Ghunt

GHunt

Google account OSINT — profile, services, location artifacts, linked apps from Gmail address.

Quick Start

pip install ghunt

# First-time setup — authenticate with Google cookies
ghunt login

# Investigate a Gmail address
ghunt email target@gmail.com

# Investigate by Gaia ID (Google internal user ID)
ghunt gaia 123456789

# Investigate a Google Drive link
ghunt drive https://drive.google.com/file/d/FILEID/view

Authentication Setup

GHunt requires valid Google cookies from a logged-in browser session.

# Interactive login (opens browser URL to capture cookies)
ghunt login

# Or manually export cookies from browser
# Install "Cookie-Editor" extension (Firefox/Chrome)
# Export cookies from google.com as JSON → ghunt login --file cookies.json

Use a throwaway Google account for OPSEC — your account appears as a viewer in some cases.

Commands

What GHunt Reveals

Profile Data

• Full name (if public profile)
• Profile photo → reverse image search
• Gaia ID (Google internal identifier — persistent, links across services)
• Account type (Google Workspace vs personal)
• Last profile edit timestamp

Linked Services

Whether the account has active:

• Google Maps — reviews posted (with location data)
• YouTube — channel (links to public videos/comments)
• Google Calendar — public calendars (may contain events/locations)
• Google Play — app reviews (reveals installed apps)
• Google Photos — shared albums
• Blogger — published posts

Location Artifacts

• Maps reviews reveal locations visited
• Calendar events with locations
• Photo metadata (if shared)

Common Workflows

Full email investigation:

ghunt email target@gmail.com
# Outputs: name, Gaia ID, profile photo URL, active services

Reverse image search profile photo:

# Get photo URL from ghunt output, then:
# yandex.com/images → search by image URL
# images.google.com → paste image URL
# tineye.com → reverse image search

Drive file owner identification:

# From a shared Google Drive link (e.g., from LinkedIn/email)
ghunt drive "https://drive.google.com/file/d/1BxiMVs0XRA5nFMdKvBdBZjgmUUqptlbs74OgVE2upms/view"
# Reveals: owner email, file name, creation date

Calendar public event scraping:

ghunt calendar target_calendar_id@group.calendar.google.com

JSON output for automation:

ghunt email target@gmail.com --json > ghunt_results.json

Parse Output

import json, subprocess

result = subprocess.run(
    ["ghunt", "email", "target@gmail.com", "--json"],
    capture_output=True, text=True
)
data = json.loads(result.stdout)

print("Name:", data.get("name"))
print("Gaia ID:", data.get("gaia_id"))
print("Services:", [s for s, active in data.get("services", {}).items() if active])

OPSEC Notes

• GHunt uses your Google account's cookies — the target may see view events in some products
• Use a dedicated throwaway Google account
• Rotate cookies regularly (session cookies expire)
• Maps reviews and Play reviews are publicly scraped — no notification to target

Gaia ID Use Cases

The Gaia ID is Google's internal persistent user identifier:

# Search Gaia ID in Google URLs
https://plus.google.com/<GAIA_ID>           # legacy, redirects
https://www.google.com/maps/contrib/<GAIA_ID>/reviews  # Maps reviews

Resources