I recently stumbled upon this and am checking here to see if what I am proposing is indeed feasible and can be considered a breach of privacy.
For obvious reasons I am not revealing the website which exhibits this property
The URLs are of the format :
https://xxxxxxxxyyyyyzzzz/xyz/<6 digit rand>_<17 digit rand>_<10 digit rand>_n.jpg
And requesting the above link will return you an image. Now, as you can see, the entropy of the possible URLs are quite large. But note that they are all integers(0-9).
This website hosts contents of millions of people
;) and my guess is that at least 10% of the URLs contained within these random number will work. Of course, its just a guess.
My question is : is this feasible ? Is my Claim true ? My presumption here is that these random numbers may be a non-cryptographic hash of some string. There is no way to confirm the above sentence. For the sake of this question, lets assume it does.
My code to generate these links looks like so (just a snippet)
first = str(random.randint(100000,999999)) second=str(random.randint(10000,99999))+str(random.randint(10000,99999))+str(random.randint(10000,99999))+str(random.randint(10,99)) third= str(random.randint(10000,99999))+str(random.randint(10000,99999)) test='https://<URL>/'+first+'_'+second+'_'+third+'_n.jpg' try: image=urllib2.urlopen(test) print (image.read()).__len__() except: print "fail"
I have not tried to run this for more than tens of requests for the fear of my IP being blocked by the server for excessive requests. I do not intend to either. Just want to clarify if my understanding is right.
P.S: Am not a python developer, so please forgive if my code is ugly (suggestions will be happily taken to improve)