Yikes, got an HTTP 400. This is not normal

initstring / linkedin2username

OSINT Tool: Generate username lists for companies on LinkedIn

MIT License

1.25k stars 185 forks source link

Yikes, got an HTTP 400. This is not normal #72

Closed gusmaocool closed 1 year ago

gusmaocool commented 1 year ago

Hi everyone!

After starting the tool, it brought me this message. "Yikes, got an HTTP 400. This is not normal" What does that mean?

initstring commented 1 year ago

Hi @gusmaocool, thanks for opening an issue!

Can you please provide more details? Please share the commands you ran, what you did when the browser window popped open, the full text output from the console, and anything else think might be helpful.

You can obfuscate anything sensitive, like company names etc.

gusmaocool commented 1 year ago

I am using Macbook M2 pro with ARM architecture. After I execute the command, the browser opens to the Linkedin login screen and I enter the credentials. I am logged in and leave the browser open. Then I press "Enter" and then it brings me this answer.

initstring commented 1 year ago

Thanks for this!

It looks like it is logging in ok and grabbing your session cookies, as it has no problem getting the company info. The problem then is some sort of bad request when looping through the employees.

I tested the program myself right now, and I don't get the error. It completes ok. So at least LinkedIn hasn't totally blocked the tool. I'm also on an ARM-based Mac.

I'm not sure why you are getting this. You can troubleshoot a bit more using the "--proxy" flag to proxy your loops through Burp or Zap or something. If you spot something with the requests that looks off, and have an idea for a fix, can you let me know?

I'll leave this issue open, to see if others start experiencing the same problem too.

rbtoms commented 1 year ago

It looks like I'm running into the same issue. Using "Google" as an example, it seems to result in an HTTP 400 response on the second API request. If it helps, I'm running an Intel-based MacOS architecture.

2023-10-05_16-00-33

2023-10-05_15-58-57

initstring commented 1 year ago

Thanks @rbtoms! This helps and I can now reproduce the issue. Looking into it...

initstring commented 1 year ago

I see when proxying normal traffic to LinkedIn that they are now using a graphql API endpoint that isn't so easy to understand. The queries don't take recognisable values. I noticed this a couple months ago, but the endpoints this tool was using were still available.

It's possible LinkedIn has deprecated the endpoints.

I don't think I will have time to troubleshoot this for a while. Probably the fix is one of:

Figure out this new graphql endpoint, and modify the tool to use it
Figure out some new random syntax or header or something required to continue using the old endpoint

initstring commented 1 year ago

I just found this project that was previously using the same API as this tool. Their tool also broke, and it was indeed due to a transition to the graphql API.

Probably by looking at their diffs, it would be possible to see what needs fixing in linkedin2username: https://github.com/tomquirk/linkedin-api/pull/332/files

If anyone sees this issue, and has time to work on this, I would gladly review the pull request. It's just the "search" API that needs to be updated in linkedin2username, which is used in the get_results function.

Thanks!

coj337 commented 1 year ago

I needed this today so I'm just tidying up my patch, PR incoming soon!

initstring commented 1 year ago

Thanks @coj337 for your great contribution. I've merged it into a separate branch so I can get it working with the unit tests. Further work will happen in linked PR.