GHunt is a Python-based OSINT tool specifically designed to investigate Google accounts using only a target’s email address (or, in newer versions, a Gaia ID, Google Maps review, or Google Docs share link). By leveraging publicly exposed Google API endpoints, GHunt can reveal a surprising amount of information tied to a Google account — including the account’s Gaia ID, associated Google Maps reviews and photos, YouTube channel (if linked), last profile edit timestamp, and whether services like Google Calendar or Google Photos are active on the account. It has become a go-to tool in the OSINT community for the specific niche of “email address → Google footprint” investigations.
Installation
# From source (recommended - not typically pre-installed on Kali by default)
git clone https://github.com/mxrch/GHunt.git
cd GHunt
python3 -m pip install -r requirements.txt --break-system-packages
# Via pipx (isolated environment, recommended by the GHunt maintainers)
pipx install ghunt
Verify installation:
ghunt --help
GHunt requires a one-time authentication setup using cookies from an active, logged-in Google account session (used purely to make authenticated API calls, not to compromise the target):
ghunt login
Syntax
ghunt [MODULE] [TARGET] [OPTIONS]
Command-Line Options
| Command/Flag | Description |
|---|---|
ghunt login | Interactive setup to authenticate GHunt with your own Google account cookies |
ghunt email EMAIL | Investigate a target Google account using an email address |
ghunt gaia GAIA_ID | Investigate a target Google account using a known Gaia ID |
ghunt drive DRIVE_LINK | Investigate the owner/metadata of a shared Google Drive/Docs link |
ghunt maps MAPS_LINK | Investigate a Google Maps contributor/review link to identify the reviewer’s account |
--json | Output results in JSON format instead of formatted console text |
--headless | Run browser-dependent modules (e.g., login) in headless mode |
-o, --output FILE | Save results to a file |
Basic Usage
ghunt email target@gmail.com
Expected output:
[*] Investigating target@gmail.com...
+ Gaia ID : 108234567890123456789
+ Profile picture : https://lh3.googleusercontent.com/a/...
+ Last profile edit : 2025-11-03
Google Maps:
+ Reviews found : 4
+ Photos found : 2
Google Calendar:
+ Calendar public : false
Practical Examples
Example 1 — Basic email-based account lookup
ghunt email target@gmail.com
+ Gaia ID: 108234567890123456789
+ Profile picture set: true
+ Last profile edit: 2025-11-03
Example 2 — Investigating using a known Gaia ID
ghunt gaia 108234567890123456789
+ Associated email: target@gmail.com
+ Profile name: John T.
Example 3 — Checking Google Maps activity
ghunt email target@gmail.com
Google Maps:
+ Reviews found: 4
- "Great coffee shop!" (5 stars) - Example Cafe, Springfield
- "Service was slow" (2 stars) - Example Diner, Springfield
+ Photos uploaded: 2
Example 4 — Investigating a shared Google Drive document link
ghunt drive "https://docs.google.com/document/d/1AbCdEfGhIjKlMnOpQrStUvWxYz/edit"
+ Document owner: target@gmail.com
+ Last modified: 2026-01-15
+ Sharing permissions: Anyone with the link (Viewer)
Example 5 — Investigating a Google Maps contributor link
ghunt maps "https://www.google.com/maps/contrib/108234567890123456789"
+ Contributor Gaia ID: 108234567890123456789
+ Total reviews: 4
+ Total photos: 2
Example 6 — Outputting results in JSON for further processing
ghunt email target@gmail.com --json > target_ghunt.json
cat target_ghunt.json
{
"gaia_id": "108234567890123456789",
"last_edit": "2025-11-03",
"maps_reviews": 4
}
Example 7 — Re-authenticating when cookies expire
ghunt login
[*] Opening browser for Google authentication...
[+] Cookies saved successfully. GHunt is ready to use.
Common Use Cases
- Confirming whether an email address belongs to an active Google account and gathering associated public metadata (profile photo, last activity).
- Uncovering a target’s Google Maps review history, which frequently reveals frequented physical locations (home neighborhood, workplace area, favorite restaurants) — highly useful in physical social engineering or executive protection assessments.
- Identifying the true owner of an anonymously shared Google Docs/Drive link during an investigation.
- Supporting broader OSINT investigations by pivoting from a single email address into a richer picture of the target’s real-world habits and digital footprint.
- Assisting corporate security teams in assessing what unintended personal information an employee’s Google account may be exposing publicly.
Automation with Bash
Batch-investigate a list of email addresses and save individual JSON reports:
#!/bin/bash
# ghunt_batch.sh
mkdir -p ghunt_results
while IFS= read -r email; do
echo "[*] Investigating $email"
ghunt email "$email" --json > "ghunt_results/${email}.json"
sleep 3 # avoid triggering Google's rate limiting
done < emails.txt
echo "[+] All results saved in ghunt_results/"
Extract just the Gaia IDs and Maps review counts from a batch of JSON results:
#!/bin/bash
for file in ghunt_results/*.json; do
email=$(basename "$file" .json)
gaia=$(jq -r '.gaia_id' "$file")
reviews=$(jq -r '.maps_reviews' "$file")
echo "$email -> Gaia: $gaia, Maps reviews: $reviews"
done
Tips and Best Practices
- Re-run
ghunt loginperiodically — Google session cookies expire, and an expired session will cause silent failures or authentication errors on subsequent lookups. - Space out batch requests (
sleep) to avoid tripping Google’s automated abuse-detection systems, which can temporarily flag the authenticating account. - Cross-reference GHunt’s Google Maps findings with other OSINT sources (Sherlock, theHarvester) to build a fuller picture rather than relying on a single tool.
- Always use a dedicated, non-personal Google account for GHunt’s authentication step rather than your own primary personal account, to avoid any risk to your personal account standing.
- Treat physical-location data derived from Maps reviews as sensitive — handle and store it according to your engagement’s data-handling and retention policies.
Troubleshooting
| Problem | Cause | Fix |
|---|---|---|
Error: Cookies expired or invalid | Authenticated Google session used by GHunt has expired | Re-run ghunt login to refresh session cookies |
| No results returned for a valid email | Target’s Google account has very strict privacy settings, or the account doesn’t exist on Google | Confirm the email is a real Gmail/Google Workspace account; some data is simply not public for privacy-conscious users |
ModuleNotFoundError on run | Missing Python dependencies after a fresh clone | Run pip3 install -r requirements.txt --break-system-packages again |
| Rate-limited / temporarily blocked by Google | Too many rapid lookups from the same authenticated session | Slow down request frequency; wait before resuming further lookups |
| Google Drive/Maps module returns “Not Found” | Link is invalid, expired, or requires the target’s exact sharing permissions to resolve | Double-check the link is correctly copied and still active/accessible |
References
- Official GitHub repository: https://github.com/mxrch/GHunt
- GHunt project documentation/wiki: https://github.com/mxrch/GHunt/wiki