People Breach Intel

---
name: people-breach-intel
description: "Breach data lookup, HudsonRock infostealer intel, email-pattern inference, email harvest, Slack/Discord discovery, package registry leaks, and vulnerability prioritization endpoints."
when_to_use: "Use for breach-data lookups (HaveIBeenPwned, DeHashed, IntelX), HudsonRock/infostealer (Cavalier) intel, email-pattern inference and harvesting, Slack/Discord discovery, or package-registry (npm) token leaks."
---

# People, Breach & Intelligence

> Sub-skill of `offensive-osint`. Load `osint-methodology` for pipeline and triage context.
> Authorized targets only. Never paste PII or credentials into cloud LLMs.

---

## BEHAVIORAL CONTRACT

**When triggered:** Breach lookups, username/email investigation, HudsonRock/HIBP/DeHashed queries, email-pattern inference, email harvesting, Slack/Discord discovery, or package registry leak hunting is needed.

**Execute:**

1. Run HudsonRock Cavalier domain lookup (§1) as the first call — highest ROI for external engagements.
2. Cross-reference with HIBP and DeHashed for domain-level breach scope.
3. Apply domain-level breach severity mapping (§1): >=10 employees = CRITICAL, 1-9 = HIGH, >=1 end-user = MEDIUM, 0 named = INFO.
4. If SSO tenants discovered (from `identity-fabric`), intersect with breach corpus for SSO_EXPOSURE findings (§1).
5. For each CVE surfaced, apply the 9-Signal Scoring Rubric (§4.1) to assign a priority tier (P0-P3).
6. For known employee names: derive candidate emails using the 8-pattern template (§2), then harvest from 6 parallel sources (§3).
7. Run Slack/Discord workspace discovery dorks (§6).
8. For package registry targets: run historical-version secret scan workflow (§7).
9. For each finding, emit per `osint-methodology` §3 schema.

**Output:** Breach findings, SSO_EXPOSURE findings, person assets with derived emails, email-harvest results — all per `osint-methodology` §3 finding schema.

**Severity rules:** §1 domain-level mapping. SSO_EXPOSURE = CRITICAL. Open Slack invite = HIGH. Package typosquat = MEDIUM.

**Gating rules:** Never paste PII or credentials into cloud LLMs. Encrypt stealer logs at rest. SHA-256 every artifact. Redact passwords in client reports.

**Chain to:** Receive SSO tenant list from `identity-fabric`. Feed validated emails to `identity-fabric` for GetCredentialType probing. Feed breach hits to `osint-methodology` §12 correlation logic. Feed secrets found in package registries to `secrets-and-dorks` for validation.

---

## 1. Breach & Leak Data — Highest ROI Sources

- [Have I Been Pwned](https://haveibeenpwned.com/) — breach lookup; Pwned Passwords API (k-anonymity).
- [Dehashed](https://dehashed.com/) — credential search (paid).
- [IntelX](https://intelx.io/) — data intelligence.
- [LeakCheck](https://leakcheck.io/), [Snusbase](https://snusbase.com/), [BreachDirectory](https://breachdirectory.org/).
- **[Cavalier (Hudson Rock)](https://cavalier.hudsonrock.com/) — infostealer log lookups; FREE; highest single-source ROI for compromised employee credentials.**

### 1.1 HudsonRock Cavalier — Direct API

```bash
# By domain (canonical first call)
curl -sk -m 30 "https://cavalier.hudsonrock.com/api/json/v2/osint-tools/search-by-domain?domain=target.com" | jq .

# By email (single-account check)
curl -sk -m 30 "https://cavalier.hudsonrock.com/api/json/v2/osint-tools/search-by-email?email=alice@target.com" | jq .

# By URL (when target's app is the breach victim)
curl -sk -m 30 "https://cavalier.hudsonrock.com/api/json/v2/osint-tools/search-by-url?url=https://app.target.com" | jq .
```

**Top-level JSON fields:**

- `total` — total stealer entries.
- `employees` — count of `<*>@<domain>` accounts found.
- `users` — count of customer accounts where domain appeared as visited URL.
- `data.employees_urls[]` — `{occurrence, type, url}` — **internal apps where employees were logging in when stolen. Subdomain hits here = recon gold.**
- `data.clients_urls[]` — user-facing apps (reveals undocumented portals).
- `data.stealer_families[]` — which stealer (RedLine / Lumma / StealC / Vidar / Raccoon).

**Free-tier caveats:**

- Subdomains past the first few are **redacted with asterisks**. Pivot to paid tier for unredacted.
- Cleartext passwords + emails are **never** in the free response.
- Rate limit ~1 req/sec/IP.

### 1.2 Domain-Level Breach Severity Mapping

| Stat                                    | Severity     |
| --------------------------------------- | ------------ |
| ≥ 10 employees compromised              | **CRITICAL** |
| 1–9 employees compromised               | **HIGH**     |
| ≥ 1 end-user (non-employee) compromised | **MEDIUM**   |
| Domain in breach with 0 named accounts  | **INFO**     |

### 1.3 SSO_EXPOSURE Finding

When a discovered SSO tenant intersects with the breach corpus → `SSO_EXPOSURE` finding, severity **CRITICAL**.

**Legacy-mail-decommissioned pattern (high-value):**

All three together → CRITICAL `SSO_EXPOSURE`:

1. `Resolve-DnsName mail.<domain> -Type A` → NXDOMAIN (legacy gone)
2. HudsonRock corpus has employee URLs against the old host (e.g., `mail.<domain>/owa/`, `/zimbra/`)
3. Current MX → M365 / Google Workspace (DNS confirms migration)

Evidence pack: tenant GUID + breach count + 3+ legacy URLs + autodiscover Microsoft IPs + current MX. Recommend forced password rotation + MFA audit.

---

## 2. Email-Pattern Inference (TENTATIVE)

Generate 8 candidate addresses for `(first_name, last_name, domain)`:

```text
{first}.{last}@{domain}        # john.doe@example.com
{first}{last}@{domain}         # johndoe@example.com
{first}@{domain}               # john@example.com
{first[0]}{last}@{domain}      # jdoe@example.com
{first}.{last[0]}@{domain}     # john.d@example.com
{last}@{domain}                # doe@example.com
{first}_{last}@{domain}        # john_doe@example.com
{first}-{last}@{domain}        # john-doe@example.com
```

Lowercase before lookup. Strip diacritics. If Hunter.io shows a dominant pattern, mark FIRM.

---

## 3. Email-Harvest Source Stack

Six parallel sources — dedup at the end:

1. **IntelX phonebook API** — 2-step search + poll. Largest single source for breach-era addresses.
2. **Hunter.io** — domain-search endpoint. ~25 free/month. Returns verified emails + roles.
3. **crt.sh** — extract X.509 SAN extensions. Many certs include admin/contact emails.
4. **DuckDuckGo SERP scrape** — HTML scrape of `"@{target-domain}"` results.
5. **Bing SERP scrape** — same query, complementary index.
6. **Wayback CDX** — historic snapshots often contain emails removed from the live site.

**Email regex:**

```regex
\b[A-Za-z0-9._%+\-]+@[A-Za-z0-9.\-]+\.[A-Za-z]{2,}\b
```

---

## 4. Vulnerability Prioritization Endpoints

```bash
# EPSS score for a CVE
curl -sk "https://api.first.org/data/v1/epss?cve=CVE-2024-3400" | jq '.data[0]'

# Check if in CISA KEV
curl -sk https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json | \
  jq '.vulnerabilities[] | select(.cveID == "CVE-2024-3400")'

# InTheWild confirmed-exploitation check
curl -sk "https://inthewild.io/api/vulnerability?cve=CVE-2024-3400"

# Trickest CVE-to-PoC lookup (GitHub repo)
# https://github.com/trickest/cve — browse: /YYYY/CVE-YYYY-NNNNN.md
```

### 4.1 9-Signal Scoring Rubric

Score each CVE additively across nine signals, then map to a priority tier.

**Scoring signals (additive):**

| Signal                                       | Points | Source                                 |
| -------------------------------------------- | ------ | -------------------------------------- |
| In CISA KEV                                  | +50    | KEV JSON feed                          |
| EPSS >= 0.7 (top 30%)                        | +30    | FIRST EPSS API                         |
| EPSS >= 0.4 (top 50%)                        | +15    | FIRST EPSS API                         |
| Metasploit module exists                     | +20    | rapid7/metasploit-framework GitHub     |
| Public PoC on GitHub                         | +15    | nomi-sec/PoC-in-GitHub or Trickest CVE |
| InTheWild.io confirmed                       | +20    | inthewild.io/api                       |
| ExploitDB entry                              | +10    | exploit-db.com                         |
| CVSS >= 9.0                                  | +10    | NVD                                    |
| Vendor advisory confirms active exploitation | +15    | vendor page                            |

EPSS tiers are mutually exclusive — apply the higher bracket only.

**Priority tiers:**

| Score | Tier           | Action                                          |
| ----- | -------------- | ----------------------------------------------- |
| >= 80 | P0 — Immediate | Flag in exec summary; recommend emergency patch |
| 50-79 | P1 — High      | Include in findings; recommend urgent patch     |
| 25-49 | P2 — Moderate  | Include in findings; recommend scheduled patch  |
| < 25  | P3 — Low       | Note in appendix; monitor                       |

---

## 5. ATS URL Patterns

| Platform             | URL Pattern                                |
| -------------------- | ------------------------------------------ |
| Lever (ATS)          | `<https://jobs.lever.co/<company>>`        |
| Greenhouse (ATS)     | `<https://boards.greenhouse.io/<company>>` |
| AshbyHQ (ATS)        | `<https://jobs.ashbyhq.com/<company>>`     |
| Company careers page | `<https://careers.<target>>.com`           |

---

## 6. Slack / Discord / Telegram Workspace Discovery

**Slack invite-link discovery:**

```text
site:join.slack.com "{target}"
inurl:slack.com inurl:shared_invite "{target}"
```

Open invite link = anyone joins without approval → HIGH finding.

**Discord server check:**

```bash
curl -sk "https://discord.com/api/v9/invites/<token>?with_counts=true"
```

Returns server name, ID, member count.

**Mattermost / Rocket.Chat / self-hosted:**

- Look for `chat.<domain>`, `mattermost.<domain>`, `rocket.<domain>` subdomains.
- Mattermost: `GET /api/v4/config/client?format=old` reveals server config if unauthenticated.
- Rocket.Chat: `GET /api/v1/info` returns version + config.
- Public channels may be readable without auth on misconfigured instances.

---

## 7. Package Registry Leak Hunting

### 7.1 npm

```bash
npm search "<target-keyword>"
npm pack <package>@<version>
tar -xzf package-version.tgz
# Run secret catalog over extracted files
```

### 7.2 PyPI

```bash
# Per-package history
curl -sk "https://pypi.org/pypi/<package>/json" | jq '.releases | keys'
pip download <package>==<version> --no-deps -d /tmp/pkg
```

### 7.3 RubyGems

```bash
# Per-gem metadata
curl -sk "https://rubygems.org/api/v1/gems/<gem-name>.json" | jq .
gem fetch <gem-name> && gem unpack <gem-name>-<version>.gem
```

### 7.4 Cargo (Rust crates)

- Search: `<https://crates.io/search?q=<target>>`
- Per-crate metadata: `<https://crates.io/api/v1/crates/<crate-name>>`

### 7.5 Packagist (PHP / Composer)

- Search: `<https://packagist.org/search/?q=<target>>`
- Per-package metadata: `<https://packagist.org/packages/<vendor>>/<package>.json`

### 7.6 NuGet (.NET)

- Search: `<https://www.nuget.org/packages?q=<target>>`

### 7.7 Maven Central (Java)

- Search: `<https://search.maven.org/?q=<target>>`

### 7.8 Workflow

For each candidate package owned by target:

1. List all historical versions (old versions often had leaked keys).
2. Download each version's archive.
3. Extract; run secret catalog.
4. For Docker images: scan each layer with `dive` or `skopeo`.

### 7.9 Typosquat Surveillance

For every published package the target owns, generate typosquat candidates:

```bash
# Example: target package "acme-utils"
for candidate in acme-util acmeutils acme_utils; do
  npm view $candidate 2>&1 | head -3
done
```

Unregistered candidate near target's published package → MEDIUM finding (typosquat / supply-chain risk).

## Structured Outrider run contract

Follow the shared run-contract instructions in `../_shared/run-contract.md`.

- Contract skill identifier: `people-breach-intel`.
- Consume `skill_request` version 1 and produce `skill_result` version 1 when participating in an Outrider run.
- Use evidence IDs for all claims; do not cite unregistered local paths as claim evidence.
- Discoveries are observations and do not expand scope or approval.
- Do not claim final finding validation; use `finding_candidate` only when a human-reviewed candidate should be handed off.
- Do not directly edit `manifest.json`, `scope.yaml`, `run.jsonl`, `evidence.jsonl`, or `approvals.jsonl`.
- Use policy-gated MCP with the explicit `run_dir`; the Python control layer and MCP boundary must reevaluate current controls.