, username, email, encrypted password and a password hint in plain text. The password cryptography was poorly done and many were quickly resolved back to plain text. The unencrypted hints also disclosed much about the passwords adding further to the risk that hundreds of millions of Adobe customers already faced. DataClasses: - Email addresses - Password hints - Passwords - Usernames IsVerified: true IsFabricated: false IsSensitive: false IsActive: true IsRetired: false IsSpamList: false LogoType: svg ``` 通过泄露名称获取单个被泄露的站点： ``` $ pwned breach MyCompany ✔ No breach found by that name. ``` 获取系统中所有数据类别，以原始 JSON 格式返回，供外部/链式使用： ``` $ pwned dc --raw ["Account balances","Address book contacts","Age groups","Ages","Apps installed on devices","Astrological signs","Auth tokens","Avatars","Bank account numbers","Banking PINs","Beauty ratings","Biometric data","Browser user agent details","Buying preferences","Car ownership statuses","Career levels","Cellular network names","Charitable donations","Chat logs","Credit card CVV","Credit cards","Credit status information","Customer feedback","Customer interactions","Dates of birth","Deceased date","Deceased statuses","Device information","Device usage tracking data","Drinking habits","Drug habits","Eating habits","Education levels","Email addresses","Email messages","Employers","Ethnicities","Family members' names","Family plans","Family structure","Financial investments","Financial transactions","Fitness levels","Genders","Geographic locations","Government issued IDs","Health insurance information","Historical passwords","Home ownership statuses","Homepage URLs","IMEI numbers","IMSI numbers","Income levels","Instant messenger identities","IP addresses","Job titles","MAC addresses","Marital statuses","Names","Nationalities","Net worths","Nicknames","Occupations","Parenting plans","Partial credit card data","Passport numbers","Password hints","Passwords","Payment histories","Payment methods","Personal descriptions","Personal health data","Personal interests","Phone numbers","Physical addresses","Physical attributes","Political donations","Political views","Private messages","Professional skills","Profile photos","Purchases","Purchasing habits","Races","Recovery email addresses","Relationship statuses","Religions","Reward program balances","Salutations","School grades (class levels)","Security questions and answers","Sexual fetishes","Sexual orientations","Smoking habits","SMS messages","Social connections","Social media profiles","Spoken languages","Support tickets","Survey results","Time zones","Travel habits","User statuses","User website URLs","Usernames","Utility bills","Vehicle details","Website activity","Work habits","Years of birth","Years of professional experience"] ``` 获取电子邮件地址的所有粘贴记录： ``` $ pwned pa nobody@nowhere.com - Source: Pastebin Id: YrpQA60S Title: null Date: 2018-01-24T07:54:15Z EmailCount: 16476 - Source: Pastebin Id: suPshHZ1 Title: null Date: 2017-09-06T03:41:33Z EmailCount: 20444 - Source: Pastebin Id: xyb8vavK Title: null Date: 2015-06-01T00:16:46Z EmailCount: 8 - Source: Pastebin Id: DaaFj8Be Title: CrackingCore - Redder04 Date: 2015-04-05T22:22:39Z EmailCount: 116 - Source: Pastebin Id: 9MAAgecd Title: IPTV Yabancı Combolist Date: 2015-02-07T15:21:00Z EmailCount: 244 - Source: Pastebin Id: QMx1dPUT Title: null Date: 2015-02-02T20:45:00Z EmailCount: 6607 - Source: Pastebin Id: zUFSee4n Title: nethingoez Date: 2015-01-21T15:13:00Z EmailCount: 312 - Source: AdHocUrl Id: http://siph0n.in/exploits.php?id=4560 Title: BuzzMachines.com 40k+ Date: null EmailCount: 36959 - Source: AdHocUrl Id: http://siph0n.in/exploits.php?id=4737 Title: PayPalSucks Database 102k Date: null EmailCount: 82071 - Source: AdHocUrl Id: http://balockae.online/files/BlackMarketReloaded_users.sql Title: balockae.online Date: null EmailCount: 10547 ``` 通过范围安全地[按范围搜索][search-by-range] 检查密码是否曾在数据泄露中暴露： ``` $ pwned pw Password1234 ⚠ Oh no — pwned 3360 times! ``` 搜索账户的泄露和粘贴记录（截断泄露数据）： ``` $ pwned search nobody breaches: - Name: BattlefieldHeroes - Name: CannabisForum - Name: Forbes - Name: Gawker - Name: HackForums - Name: LoungeBoard - Name: PokemonCreed - Name: Win7Vista pastes: null ``` ## 许可证 本工具在 [MIT 许可证][LICENSE.txt] 下分发。

标签：API客户端, GNU通用公共许可证, Have I Been Pwned, HaveIBeenPwned, hibp, MITM代理, Node.js, npm, npx, SEO安全工具, Troy Hunt, 域查询, 密码安全, 密码暴露查询, 密码检查, 数据泄露查询, 暗色界面, 自动化攻击, 认证查询