Public/Get-HibpStealerLog.ps1
|
function Get-HibpStealerLog { <# .SYNOPSIS Gets stealer log data by email, email domain, or website domain. .DESCRIPTION Retrieves stealer log data from the Have I Been Pwned system. This is a premium feature and requires a subscription. You can search by a specific email address, all accounts on an email domain, or credentials stolen from a specific website domain. .PARAMETER Account The email address to search for. .PARAMETER Domain The email domain to search for (e.g., 'example.com'). .PARAMETER WebsiteDomain The website domain from which credentials were stolen (e.g., 'facebook.com'). .PARAMETER ApiKey Your HIBP API key. Can be used instead of saving the key with Save-HibpCredential. .EXAMPLE Get-HibpStealerLog -Account 'test@example.com' Returns stealer log data for the email address 'test@example.com'. .EXAMPLE Get-HibpStealerLog -EmailDomain 'example.com' Returns stealer log data for all accounts on the 'example.com' domain. .EXAMPLE Get-HibpStealerLog -WebsiteDomain 'facebook.com' Returns stealer log data for credentials stolen from 'facebook.com'. .LINK https://haveibeenpwned.com/API/v3#StealerLogsOverview #> [CmdletBinding(DefaultParameterSetName = 'ByEmail')] Param( [Parameter(Mandatory = $true, Position = 0, ValueFromPipeline, HelpMessage = 'The email address to search for.', ParameterSetName = 'ByEmail')] [string]$Account, [Parameter(Mandatory = $true, Position = 0, ValueFromPipeline, ParameterSetName = 'ByEmailDomain')] [string]$EmailDomain, [Parameter(Mandatory = $true, Position = 0, ValueFromPipeline, ParameterSetName = 'ByWebsiteDomain')] [string]$WebsiteDomain, [string]$ApiKey ) process { $endpoint = switch ($PSCmdlet.ParameterSetName) { 'ByEmail' { 'stealerlogsbyemail/{0}' -f ([System.Web.HttpUtility]::UrlEncode($Account)) } 'ByEmailDomain' { 'stealerlogsbyemaildomain/{0}' -f ([System.Web.HttpUtility]::UrlEncode($EmailDomain)) } 'ByWebsiteDomain' { 'stealerlogsbywebsitedomain/{0}' -f ([System.Web.HttpUtility]::UrlEncode($WebsiteDomain)) } } $invokeParams = @{ Endpoint = $endpoint } if ($PSBoundParameters.ContainsKey('ApiKey')) { $invokeParams.ApiKey = $ApiKey } Invoke-HibpRequest @invokeParams } } |