I had an old soundcloud account where i privated one of my songs. After many years, I would like to listen to the track, but i don't remember what email was linked to the account or the password. All I have is the link to the song. In this case, a privated soundcloud link would look as follows

soundcloud.com/[username]/[name of song]/[xxxxxxx]

I need to know if there is some way for me to guess the xxxxxxx part. This part can consist of any mix of lowercase, uppercase leters, numbers, and symbols. Is there a way for me to use some program or something i can use to guess these 7 letters/numbers/symbols no matter how long it would take? Any feedback is appreciated.


no matter how long it would take?

This is the thing about brute-force attacks: given enough time you can compromise everything. However, "enough time" may be longer than a human lifespan, or longer than the lifespan of the solar system. In your case, there approximately 80 possible characters, and 7 positions. This gives 807 = 20971520000000 possibilities. If you can try 100 tokens per second it would take you 6650 years to try them all.

Also, this token is a method of securing access to this song. Trying to bypass this may be against the law.

That said, I typically use the intruder tool in Burp Suite for brute-force attacks.

  • Very likely you will never reach even 100 attempts: I expect Soundcloud to do a lockout (or better: show some sort of captcha) after several failed attempts. – Jeff Jan 29 '19 at 20:52

Not the answer you're looking for? Browse other questions tagged or ask your own question.