01 · Product name
GHunt
Free command-line framework for Google account and Drive lookups.
Published by mxrch.
In short
GHunt is a free, open-source Python tool by mxrch for asking Google questions from the command line. The modules in the README cover an email address, a Gaia ID, a Drive file or folder, and BSSID geolocation. It does not search anonymously: login uses a Google session you control. Results can be written to JSON, and the code can be imported as a library. The same README links an online version at osint.industries. The license is AGPL-3.0.
Product pricing strategy
02
Free
GHunt is free. You do not buy a seat to use what the project publishes.
Yes. It is open source under AGPL-3.0. The README’s hosted pointer, osint.industries, is a separate paid product.
Utility and features
03
GHunt is the Google-focused framework maintained by mxrch at github.com/mxrch/GHunt. The README calls it an offensive Google framework whose current focus is OSINT. Version 2 is the line people install. It requires Python 3.10 or newer, and the README notes Python 3.13 compatibility. The recommended install is pipx, which keeps the tool in its own environment: pipx install ghunt. Installed that way it is a command. Installed with pip, the same project imports as a Python library. The README points at a wiki and an examples directory for that second path.
- Email and Gaia. The two account modules. One starts from an address, the other from a Google account ID. Both require the login session.
- Drive. Looks up a Drive file or folder. Useful when you already have a link. It does not grant access the share settings withhold.
- Geolocate and spiderdal. Geolocate takes a BSSID. spiderdal is the Digital Assets Links module named in the README. Neither one is an email search.
- Login. A Google session you control, via the Companion extension or cookies from that session. There is no anonymous mode.
The commands the README’s help text lists are login, email, gaia, drive, and geolocate. Email takes an address. Gaia takes a Google account identifier. Drive takes a file or folder. Geolocate takes a BSSID, which is a Wi-Fi access point identifier, not a person’s name. The same usage section mentions spiderdal for Digital Assets Links, a way to see assets a site has declared. Email, Gaia, Drive, and geolocate can add --json and write a file. That is the whole surface this listing will describe. It is enough to know what the tool is for.
Login is mandatory and it is the constraint. GHunt does not query Google as a stranger. The README’s login step uses the GHunt Companion extension, in Firefox or Chrome, or cookies from a Google session. That session has to be one you are allowed to use. Do not take cookies from someone else’s browser, and do not borrow an account to get around a limit. The queries you run are tied to that session. Google can see them. A workspace policy can forbid them. If you cannot explain the account and the selector, do not run the tool.
What comes back is Google-side data available to that session: profile fields, a Drive object you can open, or whatever the module is written to collect on the day you run it. Google changes those surfaces. A module that worked last year can return less today. Treat a field as a lead. An email that resolves to a Gaia ID, or a Drive file that is shared more widely than someone meant, is a thing to open and cite. It is not a biography. The BSSID module is a different question entirely, about a wireless identifier. This page does not explain how to collect one or how to turn one into a place on a map.
The README states two limits of its own. The license is AGPL-3.0, so if you ship the code or a modified version as a service you have duties under that license. And the author writes that the tool is for personal use, criminal investigations, pentesting, or open-source projects. A README is not a statute. The law and the policy where you work still govern. “Criminal investigations” in that sentence means investigations you are authorized to conduct, not curiosity about a private person.
The top of the README points at an online version: osint.industries. That hosted product is listed separately in this directory. It is paid and it searches many sources, not only Google. Use GHunt when you want the free, local, Google-specific tool and you have a session you can use. Use Have I Been Pwned or Holehe when the question is breach exposure or “is this email registered on other sites,” which GHunt does not answer.
- 1
Install from the project with pipx if you want the command, or pip if you need to import it. Python 3.10 or newer.
- 2
Read the AGPL-3.0 license and your workplace rules before you point it at a real address.
- 3
Log in with a Google account you are allowed to use. Do not use another person’s session.
- 4
Run the email or Gaia module on one selector the investigation covers, and keep the JSON with the case.
- 5
Open the Google page or the Drive object before you cite a field. Modules go stale when Google changes.
Caveats
04
GHunt is a free local tool that reads what Google shows to a browser session. It is not an exploit, and it is not a way to take over an account. You need to be allowed to look up that account, and you need a session you are allowed to use.
Google changes responses. A field that appeared last month can be gone. The JSON is not a legal process. Do not present it as the contents of someone’s private Drive. It is the subset your session could see.
Screenshots
05
Potential use cases
06
- You are allowed to examine what a Google account exposes to an ordinary signed-in session, and you are using an account you are permitted to use. Run GHunt against the email or the Gaia ID you already have. The output is the JSON the tool prints: the fields Google returned to that session. Store the JSON with the date. Pivot a Drive file ID you already hold to the Drive URL and read the sharing state you can actually see. This page does not describe stealing cookies or replaying someone else’s session.
- You have an email and you need the Gaia ID, or the reverse, for notes you are allowed to keep. Use the lookup the tool documents, and record both identifiers. The output is that mapping, which can be empty if Google returns nothing to your session. A miss is not proof the account does not exist.
- A workflow you maintain should call the same code instead of someone clicking through Google by hand. Pin the commit you ran. The output belongs in the case file as a tool result, with the Google account that was signed in named in your notes. If the authorization does not cover a signed-in Google session, do not run it.
Hard cases
The case where the first result is easy to over-read.
The session is the whole method
The result is only as authorized as the Google account that asked for it. If the cookies or the login belong to someone else, stop. This listing will not explain how to obtain them. Run the lookup, if you run it at all, as yourself or under an authorization that names this access, keep the JSON, and write which account was signed in. A Gaia ID with no other fields is an identifier, not a biography.
Questions
Is GHunt free?
Yes. It is open source under AGPL-3.0. The README’s hosted pointer, osint.industries, is a separate paid product.
Does GHunt work without a Google login?
No. The login command uses a Google session you control. The tool is not an anonymous search.
Citations
07
Titled sources. These public pages are what the quotes on this listing come from.
Product
GHunt repository
https://github.com/mxrch/GHuntDocumentation
GHunt README
https://github.com/mxrch/GHunt/blob/master/README.md