Vulnotes

Pentest reporting, made simple.

Write findings. Review together. Deliver.

Learn more

Discord

What data can be found?

  • Discord username
  • Global display name
  • User ID
  • Account creation date
  • Avatar (if available)
  • Profile banner (if available)
  • Badges (if any)

This tool uses the Discord API to retrieve user information.

Discord OSINT Techniques

Discord IDs (Snowflakes)

Discord uses a unique identifier system called "Snowflakes" for all IDs in their platform. These IDs are used for users, messages, servers (guilds), channels, and more. A snowflake is a 64-bit integer that contains encoded information, most importantly a timestamp.

Similar to TikTok video IDs, Discord snowflakes contain a timestamp that indicates when the entity (user, server, etc.) was created.

Calculating Creation Date

You can calculate the creation date of a Discord entity (user, guild, etc.) from its snowflake ID. The first 42 bits of a snowflake represent the timestamp in milliseconds since the Discord epoch (January 1, 2015).

Here's how to calculate the creation date from a Discord snowflake ID using Python:

import datetime

# Discord epoch (January 1, 2015)
DISCORD_EPOCH = 1420070400000

def get_creation_date(snowflake):
    """
    Calculate the creation date from a Discord snowflake ID.
    
    Args:
        snowflake (str or int): The Discord snowflake ID
        
    Returns:
        datetime: The creation date of the entity
    """
    # Convert snowflake to integer and shift right by 22 bits
    snowflake = int(snowflake)
    timestamp = (snowflake >> 22)
    
    # Add Discord epoch to get milliseconds since Unix epoch
    milliseconds = timestamp + DISCORD_EPOCH
    
    # Convert to datetime object
    creation_date = datetime.datetime.fromtimestamp(milliseconds / 1000.0)
    
    return creation_date

# Example usage
user_id = "123456789012345678"
creation_date = get_creation_date(user_id)
print(f"Account created on: {creation_date.strftime('%Y-%m-%d %H:%M:%S')}")

For example, if a user has the ID 123456789012345678, you can determine exactly when their account was created using this calculation. This information can be valuable for establishing timelines in investigations.

Discord Guilds

In Discord terminology, a "guild" is what users typically call a "server." Guilds are the public communities where users interact, share content, and communicate. Each guild has its own set of channels, roles, and members.

Discord API

The Discord API provides various endpoints to retrieve information about users, guilds, and other entities. The endpoint used by this tool is:

https://canary.discord.com/api/v10/users/{id}

This endpoint returns information about a user, including their username, avatar, badges, and public flags. However, accessing this endpoint requires authentication with a Discord token, which our backend handles securely.

The information returned by the Discord API is limited to what is publicly available or accessible with the permissions of the authenticated token. For privacy and security reasons, Discord restricts access to sensitive user information.

Understanding Discord Flags

Discord uses numeric flags to represent various features, statuses, or properties of a user account. These flags are stored as bitfields, where each bit represents a specific flag. When you see "Public Flags" or "Flags" in a Discord user profile, these are numeric values that can be decoded to reveal information about the user.

Flags are represented as powers of 2 (1, 2, 4, 8, 16, etc.), and multiple flags are combined by adding these values together. To determine which flags are set, you need to perform bitwise operations on the flag value.

Flag ValueFlag NameDescription
1 << 0 (1)DISCORD_EMPLOYEEDiscord Staff
1 << 1 (2)PARTNERED_SERVER_OWNEROwner of a Discord Partner server
1 << 2 (4)HYPESQUAD_EVENTSHypeSquad Events member
1 << 3 (8)BUG_HUNTER_LEVEL_1Bug Hunter Level 1
1 << 6 (64)HOUSE_BRAVERYHypeSquad Bravery member
1 << 7 (128)HOUSE_BRILLIANCEHypeSquad Brilliance member
1 << 8 (256)HOUSE_BALANCEHypeSquad Balance member
1 << 9 (512)EARLY_SUPPORTEREarly Supporter badge
1 << 14 (16384)BUG_HUNTER_LEVEL_2Bug Hunter Level 2
1 << 16 (65536)VERIFIED_BOTVerified Bot
1 << 17 (131072)EARLY_VERIFIED_BOT_DEVELOPEREarly Verified Bot Developer
1 << 18 (262144)DISCORD_CERTIFIED_MODERATORDiscord Certified Moderator
1 << 19 (524288)BOT_HTTP_INTERACTIONSBot uses HTTP interactions
1 << 22 (4194304)ACTIVE_DEVELOPERActive Developer badge

For example, if a user has a public_flags value of 64, they are a member of HypeSquad Bravery. If they have a value of 320 (64 + 256), they are a member of both HypeSquad Bravery and HypeSquad Balance.