[Python] Twitter hacking

The title is somewhat attractive but I'm not (maybe can't) going to talk about hacking the Twitter server.

As you know, Twitter is a well known social network and lots of people use Twitter openly and share his or others information through Twitter.

But some people use their account privately, which means they use Twitter to communicate with his friends.

These people tends to make mistake like twit his personal information on Twitter.

So, I want to show you how easily people can be hacked through Twitter.

I took this experiment few months ago and I could get 1560 different phone numbers in one week...


DO NOT USE THIS FOR REAL HACKING!

Just be careful when you use SNS or internet.

1. # -*- coding:utf-8 -*-
2. import time
3. from twitter import *
4. import re
5. import MySQLdb
7. DB_NAME = 'twitter'
8. DB_TABLE = 'phone'
9. # tid bigint(20), name varchar(20), text text, number bigint(20)
10. DB_ID = 'carpedm20'
11. DB_PASS = ' '
13. db = MySQLdb.connect(host="", user=DB_ID, db=DB_NAME, passwd=DB_PASS, port=3306)
14. cur = db.cursor()
16. OAUTH_TOKEN = ''
17. OAUTH_SECRET = ''
18. CONSUMER_KEY = ''
19. CONSUMER_SECRET = ''
21. t = Twitter( auth=OAuth(OAUTH_TOKEN, OAUTH_SECRET, CONSUMER_KEY, CONSUMER_SECRET) )
23. findNum = re.compile(r'regular expression for phone number')
25. while 1:
26.         print "= start at " + time.ctime() + " ="
27.         output = t.search.tweets(q="010",lang='ko',count='100')
28.         print output['search_metadata']['count']
30.         for s in output['statuses']:
31.                 tid =  s['id']
32.                 name = s['user']['name'].encode('utf-8')
33.                 text = s['text'].replace("'","").encode('utf-8')
34.                 number = findNum.findall(s['text'])
35.                 upload_time = s['created_at'].encode('utf-8')
37.                 if number is []:
38.                         continue
40.                 query = "SELECT * FROM "+DB_TABLE+" WHERE tid="+str(tid)
41.                 cur.execute(query)
43.                 if cur.fetchone() != None:
44.                         continue
46.                 for n in number:
47.                         query = "INSERT INTO "+DB_TABLE+" (`tid`,`name`,`text`,`number`,`time`) VALUES("+str(tid)+",'"+name+"','"+text+"','"+str(n)+"','"+upload_time+"');"
48.                         print query
50.                         try:
51.                                 cur.execute(query)
52.                                 db.commit()
53.                         except:
54.                                 print "ERROR : " + query
55.         time.sleep(30)