check_hibp.sh: A script that checks haveibeenpwned.com for any breaches related to your email list

check_hibp.sh

#!/bin/bash
# Checks haveibeenpwned.com if any of your emails have been added

path="<path/to/working/dir>"
mailfrom="<add-email-here>"
mailto="<add-email-here>"
out="pwnage.out"
maillist="maillist.txt"
today=`date +%Y%m%d`

# Working dir
cd $path

# Rename old scan
if [ -e $out ]; then
        lastscan=`/bin/stat -c %y $out | cut -d" " -f1` #find date of last scan
        mv $out $out.$lastscan
fi
touch $out

# Run curl on haveibeenpwned APIv2
for i in `cat $maillist`;
do
        echo -n "Checking $i ... "
        response=$(/bin/curl --write-out %{http_code} --silent --output /dev/null "https://haveibeenpwned.com/api/v2/breachedaccount/$i")
        sleep 2; # sleep to avoid rate limit

        if [ "$response" = "200" ]; then # breach found
                breach=$(/bin/curl -A "AP-Pwnage-check" --silent https://haveibeenpwned.com/api/v2/breachedaccount/$i\?truncateResponse\=true | jq -r ".[].Name" | xargs)
                echo "Pwned on $breach"
                echo "$i : $breach" >> $out
                sleep 2;
        elif [ "$response" = "404" ]; then # not found
                echo "Clean"
        elif [ "$response" = "429" ]; then # rate limit exceeded
                echo "Too many requests"
        else    # other errors: forbidden, bad request
                echo "$i : Response Code $response" >> $out
                /bin/mailx -s "Have I been pwned? Check Failed" -r $mailfrom $mailto < $out
                exit 2;
        fi
done

# Diff old and new scan
if [ -e $out.$lastscan ]; then
        grep -Fxvf $out.$lastscan $out >> $out.diff
else
        cat $out >> $out.diff  # first scan
fi

# Send email if emails have been added since last scan
if [ -s $out.diff ] ; then
        /bin/mailx -s "Have I been pwned? Emails found in new data breach" -r $mailfrom $mailto < $out.diff
fi

# Cleanup
echo "DONE"
rm -f $out.diff
rm -f $out.$lastscan