# Credential Stuffing

**Published by:** [TheSecurityGuy](https://paragraph.com/@mrbalu/)
**Published on:** 2022-12-01
**URL:** https://paragraph.com/@mrbalu/credential-stuffing

## Content

Login with leaked credentials (But how to find the leaked credentials of the specific company 🤔? ) - How to get the plain text passwords of the company You have enumerated subdomains and you have come acrossed admin panels. You tried brute forcing credentials from public sources but no success. What should you do now ? You need to check the breached credentials of the specific company. which site you need to check ? dehashed.com Goto dehashed.com give the query domain:company.com If there is any breaches happend in the past it shows you the credentials of the company To download them you need to have a active subscription They charge 7$ for week + you need to buy the api query credits i.e 3$ for 100 api queries You need to have both of them to use the api from the bash using the apikey Query goes like curl 'https://api.dehashed.com/search?query=domain:"company.com"' -u dehashed-registerd-email@mail.com:api-key -H 'Accept: application/json' Get The Data from the above queries. You can also use jq for processing the json output from the above liner.

## Publication Information

- [TheSecurityGuy](https://paragraph.com/@mrbalu/): Publication homepage
- [All Posts](https://paragraph.com/@mrbalu/): More posts from this publication
- [RSS Feed](https://api.paragraph.com/blogs/rss/@mrbalu): Subscribe to updates
- [Twitter](https://twitter.com/_TheSecurityGuy): Follow on Twitter