Twitter / X Headers Generator

Python module with an attached reverse-engineering study of the X (former Twitter) x-client-transaction-id and x-xp-forwarded-for request headers.

Series Context

This repository represents Episode 1 of a multi-part analysis of Twitter/X login-flow protections.

Be sure to follow me on Medium and Github in order to prevent loosing next episodes.

Next one is going to be about the first antibot challenge.

Learning

Be sure to check out LEARN.md in order to understand how this has been made as well as the full article on Medium

Table of Contents

• Installation
• Quick Start
  • X-Client-Transaction-Id
  • X-XP-Forwarded-For
• Learning
• Multi-Language Implementations
• Author

Installation

pip install twitter-generator

Or from source:

git clone https://github.com/GlizzyKingDreko/twitter-generator.git
cd twitter-generator
pip install -e .

Quick Start

X-Client-Transaction-Id

from twitter_generator import ClientTransactionGenerator

generator = ClientTransactionGenerator(
    ondemand_file=ondemand_js_content, # Dynamic js file content
    home_page=home_page_html # Loaded homepage content
)

transaction_id = generator.generate(
    "GET", # Method you are going to use
    "/api/1.1/statuses/user_timeline.json" # Route of the request
)

print(transaction_id)

X-XP-Forwarded-For

from twitter_generator import XPForwardedForGenerator

generator = XPForwardedForGenerator(
    guest_id="v1%3A176824413470818950" # Your guest_id cookie
)

env = {
    'userAgent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36',
    'hasBeenActive': False,
    'webdriver': False
}

token = generator.generate(env)
print(token)


# Or decrypting it via
generator.decode(
    token, 
    generator._derive_key_from_guest_id(guest_id)
)

API Reference

ClientTransactionGenerator

class ClientTransactionGenerator:
    def __init__(self, ondemand_file: str, home_page: str)
    def generate(self, method: str, path: str) -> str

XPForwardedForGenerator

class XPForwardedForGenerator:
    def __init__(self, guest_id: Optional[str] = None)
    def generate(self, env: Dict) -> str
    def decode(self, token: str, key: Optional[bytes] = None) -> Dict
    def decode_with_key(self, token: str, key_hex: str) -> Dict
    def decode_with_guest_id(self, token: str, guest_id: str) -> Dict

    @staticmethod
    def extract_guest_id_from_cookie(
        cookie_string: str
    ) -> Optional[str]

Implementations in Other Languages

Be sure to check the

• GO Version
• NodeJS Version

License

MIT License. See LICENSE for details.

Author

If you found this project helpful or interesting, consider starring the repo and following me for more security research and tools, or buy me a coffee to keep me up.