Twitter API 4 Security Research

gAtO bEeN pLaYiNg –What Every Security researcher should know about the Twitter API is, it’s a gold mine and simple to use, just like google dorks this is twitter dorks. By using simple URL tweaking and Twitter search feature is all you need to do some cool twitter API magic.

The first thing is you need a little bit of URL_encoding  – – In Twittter we can search for “@“ “#” @ is for username and mentioned in, and # hashtag is for any search term. People use hashtags all the time in tweet-ville it’s a culture thingy. Anyway a %40 = @ | %20 = “1 blank space” so  we add!/search/%40gatomalo2

This does a basic search in Twitter for a User. Let’s add a little more vOdOo.!/search/realtime/%40gatomalo2%20%40securityaffairs

@gatomalo & @securityaffairs!/search/realtime/%40gatomalo2%20OR%20%40securityaffairs

@gatomalo2 OR @securityaffairs

Getting better eh… source: in Twitter API is the source that the user used to tweet. Let’s say they use the web, iPhone, TweetDeck and so on. .. yeah I added the location NYC for kicks.!/search/realtime/source%3Atweetdeck%20location%3Anyc

Let’s get down to it I want to look for associations with —#Anonymous and @Net_Anon or #Anonymous and @Anonymiss!/search/realtime/%23anonymous%20Net_Anon!/search/realtime/%23anonymous%20Anonymiss

#anonymous Anonymiss

Content tagged with Place & Geo

The Geo-place worries me as much as other things that twitter collects but this is a valuable tool for any security person. I want to us the API for a “Threat Intelligence Reports” I hope to start publishing in a few months. I hope this gave you a little taste of what the Twitter API can do for you today —there is more power in that there API -gAtO oUt.!/search/realtime/to%3Agatomalo2%20

Cool trick,s tips and examples:

Good Tool 4 API

1st base


@ = %40!/search/realtime/%23gatomalo2

# = %23!/search/%22tango%20down%22!/search/realtime/%40gatomalo2%20%40securityaffairs!/search/@gatomalo2

Example Searches

Query Search URL to use
Tweets which contain @twitterapi and @anywhere
Tweets which contain @twitterapi not via
Tweets about Twitter HQ (place ID 247f43d441defc03)
Tweets to @twitter created before the 7th May 2011 and within 25 miles of Twitter HQ in San Francisco,-122.398720,25mi

gatomalo2 until:2012-04-06

gatomalo2 source:tweet_button

gatomalo2 until:2012-04-06

Search Operators

In addition to the parameters listed in the Search API documentation, there are a number of operators you can use to modify the behavior of query.

Example Finds tweets…
twitter search containing both “twitter” and “search”. This is the default operator
“happy hour” containing the exact phrase “happy hour”
love OR hate containing either “love” or “hate” (or both)
beer -root containing “beer” but not “root”



#haiku containing the hashtag “haiku”
from:twitterapi sent from the user @twitterapi
to:twitterapi sent to the user @twitterapi
place:opentable:2 about the place with OpenTable ID 2
place:247f43d441defc03 about the place with Twitter ID 247f43d441defc03
@twitterapi mentioning @twitterapi
superhero since:2011-05-09 containing “superhero” and sent since date “2011-05-09” (year-month-day).
twitterapi until:2011-05-09 containing “twitterapi” and sent before the date “2011-05-09”.
movie -scary 🙂 containing “movie”, but not “scary”, and with a positive attitude.
flight 😦 containing “flight” and with a negative attitude.
traffic ? containing “traffic” and asking a question.
hilarious filter:links containing “hilarious” and with a URL.
news source:tweet_button containing “news” and entered via the Tweet Button

Twitter Places :


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: