ShareTrace: The Ultimate OSINT Tool for Unmasking Digital Identities—Your Privacy at Risk? + Video

Introduction:

In the ever-expanding digital ecosystem, shared links serve as gateways not only to content but also to a treasure trove of personal metadata. The emergence of OSINT tools like ShareTrace, which can harvest user identity information from platforms like TikTok, Instagram, and Discord, highlights a critical vulnerability in how social media platforms handle data sharing. While these tools empower cybersecurity professionals in threat intelligence and incident response, they also expose a terrifying reality for the average user: a single shared link can lead to the exposure of hidden profile details, phone numbers, and account metadata.

Learning Objectives:

• Learn how to install and utilize ShareTrace for extracting metadata from popular social media share links.
• Understand the technical workflow behind link parsing, API enumeration, and data scraping.
• Explore defensive measures and privacy hardening techniques to mitigate OSINT collection against personal or corporate accounts.

You Should Know:

1. Weaponizing ShareTrace: Installation and Initial Reconnaissance

ShareTrace is a Python-based tool designed to scrape and parse shareable URLs from platforms including TikTok, Instagram, and Discord. It operates by leveraging the unique structure of share links to query unsecured or public API endpoints, returning JSON data containing usernames, display names, profile pictures, and often the platform-specific unique IDs (e.g., Discord Snowflakes). To begin using this tool, ensure you have Python 3.8+ and Git installed.

For Linux (Debian-based):

sudo apt update && sudo apt install python3-pip git -y
git clone https://github.com/username/ShareTrace.git  Note: Replace with actual repo if available, or use OSINTrack
cd ShareTrace
pip install -r requirements.txt

For Windows (PowerShell as Admin):

Set-ExecutionPolicy Bypass -Scope Process
python -m pip install --upgrade pip
git clone https://github.com/username/ShareTrace.git
cd ShareTrace
pip install -r requirements.txt

Step‑by‑step guide for execution:

1. Copy a shareable link from your target platform (e.g., TikTok username, Discord invite, Instagram post).
2. Run the tool using the syntax: `python sharetrace.py -u “https://www.instagram.com/p/CxAMPLE/”`
   3. The tool will output a JSON file containing the extracted metadata.

2. Uncovering Hidden Data from TikTok and Instagram

The real power of ShareTrace lies in its ability to retrieve data from links that often contain “lookalike” IDs. For instance, TikTok share links often include the author’s unique ID in the query string. The tool parses this and sends a GET request to the platform’s internal graph API. To get the best results, users often need to supply their own session cookies to bypass rate limiting.

Tutorial: Extracting TikTok User Info

1. Retrieve a link: `https://www.tiktok.com/@username/video/123456789`.
   2. Use the command: `python sharetrace.py -t “tiktok” -u “https://www.tiktok.com/@username”`.
2. The tool will scrape the public profile, returning the following:
   – `uniqueId` (username)
   – `nickname` (Display name)
   – `bioDescription`
   – `followerCount` / `followingCount`
   – `profilePicture` URL (High-res)

3. Discord and the Art of Snowflake Decoding

Discord share links (discord.gg/invitecodes) can be used by ShareTrace to retrieve server information and, depending on the server’s privacy settings, member profiles. The most fascinating aspect is the extraction of “Snowflake” IDs. These IDs are not random; they are a combination of a timestamp and a worker ID.

Decoding the Discord Snowflake:

The tool uses a Python script to convert the Discord Snowflake integer to a human-readable timestamp (Unix).

 Example Python code used inside ShareTrace:
def snowflake_to_time(snowflake):
DISCORD_EPOCH = 1420070400000
return (snowflake >> 22) + DISCORD_EPOCH

When ShareTrace extracts a user ID from a share link, it allows the investigator to see exactly when the Discord account was created, which is useful for fingerprinting and sock puppet detection.

4. The API Exploitation and Hardening

The tool essentially acts as a wrapper for API calls. However, to avoid detection and IP blocking, the tool utilizes rotating user-agents. If you are an incident responder, understanding how to harden against this is crucial. The primary mitigation technique is to validate the `Referer` header on the server side to prevent automated scraping.

Defensive Tactics (Windows/Linux):

• Block known scrapers: On an Apache/NGINX server, add rules to block requests from known OSINT tool user agents.
• Rate Limiting: Implement strict API rate limiting using `iptables` or Cloudflare.

Linux Command for Rate Limiting (using iptables):

sudo iptables -A INPUT -p tcp --dport 80 -m hashlimit --hashlimit-1ame http --hashlimit-above 50/sec --hashlimit-burst 100 -j DROP

5. Integrating ShareTrace with Corporate Threat Intelligence

For blue teams, ShareTrace is a valuable addition to the OSINT toolkit. When investigating phishing campaigns, attackers often use Discord or TikTok share links to drive traffic to malicious domains. By feeding the extracted metadata into a SIEM (Security Information and Event Management) or MISP (Malware Information Sharing Platform), analysts can correlate activities.

Step‑by‑step guide to reporting:

1. Extract the data to a JSON file: python sharetrace.py -u

    -o output.json</code>.</li>
   <li>Use `jq` (Linux) to parse and push the data into your database:
   [bash]
   jq '.username, .phone_number' output.json | curl -X POST -d @- https://your-siem-url
   

2. For Windows, use PowerShell to parse and export to CSV:

   Get-Content output.json | ConvertFrom-Json | Export-Csv -Path report.csv -1oTypeInformation