Thread by @bondijois

A friend recently gave me a phone number of someone they didn't know (who wasn't being very nice) - asking me to try and find out who it was.

Here's an #OSINT technique to find a twitter account using a phone number or an email address👇

PS: Have used my number for the example.

The 'Forgot Password' functionality in most applications is underrated AF when gathering intelligence.
Most applications tell you if an account exists, and if it does, they give you a truncated e-mail/number associated with the account.

I leveraged this functionality on Twitter.

Clicking on 'Forgot Password' redirected me to a page that had 'requested_variant' as a parameter in its URL with a base64 value - which is kinda easy to identify.

URL decode made it readable and also made it easy for me to fetch the base64 encoded value from 'requested_variant'

Decoding the base64 value gave me the 'user_id' of my target and the 'user_identifier' which I'd used initially(phone number)

While it's fairly easy to use Twitter API and fetch the associated account information using the 'user_id' - I found a website that does it, - and voila!

This works even if the target has disabled Discoverability in privacy settings - like me

ProTip: Be careful about the account info you use when creating sock puppets

LifeProTip: Don't unnecessarily fuck with people - especially with ones who've got #Infosec friends

Stay Safe.