<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: conducting-breach-data-analysis
description: >-
  Analyze publicly available breach datasets to identify exposed credentials,
  password patterns, and organizational security posture for authorized
  security assessments.
domain: cybersecurity
subdomain: osint-recon
tags:
  - breach-data
  - credential-analysis
  - password-patterns
  - data-exposure
  - haveibeenpwned
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: >-
  h8mail, HIBP API, DeHashed API, pwndb, Scylla, breach-parse,
  username-anarchy, hashcat, john.
metadata:
  mitre-attack:
    - "T1589.001"  # Gather Victim Identity Information: Credentials
    - "T1589.002"  # Gather Victim Identity Information: Email Addresses
    - "T1110.001"  # Brute Force: Password Guessing
    - "T1552.001"  # Unsecured Credentials: Credentials In Files
---

# Conducting Breach Data Analysis

## Overview

Breach data analysis examines publicly available credential dumps, data
exposures, and breach notifications to assess an organization's credential
hygiene. During authorized engagements, this identifies password reuse
patterns, weak credential policies, and accounts with known compromised
passwords. This intelligence supports password spraying, credential stuffing
simulations, and security awareness recommendations.

## Prerequisites

- h8mail for automated breach data searches
- Have I Been Pwned (HIBP) API key for breach lookup
- DeHashed API credentials for advanced searches
- hashcat or john for password pattern analysis
- breach-parse for local breach database queries
- Python 3.10+ with `requests`, `hashlib`

```bash
pip install h8mail requests
# HIBP API key from https://haveibeenpwned.com/API/Key
# DeHashed API from https://www.dehashed.com/
```

## Quick Reference

| Task | Command |
|------|---------|
| HIBP check | `curl -s -H "hibp-api-key: $HIBP_KEY" "https://haveibeenpwned.com/api/v3/breachedaccount/user@target.com"` |
| h8mail search | `h8mail -t user@target.com --config h8mail_config.ini` |
| Bulk breach check | `h8mail -t emails.txt --config h8mail_config.ini -o results.json` |
| DeHashed search | `curl -s -u "$DH_EMAIL:$DH_KEY" "https://api.dehashed.com/search?query=domain:target.com"` |
| Password audit | `hashcat -m 0 hashes.txt rockyou.txt --rules best64.rule` |
| HIBP domain | `curl -s -H "hibp-api-key: $HIBP_KEY" "https://haveibeenpwned.com/api/v3/breaches" \| jq '.[].Name'` |
| Pwned passwords | `echo -n "password" \| sha1sum \| cut -c1-5 \| xargs -I {} curl -s "https://api.pwnedpasswords.com/range/{}"` |
| Pattern extract | `cat passwords.txt \| grep -oP '[A-Z][a-z]+[0-9]+[!@#$]?' \| sort \| uniq -c \| sort -rn` |

## Workflow

### Step 1: Domain-Level Breach Assessment

```bash
# HIBP — check all breaches
curl -s -H "hibp-api-key: $HIBP_KEY" \
  "https://haveibeenpwned.com/api/v3/breaches" \
  | jq '[.[] | select(.Domain != "") | {Name, Domain, BreachDate, PwnCount}]'

# DeHashed — domain-wide search
curl -s -u "$DH_EMAIL:$DH_KEY" \
  "https://api.dehashed.com/search?query=domain:target.com&size=100" \
  | jq '.entries[] | {email, password, hashed_password, database_name}'
```

### Step 2: Individual Account Checking

```bash
# h8mail — automated multi-source breach search
h8mail -t user@target.com --config h8mail_config.ini -o single_result.json

# Bulk employee check
h8mail -t employee_emails.txt --config h8mail_config.ini -o bulk_results.json

# HIBP API — individual account
curl -s -H "hibp-api-key: $HIBP_KEY" \
  "https://haveibeenpwned.com/api/v3/breachedaccount/user@target.com?truncateResponse=false" \
  | jq '.[].Name'
```

### Step 3: Password Pattern Analysis

```bash
# Extract password patterns from breach data
cat breach_passwords.txt | awk '{print length}' | sort -n | uniq -c | sort -rn > length_dist.txt

# Common base words
cat breach_passwords.txt | tr '[:upper:]' '[:lower:]' | \
  sed 's/[0-9]*$//' | sed 's/[!@#$%^&*]*$//' | sort | uniq -c | sort -rn | head -20

# Identify password policy indicators
cat breach_passwords.txt | grep -cP '^(?=.*[A-Z])(?=.*[a-z])(?=.*[0-9]).{8,}$'
```

### Step 4: Pwned Password Verification

```bash
# Check password against HIBP Pwned Passwords (k-anonymity)
HASH=$(echo -n "password123" | sha1sum | awk '{print toupper($1)}')
PREFIX=${HASH:0:5}
SUFFIX=${HASH:5}
curl -s "https://api.pwnedpasswords.com/range/$PREFIX" | grep "$SUFFIX"
```

### Step 5: Compile Breach Intelligence Report

```bash
node agent.js --domain target.com --full --output breach_report.json
```

## Detection Opportunities

- HIBP API queries are logged per API key — targeted account checks visible
- DeHashed queries are authenticated and logged
- Credential stuffing attempts from breach data trigger account lockouts
- Password spraying with breach-derived patterns may trigger SIEM alerts

## Verification

- [ ] Domain-level breach exposure assessed across databases
- [ ] Employee emails checked against known breaches
- [ ] Password patterns analyzed for policy weaknesses
- [ ] Credential reuse across services identified
- [ ] Breach timeline established showing exposure windows
- [ ] Recommendations generated for credential hygiene improvements

## References

- [Have I Been Pwned](https://haveibeenpwned.com/)
- [h8mail](https://github.com/khast3x/h8mail)
- [DeHashed](https://www.dehashed.com/)
- [HIBP API Documentation](https://haveibeenpwned.com/API/v3)
- [Pwned Passwords](https://haveibeenpwned.com/Passwords)

---
v1.0 | Validated: 2026-03-17
