Ripping OAuth tokens out of Twitter apps • Hacker News Board

Re: Ripping OAuth tokens out of Twitter apps

#31

Post by 0x0 » Tue, Aug 21, 2012, 8:46 AM UTC

franzus wrote: post #30

Fun Fact: You can get the API secret key out of twitter's official client. Which will allow you to use their xauth system (no browser oauth required - only enter username/password). Also great for spambots: Twitter can't ban the app because then they had to ban their official Twitter clients. /edit: have fun 'key': 'Fpl5UUVwvaczUzzpVJ8Rlw' 'secret': 'z73HF21zCz5CaxzDM6M0OPeaCBYGfHUG3FYBgcMB2Y' 'key': '3rJOl1ODzm9yZy6…

I guess you should take great care to use the exact same HTTP headers (user-agent, accept, encoding etc) and pattern of API access as the corresponding apps, or they'll surely be able to detect anomalies and ban your account :)

Re: Ripping OAuth tokens out of Twitter apps

#32

Post by [deleted] » Tue, Aug 21, 2012, 9:20 AM UTC

franzus wrote: post #30

Fun Fact: You can get the API secret key out of twitter's official client. Which will allow you to use their xauth system (no browser oauth required - only enter username/password). Also great for spambots: Twitter can't ban the app because then they had to ban their official Twitter clients. /edit: have fun 'key': 'Fpl5UUVwvaczUzzpVJ8Rlw' 'secret': 'z73HF21zCz5CaxzDM6M0OPeaCBYGfHUG3FYBgcMB2Y' 'key': '3rJOl1ODzm9yZy6…

[deleted]

Re: Ripping OAuth tokens out of Twitter apps

#33

Post by tvdw » Tue, Aug 21, 2012, 11:00 AM UTC

franzus wrote: post #30

Fun Fact: You can get the API secret key out of twitter's official client. Which will allow you to use their xauth system (no browser oauth required - only enter username/password). Also great for spambots: Twitter can't ban the app because then they had to ban their official Twitter clients. /edit: have fun 'key': 'Fpl5UUVwvaczUzzpVJ8Rlw' 'secret': 'z73HF21zCz5CaxzDM6M0OPeaCBYGfHUG3FYBgcMB2Y' 'key': '3rJOl1ODzm9yZy6…

You should try to extract the ones from iOS 5. They're hardcoded in Twitter.framework (simulator versions as well) and can be extracted with the simple "strings" tool. I'm not going to post them here though.