3 ms·
Agree, used it to build this as a proof of concept: https://emailprofile.herokuapp.com/ https://emailprofile.herokuapp.com/ Many sites don't consider user enum
by lxchase 10y ago
Agree, used it to build this as a proof of concept: https://emailprofile.herokuapp.com/ https://emailprofile.herokuapp.com/
Many sites don't consider user enumeration a bug/threat, but theoretically given enough sites, one could build a profile around a specific email address.
- LunaSea 10y agoHave you open-sources this package somewhere? As an amateur web security researcher this project looks really interesting.
- lxchase 10y agoI haven't yet. I'm a bit torn on whether or not to release it given the potential privacy implications. With more sites and a classification algorithm, one could say an email is a "Gender, Race, Age Range, Job Industry, Interests, etc." What makes this tool work is most sites (as an UX feature) will tell you if an account/email already exists. Whether that be an API call or a notice saying "Your password is incorrect", you'll be able to get the data you need. It was a learning experience for me to use Go to wrap each site check in its own goroutine to leverage concurrency. Quite nice.