sha1_prefix_suffix (breach_checker.py)

Extracts SHA1 prefix and suffix for HIBP k-anonymity API queries.

#!/usr/bin/env python3
# Source: https://github.com/shuvonsec/claude-bug-bounty | License: MIT | Copyright 2026 Claude Bug Bounty Hunter Contributors
# Provided via justclaw.it.com; keep this notice with the code.
"""
HIBP k-anonymity password breach checker.

Reads a password wordlist, queries the HaveIBeenPwned /range/ API using
k-anonymity (only first 5 chars of SHA-1 are sent), enriches each password
with its breach count, then writes the ranked output.

Why rank by breach count:
  - HIGH count (>1M):  "Password123" — already in every generic spray list
  - SWEET SPOT (1-1k): proven-real passwords not yet over-used
  - ZERO count:        never seen — could be truly company-specific (or random)

Usage:
  tools/breach_checker.py <wordlist.txt>
  tools/breach_checker.py <wordlist.txt> -o 

... (truncated -- full source via MCP)