Mastodon User & Instance Search

User Search Functionality

The Mastodon user search functionality operates through a dual-approach methodology to find users across the federated network:

API Search

The module queries the Mastodon.social API to find user information using the following endpoint:

GET https://mastodon.social/api/v2/search?q=

This endpoint returns user information if the account exists on mastodon.social, including:

User ID and profile URL
Username and display name
Account creation date
Follower and following counts
Status count and last status date
Account flags (bot, locked, discoverable)
Bio and profile fields

Federated Instance Search

Simultaneously, the module checks a curated list of popular Mastodon instances to locate profiles with the same username across the federated network.

The list of instances is sourced from C3n7ral051nt4g3ncy's Masto repository, which maintains a comprehensive database of active Mastodon servers.

For each instance in the list, the module checks if the username exists by making a request. Every mastodon instance has a unique API endpoint, and the module will attempt to find the user information for the given username.

Instance Search Functionality

The Mastodon instance search functionality queries a specific instance's API to retrieve detailed information about the server.

Instance API

The module sends a request to the instance's API endpoint:

GET https:///api/v1/instance

This endpoint returns detailed information about the Mastodon instance, including:

Instance URI and title
Short and detailed descriptions
Contact email
Thumbnail/logo
Supported languages
Registration status (open/closed)
Approval requirements
Administrator account information

Example response:

{
  "uri": "mastodon.social",
  "title": "Mastodon",
  "short_description": "The original server operated by the Mastodon gGmbH non-profit",
  "description": "Mastodon is a free, open-source social network server...",
  "email": "admin@mastodon.social",
  "version": "4.1.0",
  "languages": ["en"],
  "registrations": true,
  "approval_required": false,
  "contact_account": {
    "id": "1",
    "username": "Gargron",
    "acct": "Gargron",
    "display_name": "Eugen Rochko",
    "followers_count": 210000,
    "following_count": 300,
    "statuses_count": 25000,
    "last_status_at": "2023-03-01",
    "locked": false,
    "bot": false,
    "discoverable": true,
    "created_at": "2016-03-16T00:00:00.000Z"
  }
}

Pentest reporting, made simple.

Mastodon

What data can be found?

User Information

Instance Information