Snapchat Reverse Engineering - Part 1 - Snapchat Account Creator Bot - API based

Snapchat Reverse Engineering - Part 1 - Snapchat Account Creator Bot - API based


Update 4 (June 16th, 2024)


Progress:

OOOOOOOOOOOOOOOOOOOOOOOOOOOOOO - around 85 %
0 - - - - - - - - - - - - - - - 50 - - - - - - - - - - - - - - 100

Backend - Linux servers: 100 % complete
Frontend - GUI, API: ~ 30 % complete


Account stability/ban rate:

Since June 8th, 2024: 0,00 % (0 of 30,000+ accounts locked/permanently locked, banned)


5G multi proxy setup:

Let's be honest, 5G IP addresses are simply the best when it comes to automating the processes of a social media platform like Snapchat with bots. Especially the mass creation of accounts (currently 1,000 to 3,000 accounts per day - with further increases in the numbers).

Unfortunately 5G IPv4 proxy services are either hard to find or extremely expensive, since most mobile proxies are based on hardware dongles (USB sticks) from Asia with 4G support only (e. g. Huawei). Well, everything is expensive if you create 3,000 accounts per day. ;-)

So why not create my own redundant 5G proxy setup?

I created a custom hardware solution together with custom software. Did you expect something else from me? hahaha

One standard industrial part of each custom proxy server:





The Snapchat account creator bot requests a fresh, unused 5G IP IPv4 address from West Europe for the duration of the account creation and email verification. As soon as the workflow has been completed and a few warm up tasks have been absolved, the bot requests a new IP address and starts the workflow again.

The IP address space has a total of theoretical 16,581,375 IPv4 addresses, experts would call this a /8 network. [1]

So it's a mix of a static mobile proxy solution and a rotating proxy solution.

Of course all hardware components work with registered, legal SIM cards. So no hacking/phishing will be used to stay absolutely white hat.

Why don't I use IPv6 address space? I guess you know the answer. Or not? ;-)


Vitality and life time checks:

Somebody at a messenger asked me if "aged" Snapchat accounts are really still required for adding friends due to this complex white hat account creation process with currently 0,00 % account loss (since June 8th, 2024).

So I'm going to set up a little workflow to add a few hundred friends right after the creation and also accept a few hundred friend requests. Of course fully software based (no phones, no emulators, no browser emulation, no BS).

Let's see what will happen, and maybe also adjust the setup.



Some easy terms have been used to make it easier for non-professionals to read and understand the concept. For example: I wrote "access tokens", "hard coded" or "encoded" although there is much more behind.


(I am not native English/American, so please excuse any spelling or grammar mistakes.)


Side notes (linked from above):

[1] - CIDR, /8 network https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing


Short updates (random daily work) will be posted at my BHW profile: https://www.blackhatworld.com/members/reverseengineering.1413206/

So maybe you should follow me here at BHW to keep you up-to-date? https://www.blackhatworld.com/members/reverseengineering.1413206/follow

5G network gives different IPs than 4G? I don't know. I only use LTE.

Wait, I changed my phone, it says 5G. Before it said LTE.

But I think it's the same pool of IPs.

I rotate this and I'm getting 100.100.x.x all the time. First 2 columns don't change almost ever. So it sucks.

reaaski said:

5G network gives different IPs than 4G? I don't know. I only use LTE.

Click to expand...

5G is faster than 4G (LTE) here. And it's also a different IP address space (IP pool) here.

I rotate this and I'm getting 10.10.x.x all the time. So it sucks.

Click to expand...

This means you have at least a /16 network (see link above). So 255 x 255 IP addresses (excl. broadcast).

* IP address network edited by me

ReverseEngineering said:

5G is faster than 4G (LTE) here. And it's also a different IP address space (IP pool) here.



This means you have at least a /16 network (see link above). So 255 x 255 IP addresses (excl. broadcast).

* IP address network edited by me

Click to expand...

you mentioning the broadcast IPs tells me you have a strong network background, right?

ReverseEngineering said:

5G is faster than 4G (LTE) here. And it's also a different IP address space (IP pool) here.



This means you have at least a /16 network (see link above). So 255 x 255 IP addresses (excl. broadcast).

* IP address network edited by me

Click to expand...

But third column is usually x.x.110 - 120.x

So it's not much to get.

I used that for account creation on desktop. After a day I exhausted the pool on google.

ReverseEngineering said:

I created a custom hardware solution together with custom software. Did you expect something else from me? hahaha

One standard industrial part of each custom proxy server:

Click to expand...

Nice journey, if you don't mind please share more info about the solution and how you built it.

What kind of 5G speed do you get with your device and how much does it cost to obtain?

AlbinKurti said:

you mentioning the broadcast IPs tells me you have a strong network background, right?

Click to expand...

I wouldn't call it "strong", but I know how routing works, which hardware is required to open a data center, and I'm also 2 times certified at the RIPE.

So nothing special. ;-)

Why do you ask?

For non-professionals: https://en.wikipedia.org/wiki/RIPE + https://en.wikipedia.org/wiki/RIPE_NCC

thebotmaker said:

Nice journey, if you don't mind please share more info about the solution and how you built it.

Click to expand...

As you can see it's one of a few Raspberry Pi with Ubuntu 22.04 Linux (24.04 will follow some day). You see the connection via RJ45 and the power connection. I use the Squid proxy software with a lot of modifications.

Missing at the picture: the external SIM reader ;-)

For the non-professionals: https://en.wikipedia.org/wiki/Raspberry_Pi

The next plan is to "rotate" the SIMs automatically for SMS verifications. I talked to 4 mobile providers about my idea of a possible solution and a cooperation with their "nerd" and recruiting department. They also operate their own "makers space" to recruit people.

What else do you want to know about the proxy solution?

AllOutAnime said:

What kind of 5G speed do you get with your device and how much does it cost to obtain?

Click to expand...

The speed totally depends. The provider offers 300 Mbit/s downstream and 50 Mbit/s upstream.

But I have to say that I didn't run a benchmark yet. I don't want to view streams, I just want to do some random HTTP/2.0 requests. ;-)

The costs will be between 10 Euro (8 GB) and 20 Euro (25 GB) per month per SIM. But it's the first month, I don't know the volume yet.


* Edit: a few details added

ReverseEngineering said:

I wouldn't call it "strong", but I know how routing works, which hardware is required to open a data center, and I'm also 2 times certified at the RIPE.

So nothing special. ;-)

Why do you ask?

For non-professionals: https://en.wikipedia.org/wiki/RIPE + https://en.wikipedia.org/wiki/RIPE_NCC




As you can see it's one of a few Raspberry Pi with Ubuntu 22.04 Linux (24.04 will follow some day). You see the connection via RJ45 and the power connection. I use the Squid proxy software with a lot of modifications.

Missing at the picture: the external SIM reader ;-)

For the non-professionals: https://en.wikipedia.org/wiki/Raspberry_Pi

The next plan is to "rotate" the SIMs automatically for SMS verifications. I talked to 4 mobile providers about my idea of a possible solution and a cooperation with their "nerd" and recruiting department. They also operate their own "makers space" to recruit people.

What else do you want to know about the proxy solution?




The speed totally depends. The provider offers 300 Mbit/s downstream and 50 Mbit/s upstream.

But I have to say that I didn't run a benchmark yet. I don't want to view streams, I just want to do some random HTTP/2.0 requests. ;-)

The costs will be between 10 Euro (8 GB) and 20 Euro (25 GB) per month per SIM. But it's the first month, I don't know the volume yet.


* Edit: a few details added

Click to expand...

Thank you for the update.

I was referring to the cost of the device.
Where are the antennas?
Usually you need 4 to run 5G.

Question, are you generating the tokens via raw code?

AllOutAnime said:

I was referring to the cost of the device.
Where are the antennas?
Usually you need 4 to run 5G.

Click to expand...

I put the antennas outside, I will post a picture later.

It's a simple plastic case with everything integrated, so made for outdoor usage.

th3darkknight said:

Question, are you generating the tokens via raw code?

Click to expand...

Yes, they are generated based on the original code.

Why do you ask?

as someone who's got the api reversed, you're making this sound very questionable, if you can generate the header or whatever you wish to call it then there shouldn't be a limit as to how many accounts you can make a day or whatever you wish to call it

not being able to log into the accounts isn't a matter of playing with the settings, it's because your token is flagged which means something is detected which i assume is because you're using a bridge to make the token

the register request doesn't take an email or number field as it's a separate request to-do this

you've made everything sound overly complicated, if you use https://mitmproxy.org/ when you unpin ssl you can see the protobuf schema obviously without the field names but you can get a good understanding of what's inside the request, or you could log the bytes as base64 or hex and use https://protobuf-decoder.netlify.app/ to view the schema in the same way mitmproxy would show you

there's several public frida scripts for Snapchat available on https://github.com, frida is detected but if you use https://github.com/hzzheyang/strongR-frida-android then you'll be fine

i doubt you've done what you claim to have done;

I guess Snapchat will collect something like Device Fingerprint, how do u deal with this part?

Thank you for interesting thread

lolbrah said:

i doubt you've done what you claim to have done;

Click to expand...

Welcome to BlackHatWorld!

I'm glad that you registered today and wrote your first and only post just to reply me. ;-)

"Yes, you are right. I don't have any clue about reverse engineering, bot development, protobuf and especially how Snapchat works." Not.

But, wait, what's that? ;-)





Sorry, but I don't reply to offending posts in detail.

This is BlackHatWorld, the public forum section. I will never post my latest little secrets at the public.

rickty said:

I guess Snapchat will collect something like Device Fingerprint, how do u deal with this part?

Thank you for interesting thread

Click to expand...

Thank you for your feedback, @rickty !

Since I don't use phones, emulators, browser emulation etc. I have to generate the Android DeviceID, some Google IDs and all device parameters Snapchat retrieves on my own with the bot software. But this is not a big deal.

Snapchat for Android contains a lot more "encrypted" IDs to handle the requests.

The golden times when you could use one single previously generated ID for thousands of friend adding requests are over. Regarding the friend adding/accepting I am not really sad about it. ;-)

lolbrah said:

i'd love to hear what type of encryption the token uses (...)

could you please tell me how many blocks are in the token for registration and also what data is inside of the second block?

Click to expand...

Please create a thread at the "Hire a Freelancer" forum section for such requests: https://www.blackhatworld.com/forums/hire-a-freelancer.76/

Please notify me after you posted it there. And don't forget to put a US$ amount into your thread, so what you would pay a freelancer to receive this information.

If your request matches my desires I may accept it.

* Edit: You posted 2 replies instead of multi-quoting. So my additional answer: I don't use any bridge.

ReverseEngineering said:

Please create a thread at the "Hire a Freelancer" forum section for such requests: https://www.blackhatworld.com/forums/hire-a-freelancer.76/

Please notify me after you posted it there. And don't forget to put a US$ amount into your thread, so what you would pay a freelancer to receive this information.

If your request matches my desires I may accept it.

Click to expand...

stop avoiding the question and answer it, if you can do what you claim to-do then you'd have no issue answering what I asked but instead you avoid it and act like a foul scammer

also i'd like to point something out which is interesting

As soon as you faced a real question, you started drifting to some other direction. Dodging the questions completely.
If the code is in raw and you've already decoded everything then just answer the questions? Why act like it's a big secret now?

You already posted a thread on a public forum that you're reversing snapchat and now if someone asks a question then say "it's a public forum, i don't want to reveal my secrets" and dodge it easily.

Tbh, no hate but I myself have worked on snapchat (re) as well and half of your sayings are total crap. Anyway, good luck fishing.

th3darkknight said:

As soon as you faced a real question, you started drifting to some other direction. Dodging the questions completely.
If the code is in raw and you've already decoded everything then just answer the questions? Why act like it's a big secret now?

You already posted a thread on a public forum that you're reversing snapchat and now if someone asks a question then say "it's a public forum, i don't want to reveal my secrets" and dodge it easily.

Tbh, no hate but I myself have worked on snapchat (re) as well and half of your sayings are total crap. Anyway, good luck fishing.

Click to expand...

So it's that you don't like the way someone is engineering or what?

I can make accounts using javascript or macros and probably people would come and tell me how reverse engineering would be better, but...

I feel like there's a lot of bragging about which way is better. And there's no simple answer to such problems.

I'm looking forward for Snap Inc. to patch the code on server (!) side to prevent any abuse of the GitHub content.

It wouldn't be the first time. ;-)

* Edit: I totally forgot ... of course I have 2 fallback account creators already, in case Snapchat will patch anything. There is also the iOS based account creator left.

reaaski said:

So it's that you don't like the way someone is engineering or what?

I can make accounts using javascript or macros and probably people would come and tell me how reverse engineering would be better, but...

I feel like there's a lot of bragging about which way is better. And there's no simple answer to such problems.

Click to expand...

The best way will always be to reverse-engineer and replicate the full app 100% in your own code.
Like that you can do millions of actions per day on a raspberry pi.