Snapchat Reverse Engineering - Part 1 - Snapchat Account Creator Bot - API based
Update 3 (June 15th, 2024)
Progress:
OOOOOOOOOOOOOOOOOOOOOOOOOOOOOO - around
85 %
0 - - - - - - - - - - - - - - - 50 - - - - - - - - - - - - - - 100
Backend - Linux servers: 100 % complete
Frontend - GUI, API: 20 % complete
Account stability/ban rate:
Since June 8th, 2024:
0,00 % (
0 accounts locked/permanently locked, banned)
Previous journey thread delays:
I would like to apologize for the missing journey thread updates during the last week. I didn't abandon this thread, as explained here:
profile post
I managed to reach a huge milestone in the account creation process last weekend. I also detected at least 4 more Snapchat leaks (missing security flows at the Snapchat API).
The negative side: I had to work on this 20 hours per day, so there was no time left for any update here.
So the next journey thread updates will be shorter bot happen more frequently. There are around 12 more topics on my journey thread update TODO.
So, let's start. Shall we?
Snapchat loves to track your activities:
Similar to TikTok and other social media apps also Snapchat tracks your activities.
One example is the input field for your username:
For every character you type online Snapchat does at least 1 HTTP/2.0 gRPC Protobuf request, sometimes even 2.
Snapchat is able to measure your input speed. So if you really try to use an ADB connection to your Android device (or, worst case, Android emulator), please don't to a quick insert. Implement some delays instead.
Anything automated will risk your account lifetime.
Randomize your user agent:
User agent? The what?
[1]
Rich (BB code):
POST https://aws.api.snapchat.com/snapchat.janus.api.RegistrationService/RegisterWithUsernamePassword HTTP/2.0
Request header:
accept-encoding: br
accept-language: en
x-request-id: (removed)
x-snap-janus-request-created-at: (removed)
te: trailers
content-type: application/grpc
user-agent: Snapchat/12.x.x.x (xxx; Android xx.0#xxx; gzip) V/MUSHROOM grpc-c++/x.x.x grpc-c/x.x.x (android; cronet_http)
grpc-accept-encoding: identity,deflate,gzip
grpc-timeout: 30S
(...)
(Typical HTTP/2.0 gRPC Protobuf request header for the registration of accounts under Android.)
1. Don't use the same user agent for every request.
2. Randomize the Snapchat version your software emulates (e. g. Snapchat 12.90.0.46), but please make sure that this version matches your DeviceID request:
Rich (BB code):
POST https://app.snapchat.com/loq/device_id HTTP/1.1
Request header:
(...)
user-agent: Snapchat/12.x.x.x (xxx; Android xx.0#xxx; gzip) V/MUSHROOM)
(...)
Request body:
req_token=xxx@timestamp=xxx
(Typical HTTP/
1.1 POST request to use (register) your Android device, without Protobuf content.)
As a result you will receive 2 important variables: dtoken1i and dtoken1v Both are required at several places.
3. The same for the Android version and Android device description your software emulates (e. g. Android 14.0, SAMSUNG SM-S918B).
Some easy terms have been used to make it easier for non-professionals to read and understand the concept. For example: I wrote "access tokens", "hard coded" or "encoded" although there is much more behind.
(I am not native English/American, so please excuse any spelling or grammar mistakes.)
Side notes (linked from above):
[1] - User agent:
https://en.wikipedia.org/wiki/User-Agent_header
Short updates (random daily work) will be posted at my BHW profile: https://www.blackhatworld.com/members/reverseengineering.1413206/
So maybe you should follow me here at BHW to keep you up-to-date? https://www.blackhatworld.com/members/reverseengineering.1413206/follow
