GHunt: Complete Guide to Google Account OSINT and Information Gathering Using Kali Linux

GHunt is a Python-based OSINT tool specifically designed to investigate Google accounts using only a target’s email address (or, in newer versions, a Gaia ID, Google Maps review, or Google Docs share link). By leveraging publicly exposed Google API endpoints, GHunt can reveal a surprising amount of information tied to a Google account — including the account’s Gaia ID, associated Google Maps reviews and photos, YouTube channel (if linked), last profile edit timestamp, and whether services like Google Calendar or Google Photos are active on the account. It has become a go-to tool in the OSINT community for the specific niche of “email address → Google footprint” investigations.

Installation

# From source (recommended - not typically pre-installed on Kali by default)
git clone https://github.com/mxrch/GHunt.git
cd GHunt
python3 -m pip install -r requirements.txt --break-system-packages

# Via pipx (isolated environment, recommended by the GHunt maintainers)
pipx install ghunt

Verify installation:

ghunt --help

GHunt requires a one-time authentication setup using cookies from an active, logged-in Google account session (used purely to make authenticated API calls, not to compromise the target):

ghunt login

Syntax

ghunt [MODULE] [TARGET] [OPTIONS]

Command-Line Options

Basic Usage

ghunt email target@gmail.com

Expected output:

[*] Investigating target@gmail.com...

+ Gaia ID : 108234567890123456789
+ Profile picture : https://lh3.googleusercontent.com/a/...
+ Last profile edit : 2025-11-03

Google Maps:
+ Reviews found : 4
+ Photos found : 2

Google Calendar:
+ Calendar public : false

Practical Examples

Example 1 — Basic email-based account lookup

ghunt email target@gmail.com

+ Gaia ID: 108234567890123456789
+ Profile picture set: true
+ Last profile edit: 2025-11-03

Example 2 — Investigating using a known Gaia ID

ghunt gaia 108234567890123456789

+ Associated email: target@gmail.com
+ Profile name: John T.

Example 3 — Checking Google Maps activity

ghunt email target@gmail.com

Google Maps:
+ Reviews found: 4
  - "Great coffee shop!" (5 stars) - Example Cafe, Springfield
  - "Service was slow" (2 stars) - Example Diner, Springfield
+ Photos uploaded: 2

Example 4 — Investigating a shared Google Drive document link

ghunt drive "https://docs.google.com/document/d/1AbCdEfGhIjKlMnOpQrStUvWxYz/edit"

+ Document owner: target@gmail.com
+ Last modified: 2026-01-15
+ Sharing permissions: Anyone with the link (Viewer)

Example 5 — Investigating a Google Maps contributor link

ghunt maps "https://www.google.com/maps/contrib/108234567890123456789"

+ Contributor Gaia ID: 108234567890123456789
+ Total reviews: 4
+ Total photos: 2

Example 6 — Outputting results in JSON for further processing

ghunt email target@gmail.com --json > target_ghunt.json
cat target_ghunt.json

{
  "gaia_id": "108234567890123456789",
  "last_edit": "2025-11-03",
  "maps_reviews": 4
}

Example 7 — Re-authenticating when cookies expire

ghunt login

[*] Opening browser for Google authentication...
[+] Cookies saved successfully. GHunt is ready to use.

Common Use Cases

• Confirming whether an email address belongs to an active Google account and gathering associated public metadata (profile photo, last activity).
• Uncovering a target’s Google Maps review history, which frequently reveals frequented physical locations (home neighborhood, workplace area, favorite restaurants) — highly useful in physical social engineering or executive protection assessments.
• Identifying the true owner of an anonymously shared Google Docs/Drive link during an investigation.
• Supporting broader OSINT investigations by pivoting from a single email address into a richer picture of the target’s real-world habits and digital footprint.
• Assisting corporate security teams in assessing what unintended personal information an employee’s Google account may be exposing publicly.

Automation with Bash

Batch-investigate a list of email addresses and save individual JSON reports:

#!/bin/bash
# ghunt_batch.sh
mkdir -p ghunt_results
while IFS= read -r email; do
    echo "[*] Investigating $email"
    ghunt email "$email" --json > "ghunt_results/${email}.json"
    sleep 3   # avoid triggering Google's rate limiting
done < emails.txt

echo "[+] All results saved in ghunt_results/"

Extract just the Gaia IDs and Maps review counts from a batch of JSON results:

#!/bin/bash
for file in ghunt_results/*.json; do
    email=$(basename "$file" .json)
    gaia=$(jq -r '.gaia_id' "$file")
    reviews=$(jq -r '.maps_reviews' "$file")
    echo "$email -> Gaia: $gaia, Maps reviews: $reviews"
done

Tips and Best Practices

• Re-run ghunt login periodically — Google session cookies expire, and an expired session will cause silent failures or authentication errors on subsequent lookups.
• Space out batch requests (sleep) to avoid tripping Google’s automated abuse-detection systems, which can temporarily flag the authenticating account.
• Cross-reference GHunt’s Google Maps findings with other OSINT sources (Sherlock, theHarvester) to build a fuller picture rather than relying on a single tool.
• Always use a dedicated, non-personal Google account for GHunt’s authentication step rather than your own primary personal account, to avoid any risk to your personal account standing.
• Treat physical-location data derived from Maps reviews as sensitive — handle and store it according to your engagement’s data-handling and retention policies.

Troubleshooting

References

• Official GitHub repository: https://github.com/mxrch/GHunt
• GHunt project documentation/wiki: https://github.com/mxrch/GHunt/wiki