ChatGPT Share Scanner

A comprehensive toolkit for discovering, analyzing, and understanding ChatGPT share link patterns. This research revealed that ChatGPT uses UUID v8 format for share links, making them significantly more discoverable than expected.

🔬 Research Findings

• Pattern Discovery: ChatGPT share links use UUID v8 format (not random UUID v4)
• Hit Rate: ~0.4% for random patterns, ~6% when targeting UUID v8 (16x improvement)
• Security Impact: 256-fold reduction in effective search space
• Deleted Shares: Remain in namespace with 200 status code, just show "Can't load" message

Read the full research article: ARTICLE.md

🚀 Quick Start

Installation

# Clone the repository
git clone https://github.com/actyra/chatgpt-share-scanner.git
cd chatgpt-share-scanner

# Install dependencies
pip install -r requirements.txt

Basic Usage

# Discover shares using CDX API (free, no API keys needed)
python cdx_probe.py discover --providers cdx --limit 5000 --out found.txt

# Brute-force with UUID v8 pattern (most effective)
python cdx_probe.py brute-force --attempts 1000 --pattern uuid8 --resume

# Analyze discovered patterns
python analyze_guid_pattern.py

# View statistics
python cdx_probe.py guid-stats

📦 Tools Suite

Core Tools

1. cdx_probe.py - Main scanner

   • Multiple discovery methods (CDX API, Common Crawl, brute-force)
   • Content verification (distinguishes accessible vs deleted shares)
   • Full-text search engine with SQLite FTS5
   • Pattern-based GUID generation

2. analyze_guid_pattern.py - Pattern analyzer

   • Discovers UUID versions and variants
   • Analyzes timestamp encoding
   • Generates pattern-based GUIDs
   • Statistical analysis

3. guid_utils.py - Reusable library

   • UUID v4, v8, and random GUID generation
   • Database operations
   • GUID validation and statistics

4. guid_generator.py - Standalone generator

   • Batch GUID generation
   • Multiple pattern support
   • Database tracking

Advanced Tools

Located in tools/ directory:

5. guid_finder - Web occurrence scanner (requires API keys)
6. partial_guid_search - Fragment-based search (requires API keys)
7. advanced_guid_search - Advanced search operators (requires API keys)
8. merge_guid_dbs - Database merger

See tools/README.md for detailed documentation.

🎯 Key Features

• ✅ Content Verification: Distinguishes accessible shares from deleted ones
• ✅ Pattern-Based Generation: Targets UUID v8 for maximum efficiency
• ✅ Database Tracking: SQLite databases prevent duplicate testing
• ✅ Full-Text Search: FTS5-powered search engine for discovered content
• ✅ Multiple Discovery Methods: CDX archives, web crawl, search engines, brute-force
• ✅ Standalone Tools: Each tool works independently

📊 Results & Statistics

From our testing of 13,000+ attempts:

Pattern	Hit Rate	Accessible Shares	Notes
Random	0.4%	Low	Occasionally matches v8 by chance
UUID v4	~0.3%	Low	Wrong pattern for ChatGPT
UUID v8	~6%	Moderate	Matches ChatGPT's actual format

Pattern Breakdown:

• All discovered shares use UUID v8 (section 3 starts with '8')
• RFC 4122 compliant variant bits (section 4: 8/9/a/b)
• No timestamp encoding detected

🔧 Advanced Usage

Brute-Force with Content Verification

# UUID v8 pattern with content check
python cdx_probe.py brute-force \
  --attempts 10000 \
  --pattern uuid8 \
  --delay 0.3 \
  --resume

# View accessible vs deleted breakdown
python cdx_probe.py guid-stats

Build Searchable Database

# Discover shares
python cdx_probe.py discover --providers cdx --limit 5000 --out shares.txt

# Index for full-text search
python cdx_probe.py index --urls shares.txt --db shares.db

# Search the database
python cdx_probe.py search --query "python programming" --db shares.db

Pattern Analysis

# Analyze discovered GUIDs
python analyze_guid_pattern.py

# View detailed JSON output
cat guid_pattern_analysis.json

Database Management

# Merge multiple databases
cd tools/merge_guid_dbs
python merge_guid_dbs.py merge \
  --tested-db ../../tested_guids.db \
  --generated-db ../../guid_generator/generated_guids.db \
  --output all_guids.db

# View statistics
python merge_guid_dbs.py stats --db all_guids.db

📁 Project Structure

chatgpt-share-scanner/
├── README.md                      # This file
├── ARTICLE.md                     # Research article
├── LICENSE                        # MIT License
├── requirements.txt               # Python dependencies
├── .gitignore                     # Git ignore rules
│
├── cdx_probe.py                   # Main scanner
├── analyze_guid_pattern.py        # Pattern analyzer
├── guid_utils.py                  # Reusable library
├── guid_generator.py              # GUID generator
│
├── tools/                         # Advanced tools
│   ├── README.md                  # Tools documentation
│   ├── cdx_probe/                 # Main scanner (release)
│   ├── guid_finder/               # Web occurrence scanner
│   ├── partial_guid_search/       # Fragment search
│   ├── advanced_guid_search/      # Advanced operators
│   ├── merge_guid_dbs/            # Database merger
│   ├── guid_utils/                # Python library
│   └── examples/                  # Usage examples
│
└── docs/                          # Additional documentation
    └── API_KEYS.md                # API key setup guide

🔑 API Keys (Optional)

Some tools require API keys for web search functionality:

• Google Custom Search API (for guid_finder, advanced_guid_search)
• Bing Search API (for guid_finder)
• GitHub Token (for guid_finder)

See docs/API_KEYS.md for setup instructions.

Note: Core functionality (CDX discovery, brute-force, pattern analysis) works without API keys.

🛡️ Security & Ethics

This research was conducted responsibly for educational purposes:

• ✅ All code is for defensive security research
• ✅ Tools help understand privacy implications
• ✅ No credentials harvesting or malicious use
• ✅ Respects rate limits and ToS
• ❌ Do not use for unauthorized access
• ❌ Do not share sensitive discovered content

Recommendations:

• Don't share sensitive information via ChatGPT links
• Assume share links are discoverable
• "Deleted" shares remain in ChatGPT's namespace

📈 Performance

• CDX Discovery: ~5000 shares in 30 seconds (free API)
• Brute-Force: ~200 attempts/minute with content verification
• Database: Handles millions of GUIDs efficiently
• Search: Sub-second full-text search with FTS5

🤝 Contributing

Contributions welcome! Please:

1. Fork the repository
2. Create a feature branch (git checkout -b feature/amazing-feature)
3. Commit your changes (git commit -m 'Add amazing feature')
4. Push to the branch (git push origin feature/amazing-feature)
5. Open a Pull Request

📝 License

This project is licensed under the MIT License - see the LICENSE file for details.

🙏 Acknowledgments

• OpenAI - For creating ChatGPT and the share feature
• Internet Archive - For the CDX API
• Common Crawl - For web archive data

📧 Contact

• GitHub: @actyra

⚠️ Disclaimer

This tool is for educational and security research purposes only. Users are responsible for complying with applicable laws and OpenAI's Terms of Service. The authors assume no liability for misuse.

---

Star ⭐ this repository if you found it interesting!