WhatsApp Media Enumeration (wenum)

WhatsApp Media Enumeration is a self-scope proof of concept tool designed to trace the lineage of media shared through WhatsApp without sending any additional data. Leveraging WhatsApp's media deduplication and end-to-end encryption, this tool allows users to uncover important details regarding media items, all while adhering to strict ethical guidelines of use.

Overview

WhatsApp employs a content-addressed media deduplication cache to save bandwidth, allowing it to reuse the same mediaKey (an end-to-end key not visible to the server) and directPath for previously sent media. This mechanism enables an ordinary client to:

• Determine if specific media has ever been sent through their account by matching the fileSha256.
• Identify if two pieces of media share a common origin and the various chats through which the media has been forwarded, using the reused mediaKey.
• Access information about when a media item was originally uploaded and if any copies were reused, indicated by the mediaKeyTimestamp.

This tool showcases how the combination of encryption and deduplication can inadvertently reveal media provenance, highlighting a unique intersection of privacy and usability in messaging platforms.

Key Features

• Login Command: Establishes a linked WhatsApp Web session for usage.
• Detect Command: Checks if a specified media item exists in the user's history without sending anything externally.
• Forwarding Analysis: Analyzes media blocks that share an identical mediaKey across multiple chats, providing insights into media usage.
• Timestamp Comparisons: Compares the message time of forwards against the mint time of the media blob, giving detailed historical context.
• Export History: Create offline snapshots of history for analysis.

Installation Requirements

• Node.js 20 or higher
• Python 3 for optional tools (only requires if generating images)

Usage Example

./wenum login                 # Link a session once by scanning a QR code.
./wenum detect photo.jpg      # Check if this media has ever been sent.
./wenum forward --repeats     # Identify media with the same key seen across multiple chats.
./wenum forward --timestamps  # Compare every forward's message time against blob mint time.
./wenum forward --help        # Access help for all modes and commands.

Ethical Usage

This tool is intended for self-scope applications only. Users must employ it to analyze their own linked sessions against their own synced history. The project emphasizes responsible use and discourages any intent to deanonymize or monitor others' activities.

For a deeper understanding of this project's framework and implications, refer to the white paper available in both English and Spanish: English White Paper · Español.