A fork of soxoj/sharetrace with Google Docs and GitHub owner-email extraction added.
Fork maintained by Hieu Ngo • hieu.ngo@chongluadao.vn • chongluadao.vn
All upstream functionality preserved. Additions over soxoj/sharetrace:
| Addition | Covers | Notes |
|---|---|---|
Google Docs source (gdoc) |
Docs, Sheets, Slides, Drawings, Forms, Drive files, Apps Script, Jamboard, My Maps | Owner email + Google ID + creation/modification dates from the public Drive v2beta metadata endpoint. API key overridable via SHARETRACE_GDOC_API_KEY. Clean-room rewrite against the endpoint first documented by Malfrats/xeuledoc |
GitHub source (github) |
Commit URLs, PR-commit URLs, profile URLs | Commit: parses .patch mbox From: header with RFC 5322 parser (handles quoted display names). Profile: scans recent public PushEvents (last 90 days). users.noreply.github.com emails flagged via is_noreply |
GitLab source (gitlab) |
Commit URLs (incl. nested groups), profile URLs | Commit: .patch mbox From: header, same trick as GitHub. Profile: /api/v4/users — returns public_email only if user opted in (GitLab strips email from push events, unlike GitHub). gitlab.com only; self-hosted out of scope |
Hugging Face source (huggingface) |
Profile URLs, repo URLs (owner resolved) | Uses undocumented-but-stable /api/users/<name>/overview. Returns username, fullname, avatar, account type (user/org), follower count, orgs list. No email (HF treats emails as private) |
LinkedIn source (linkedin) |
/in/, /posts/, /pulse/ URLs |
OG-tag scrape with realistic Chromium UA. Detects LinkedIn's bot protection (999/403/429 status, authwall keyword) and returns is_blocked: True. Hit rate ~80% on public profiles; dynamic and degrades over time |
| 50+ new tests | Router + gdoc + github + gitlab + huggingface + linkedin modules |
Mocked unit tests + live-verified against real public resources |
python -m sharetrace <url># JSON output (scriptable)
python -m sharetrace <url> --json
# List all supported sources
python -m sharetrace --list
# Override the default Google Drive API key (if it gets revoked)
SHARETRACE_GDOC_API_KEY=<your-key> python -m sharetrace <drive-url>git clone https://github.com/7onez/sharetrace.git
cd sharetrace
pip install -r requirements.txt# Google Docs / Sheets / Drive — extracts owner email + Google ID + dates
python -m sharetrace "https://docs.google.com/document/d/<id>/edit" --json
# GitHub commit — extracts committer name + email
python -m sharetrace "https://github.com/<user>/<repo>/commit/<sha>"
# GitHub profile — scans recent public PushEvents for emails
python -m sharetrace "https://github.com/<username>"
# TikTok share link — extracts sharer identity + device + share method
python -m sharetrace "https://vm.tiktok.com/<code>"
# ChatGPT share — extracts display name
python -m sharetrace "https://chatgpt.com/share/<uuid>"| Name | Extracts | Notes |
|---|---|---|
| TikTok | User ID, Username, Nickname, Country, Avatar, Signature, Device, Share Method, Timestamp, Follower/Following/Video/Heart Counts, Private Account, DM Available | Requires short share link (vm.tiktok.com / vt.tiktok.com) |
| Username, User ID, Display Name, Profile URL, Profile Pic | Sharer data might expire within a few days; only fresh share links contain identity info | |
| Discord | User ID, Username, Display Name, Avatar, Creation Time | Vanity invites may not contain inviter data |
| ChatGPT | Display Name | |
| Claude | Display Name, User ID | |
| Perplexity | Username, Avatar, User ID | |
| Microsoft | From SharePoint/OneDrive personal links; no HTTP request needed | |
| Username, User ID, Display Name, Avatar, Profile URL | Requires short share link (pin.it) with invite code |
|
| Substack | User ID, Name, Handle, Bio, Avatar, Profile Setup Date | Requires referral share link (?r= parameter) |
| Suno | Username, Display Name, Avatar, Profile URL | |
| Telegram | User ID | Decoded from joinchat link hash; no HTTP request needed. Links starting with AAAAA decode to user_id=0 and contain no useful data |
| Google Docs ★ | Owner Email, Name, Google ID, Avatar, Creation Date, Last Edit, Public Permissions | Works for Docs, Sheets, Slides, Drawings, Forms, Drive files, Apps Script, Jamboard, My Maps. Requires document to be publicly shared. API key overridable via SHARETRACE_GDOC_API_KEY |
| GitHub ★ | Email, Name, Commit SHA, Repo (commit URL); Username, Emails list (profile URL) | Commit URL: parses .patch mbox From: header. Profile URL: scans recent public PushEvents (last 90 days). users.noreply.github.com emails flagged. Profile route subject to GitHub's 60/hr unauth rate limit |
| GitLab ★ | Email, Name, Commit SHA, Project (commit URL); Username, Display name, Avatar, User ID, public_email (profile URL) |
Commit URL uses same .patch trick as GitHub, handles nested groups. Profile returns public_email only when user opted in (GitLab strips push-event emails). gitlab.com only; self-hosted out of scope |
| Hugging Face ★ | Username, Fullname, Avatar, Account type (user/org), Follower count, Orgs list | Uses undocumented-but-stable /api/users/<name>/overview. Repo URLs resolve to owner. No email (HF privacy default). Denylist prevents service pages (spaces, datasets, etc.) from being treated as profiles |
| LinkedIn ★ | Display name, Headline, Profile URL, Avatar (OG tags) | Covers /in/, /posts/, /pulse/ URLs. Hit rate ~80% on high-profile public accounts; lower / degrading over time as LinkedIn tightens bot defenses. Blocked fetches honestly return {"error": "...", "is_blocked": true} — callers should expect this |
★ = added in this fork
A self-hosted Flask wrapper with a browser UI is available: voelspriet/sharetrace-web — live demo at https://share.whopostedwhat.com. Maintained separately against upstream; all extraction logic still lives in this repo.
This tool uses the following OSINT techniques:
- soxoj/sharetrace — the original project this fork builds on. The CLI scaffolding, platform routing, and every source module for TikTok, Instagram, Discord, ChatGPT, Claude, Perplexity, Microsoft/SharePoint, Pinterest, Substack, Suno, and Telegram were built by soxoj and upstream contributors. All credit for the core project belongs to them.
- Malfrats/xeuledoc — the Google Drive
v2betaowner-metadata endpoint was first documented here (GPLv3). Thegdocmodule in this fork is a clean-room rewrite against the same public API. - avonture.be — documented the GitHub
.patchtrick that thegithubmodule's commit route relies on.
This tool is created for educational and defensive purposes only.
- Only analyze links that have been publicly shared or sent to you.
- Only hit endpoints that are explicitly public (no auth, no scraping of private data).
- The fork maintainer is not responsible for misuse.
Permitted: journalistic fact-checking, corporate security research, authorized penetration testing, counter-scam / anti-fraud work (the reason this fork exists), personal reputation monitoring.
Forbidden: doxxing, harassment, stalking, unauthorized surveillance, social engineering for fraud, privacy invasion, any criminal activity.
Fork by Hieu Ngo
•
hieu.ngo@chongluadao.vn
•
chongluadao.vn
•
Upstream: soxoj/sharetrace
•
License: GPL-3.0