Initialization vectors: It's alive! - Attachment links in Discord

Tuesday, September 15, 2020

It's alive! - Attachment links in Discord

What happens to the URL links inside Discord chats if you copy-paste them into an internet connected browser? You might be surprised to know that...

In the past I have written about the structure of Discord chats in the following platforms:






Viewing extracted data using an Android emulator:

Timely updates to the research have been provided by generous folks, like @TheKateCain,  here:

For the last couple of days I've been working creating a parser of Discord JSON chat files using iLEAPP. If you are not familiar with iLEAPP it is a Python 3 framework designed to parse useful forensic artifacts from iOS devices. More on iLEAPP here. I wanted to validate some findings on a case I am working with the amazing @i_am_the_gia and as part of the process I used the newly created parser on @Josh_Hickman1 excellent iOS testing images. You can get his testing images here.

Here is iLEAPP's  HTML report for the chat:

Here is the output for the Discord user's email and user ID:

In that same moment I watched the most amazing trailer for The Mandalorian Season #2 thanks to @KevinPagano3. As you all should know by now, the Child just steals every scene with just how cute it is. 

Going back to my report I copy one of the URLs in the attachment column and pasted it into an internet connected browser to see if it would come up. In past (2017) I did some testing on Discord for Android and found out that the links in chats could be copy-paste into a browser and be accessible from anywhere by anyone.

With Josh's image I confirmed that was still the case. And what did the URL image in the chat contain?

Coincidence? I think not. :-D
As always, I can be reached on twitter @AlexisBrignoni and email 4n6[at]abrignoni[dot]com.

May the Force be with you too.