Learn
LoginRegister
← All tools

Have I Been Pwned

Tool manual · Kali & common usage

OSINT · Beginner · OSINT lane

BeginnerOSINT — Breach
Authorized usage only. Capture and inspect traffic only on systems and networks you own or have written permission to analyze.

What is Have I Been Pwned?

Have I Been Pwned checks whether emails/passwords appear in known breaches.

Personal/org exposure awareness (use org policies for employee checks).

Official website: Have I Been Pwned · Documentation

When do you use it?

  • You need Check if emails appear in known public breach datasets.
  • You are following a CYNARKS lab or authorized engagement that calls for Have I Been Pwned.
  • You already tried simpler checks and need this tool’s deeper capability.

Who uses it?

  • OSINT analysts
  • Investigators (lawful use)
  • Red teamers (authorized recon)

How do you use it? (typical flow)

  1. Install Have I Been Pwned using the steps below (prefer Kali package or official installer).
  2. Confirm you have authorization for the target (lab VM, own system, or written scope).
  3. Run --help / man (or the Help section) to see current flags for your version.
  4. Start with a safe example from Basic commands against localhost or an authorized lab target.
  5. Record what you ran, what you observed, and any follow-up (filter, report, remediation).

Help & manual (like man / --help)

Every serious tool has a built-in way to look up flags. Learn these first so you are not stuck memorizing every option.

  1. 1. Site

    https://haveibeenpwned.com/

Kali Linux

Web/API — no Kali package required.

1. Installation

OSInstallation
Kali LinuxWeb/API — no Kali package required.
Webhttps://haveibeenpwned.com

2. Basic commands

  1. 1. Assess breach exposure

    Domain search for your company

    Assess breach exposure

  2. 2. Show help

    Domain --help

    List flags for your installed version (same habit as man/--help).

  3. 3. Short help

    Domain -h

    Alternate help flag when supported.

5. Useful features

  • Breaches
  • Pastes
  • Domain search for orgs

6. Practical examples

  1. Example 1: Assess breach exposure

    Domain search for your company

    Assess breach exposure

  2. Example 2: Show help

    Domain --help

    List flags for your installed version (same habit as man/--help).

  3. Example 3: Short help

    Domain -h

    Alternate help flag when supported.

7. Important notes

  • Use HIBP to drive MFA and reset — not to target individuals.
  • Authorized targets only — labs, systems you own, or written permission.
  • Prefer reading --help / man / official docs for your installed version; flags change over time.

Related course: ethical hacking penetration testing · soc analyst blue team · Commands: /osint