GHunt: Investigate Google Accounts and Assets with OSINT

Overview

GHunt is an offensive Google-focused framework for collecting and examining information exposed through Google services. Its modules investigate email addresses, Gaia IDs, Drive files or folders, and BSSIDs, with an additional module for finding assets through Digital Assets Links.

It is aimed at OSINT work and can be used from the command line or imported as a Python library. Authentication relies on Google cookies, with a companion browser extension available to support login. Use it only in authorized contexts and in line with the project's stated terms.

Key Features

• CLI modules for email, Gaia ID, Drive, and BSSID investigations.
• spiderdal module for finding assets through Digital Assets Links.
• Python library interface for integrating GHunt into Python projects.
• Asynchronous operation.
• JSON export for email, Gaia, Drive, and geolocation module results.
• Browser extension-assisted login, alongside manual cookie options.

Use Cases

• OSINT researchers can examine Google-related information connected to an email address.
• Authorized investigators can look up a Gaia ID or assess a Drive file or folder.
• Security practitioners can geolocate a BSSID as part of an approved investigation.
• Python developers can call GHunt from scripts or projects that need its Google-focused modules.

Getting Started

Install with pipx:

pipx install ghunt

See the README for login setup, module usage, and library examples.

Considerations

• Requires Python 3.10 or newer.
• Login requires Google cookies. The companion listener login method is not compatible with Docker, according to the README.
• The README describes the project as educational and states that use must comply with its AGPL terms. The repository metadata reports the license as NOASSERTION.
• This framework accesses Google-related information, so use it only for authorized investigations, testing, or other permitted purposes.