Tuesday, September 15, 2020

It's alive! - Attachment links in Discord

What happens to the URL links inside Discord chats if you copy-paste them into an internet connected browser? You might be surprised to know that...

In the past I have written about the structure of Discord chats in the following platforms:

Windows:

https://abrignoni.blogspot.com/2018/03/finding-discord-app-chats-in-windows.html

macOS:

https://abrignoni.blogspot.com/2018/03/finding-discord-chats-in-os-x.html

iOS: 

https://abrignoni.blogspot.com/2018/08/finding-discord-chats-in-ios.html

Linux:

https://abrignoni.blogspot.com/2018/08/finding-discord-chats-in-linux-dfir.html

Android:

https://abrignoni.blogspot.com/2017/07/discord-app-forensic-artifacts-in.html

Viewing extracted data using an Android emulator:

https://abrignoni.blogspot.com/2017/08/viewing-extracted-android-app-data.html

Timely updates to the research have been provided by generous folks, like @TheKateCain,  here:

https://abrignoni.blogspot.com/2020/08/update-on-discord-forensic-artifacts.html

For the last couple of days I've been working creating a parser of Discord JSON chat files using iLEAPP. If you are not familiar with iLEAPP it is a Python 3 framework designed to parse useful forensic artifacts from iOS devices. More on iLEAPP here. I wanted to validate some findings on a case I am working with the amazing @i_am_the_gia and as part of the process I used the newly created parser on @Josh_Hickman1 excellent iOS testing images. You can get his testing images here.

Here is iLEAPP's  HTML report for the chat:


Here is the output for the Discord user's email and user ID:


In that same moment I watched the most amazing trailer for The Mandalorian Season #2 thanks to @KevinPagano3. As you all should know by now, the Child just steals every scene with just how cute it is. 

Going back to my report I copy one of the URLs in the attachment column and pasted it into an internet connected browser to see if it would come up. In past (2017) I did some testing on Discord for Android and found out that the links in chats could be copy-paste into a browser and be accessible from anywhere by anyone.

With Josh's image I confirmed that was still the case. And what did the URL image in the chat contain?


Coincidence? I think not. :-D
As always, I can be reached on twitter @AlexisBrignoni and email 4n6[at]abrignoni[dot]com.

May the Force be with you too.
-Brigs