GitHub - alejandrocora/WhatsAppMediaEnumeration: Self-scope, zero-send tool (and white paper) that traces WhatsApp media lineage through the mediaKey its dedup cache reuses across chats. · GitHub
/" data-turbo-transient="true" />
Skip to content
Search/
Sign in<br>Sign upAppearance settings
You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.
Dismiss alert
{{ message }}
alejandrocora
WhatsAppMediaEnumeration
Public
Notifications<br>You must be signed in to change notification settings
Fork
Star
main
BranchesTags
Go to file
CodeOpen more actions menu
Latest commit
History<br>1 Commit<br>1 Commit
Folders and files<br>NameNameLast commit message<br>Last commit date<br>paper
paper
src
src
tools
tools
.gitignore
.gitignore
LICENSE
LICENSE
README.md
README.md
install.sh
install.sh
package-lock.json
package-lock.json
package.json
package.json
requirements.txt
requirements.txt
wenum
wenum
View all files
Repository files navigation
WhatsApp Sent-Media Enumeration (wenum)
A self-scope proof of concept: WhatsApp's media deduplication , combined with its<br>end-to-end media encryption, leaks media lineage to any ordinary, user-level<br>client, with nothing sent.
Summary
To save bandwidth, a WhatsApp client keeps a content-addressed media dedup cache<br>and reuses the same mediaKey (the end-to-end key the server never sees) and<br>directPath whenever it re-sends or forwards media it already holds. Because that<br>key rides the whole forward chain, two copies sharing a mediaKey descend from one<br>upload. So a user-level client can read, from its own local storage:
whether a given media was ever sent through the account (send-free fileSha256 match);
whether two media pieces share an origin , and which chats a blob has touched (reused mediaKey);
when a blob was first uploaded, and whether a copy was reused (mediaKeyTimestamp, the blob's mint time).
The same secret that hides content from the server exposes its provenance to the<br>client. Neither the encryption nor the deduplication is faulty on its own; the leak<br>is emergent from their combination.
Full details in the white paper: English · Español.
Installation
Requirements: Node.js 20+ . Python 3 is optional (only the tools/ image<br>generators use it).
cd WASentMediaEnum-public<br>./install.sh">git clone repo-url><br>cd WASentMediaEnum-public<br>./install.sh
install.sh installs the Node dependencies, the Chromium build Playwright drives,<br>and, if python3 is present, a local .venv with Pillow for tools/. It is safe<br>to re-run and touches nothing outside this directory except Playwright's browser<br>cache.
Quick start
./wenum login # link a session once (scan the QR)<br>./wenum detect photo.jpg # was this media ever sent? (sends nothing)<br>./wenum forward --repeats # blobs (same mediaKey) seen across multiple chats<br>./wenum forward --timestamps # every forward: message time vs blob mint time<br>./wenum forward --help # all modes and selectors
Everything runs against your own linked session and local history. The detection<br>and lineage modes send nothing; they only read the device's own copy of the data.
Commands
Command<br>What it does
login<br>Establish the linked WhatsApp Web session (once).
detect FILE…<br>Is a given media present in the account's history? (matches fileSha256).
forward --repeats<br>Blobs with an identical mediaKey surfacing across ≥N chats.
forward --timestamps<br>Every forward's message time vs blob mint time (mediaKeyTimestamp).
forward --stickers<br>Sticker media grouped by blob (the easiest tracer).
forward --map / --svg / --art<br>Render a blob's chronological chain (JSON / SVG / console).
dump-history<br>Export a snapshot; any command then runs offline with --history FILE.
Selectors (--filehash, --mediakey, --from, --name, --recent, --all,<br>--json) narrow the scan or pin a specific blob.
Scope and responsible use
Self-scope only: drive your own linked session against your own synced<br>history. This is a defensive/forensic proof of concept and a research artifact; do<br>not use it to deanonymize or track other people.
License
MIT — free to use and modify; please keep attribution to the original<br>author (Alejandro Zapico Lara), including for the white paper.
About<br>Self-scope, zero-send tool (and white paper) that traces WhatsApp media lineage through the mediaKey its dedup cache reuses across chats.<br>Resources<br>Readme<br>License<br>Activity<br>Stars<br>2 stars<br>Watchers<br>0 watching<br>Forks<br>0 forks<br>Report repository
Releases
Packages
Contributors
Languages
You can’t perform that action at this time.