403 FORBIDDEN Error

[ph3nx]

It seems like snaphax isn't working anymore. I can't even login. Here is the Debug:

SNAPHAX DEBUG: p1: m198sOkJEn37DjqZ32lpRu76xmw288xSQ9 SNAPHAX DEBUG: p2: 1390651093487 SNAPHAX DEBUG: s1: iEk21fuwZApXlz93750dmW22pw389dPwOkm198sOkJEn37DjqZ32lpRu76xmw288xSQ9 SNAPHAX DEBUG: s2: 1390651093487iEk21fuwZApXlz93750dmW22pw389dPwOk SNAPHAX DEBUG: s3: 93046e57a3c183186e9e24ebfda7ca04e7eb4d8119060a8a39b48014d4c5172b SNAPHAX DEBUG: s4: 013552862101f2eb9c9190a81b4946a0274b98e25f177337cdbfec1c9c3d49d3 SNAPHAX DEBUG: out: 930552562101f2e86e9190e8fba946a427eb4d8219177a87c9b4ec14dcc519db SNAPHAX DEBUG: POST params: {"username":"XXX","password":"XXX","timestamp":1390651093487,"req_token":"930552562101f2e86e9190e8fba946a427eb4d8219177a87c9b4ec14dcc519db"}

SNAPHAX DEBUG: HTTP response code 403
SNAPHAX DEBUG: POST return
Error: FORBIDDEN

NULL

[snaphaxtech]

I actually get this response:

SNAPHAX DEBUG: HTTP response code200
SNAPHAX DEBUG: POST return 
NULL

So it looks like it's going through, it just returns no result. I have a few pending snaps but still get nothing back. Also, did you have to disable SSL within snaphax.php?

[bear24rw]

The example code provided here seems to still work: http://gibsonsec.org/snapchat/fulldisclosure/

[ph3nx]

It seems like they blocked some IP adresses. The code works locally, but not on my deployment server (heroku).

[snaphaxtech]

I actually checked out the gibsec article as well and followed it through but in PHP. This time, I get a 401 Error: UNAUTHORIZED. Not quite sure why, I've been looking at this all day. Maybe that's the problem though, I should probably get some rest and take a fresh jab at this later.

[iliyaskhan]

SNAPHAX DEBUG: HTTP response code200
SNAPHAX DEBUG: POST return

Same problem here. It returns null after successful login.

[Narmoistar]

I changed the useragent from Snaphax to Snapchat, which stopped null from being returned on login, but now it seems that every single snap I receive is automatically marked as deleted. I'm assuming my account has been blacklisted. I haven't tried it with another account yet, but even logging into the strange account with the snapchat app results in all snaps instantly marked as expired.

[liamcottle]

It looks like snapchat are IP banning servers which try and use the API. I've had 18 different servers IP blocked by snapchat. I create a new server identical to the one that is returning 403 error, causing it to have a new IP address, it works for a few days or so perfectly fine, and then back to 403 errors.

My guess is snapchat is now IP banning.

[drewhammond]

I run snapintercept.com and while I haven't actually used the snaphax codebase in my app, I'm running into the same problem with the 403s.

I've had some success with proxying requests through Tor on my EC2 instances since they started the rate limiting. No idea how many Tor relays I've burnt though. My users have about a 20-30% login success rate which is still pretty significant considering what we're up against but I have a feeling that pushing the application work client-side is going to be the only way to get through this.

[liamcottle]

My system, "SaveMySnaps" http://savemysnaps.liamcottle.com used to run perfectly fine, and then all of a sudden I started getting 403 errors as well.

I decided to fix this problem by creating a new server, this gave me a new IP address which then removed the 403 errors. But, once again a few hours later I was IP blocked (I'm guessing) and the 403's showed up again. So creating new servers (which took around 20-30 minutes) was not an ideal solution.

I have made a temporary/permanent/been working for a while 'fix' to the IP blocking. I have been using Google to proxy my requests, it seems that each time you request a domain such as liamcottle.com via the Google proxy, it uses the same IP address to make the request, but give it a different domain (such as a subdomain) 123.liamcottle.com it then makes the request with a different IP address.

What I have done, is everytime I request data from the snachat API, I make my requests to RandomNumber.feelinsonice.appspot.com this then gives me a new IP address when making the request.

But, sometimes I run into the 403 error once in a while, but very rarely. Just tapping on an update button a second time seems to make it work.

Pretty happy with the Google proxy.

[brettneese]

@liamcottle can you explain a little more about which google proxy you're using and how you implemented it? :)

[liamcottle]

I ACCIDENTALLY DELETED MY COMMENT - BUT COPIED IT FROM SOURCE CODE ;)

@brettneese I'm using the GModules proxy. If you haven't heard of it, there's example usage of it here --> http://www.labnol.org/internet/google-proxy-server/28112/#gmodules

What I did, was created a function which can return either a proxied url or the original snapchat api url.

What I noticed with the GModules proxy was that if you request the same domain name it will be requested by the proxy with the same IP address each time, meaning that just using http://www.gmodules.com/ig/proxy?url=https://feelinsonice-hrd.appspot.com/bq would mean you are still using the same IP address. Not helpful if blocked.

So what I found out after playing around with the GModules proxy, was if you give it a different domain name eg https://1.feelinsonice-hrd.appspot.com/bq it would be queried by a different IP address.

So, each time I make a request to the snapchat API, I use the following PHP function:

  public function api_url($proxy = true){
    if($proxy){
      $random_number = rand(0,100000000000);
      return "http://www.gmodules.com/ig/proxy?url=https://{$random_number}.feelinsonice-hrd.appspot.com/bq";
    }
    else{
      return "https://feelinsonice-hrd.appspot.com/bq";
    }
  }

As you can see, each time I call the function it will return the url to make POST or GET requests to, which will be requested by the gmodules proxy with a different IP.

Every once in a while my system returns a 403 error, but making a second request (thus giving a new IP address) allows the request to succeed.

My SaveMySnaps system http://liamcottle.com/savemysnaps/ uses the code above and bits and pieces of snaphax along with pieces of other libraries I have found useful.

I built an API for my SaveMySnaps which runs my Android app https://play.google.com/store/apps/details?id=com.liamcottle.savemysnapsplus If you are interested in using my API, or if anyone is, let me know and I can send you some details through.

Was thinking of setting up a public API for SaveMySnaps, but have been pretty busy so haven't got around to doing it.

Whipped up a quick documentation of my API:
SaveMySnaps API Documentation

[ph3nx]

@liamcottle Do POST requests work with the google proxy?

[liamcottle]

@ph3nx indeed they do.

[drewhammond]

@liamcottle brilliant.