uuidinfo

Documentation

Overview

Package uuidinfo decodes a UUID/GUID into its structure and — crucially for recon — any information it leaks. A version-1 (or version-6) UUID embeds the **generating host's MAC address** and the **creation timestamp**; a version-7 UUID embeds a millisecond creation timestamp. These appear in tokens, API responses, email Message-IDs, filenames, database keys, and session identifiers, so a UUID captured in any of those deanonymizes the host that minted it (the classic "UUIDv1 leaks the MAC + time" finding) and time-orders records for enumeration. Pure offline transform; no network or device.

Wrap-vs-native judgement

Native. A UUID is 16 bytes with a fixed RFC 9562 (formerly RFC 4122) bit layout: a 4-bit version nibble, a 2-3 bit variant, and per-version timestamp / node / clock-sequence fields. Decoding is hex parsing + bit/field extraction + a gregorian↔unix epoch shift — there is nothing to wrap, and the Go stdlib has no UUID type. Distinct from internal/btuuid, which looks up Bluetooth GATT service UUIDs (a different, assigned-numbers concern). Consistent with the other in-tree identifier/loot decoders.

Verifiable / no confidently-wrong output

Anchored to Python's reference `uuid` module: the v1 example decodes to its exact version / variant / node / clock-sequence and UTC timestamp (2006-06-10T10:48:31.013993Z, node 00:11:24:44:be:1e), v3/v4/v5/v7 to their versions, and the v7 48-bit millisecond timestamp to its exact UTC instant. v6 (which the reference module does not timestamp-decode) is cross-checked against v1 by field-reordering the same known instant. Versions that embed no recoverable data (v3/v5 name hashes, v4 random) say so rather than inventing a timestamp; the MAC-leak assessment is gated on the IEEE multicast bit, so a randomized node is never reported as a hardware address. A non-UUID string is rejected.

Index

• type Result
  • func Decode(in string) (*Result, error)

Types

type Result

type Result struct {
	UUID        string `json:"uuid"`    // canonical 8-4-4-4-12 lowercase
	Version     int    `json:"version"` // 1..8; 0 = nil/max/unversioned
	VersionName string `json:"version_name"`
	Variant     string `json:"variant"`

	TimestampUTC string `json:"timestamp_utc,omitempty"` // v1 / v6 / v7
	UnixMillis   int64  `json:"unix_millis,omitempty"`
	Node         string `json:"node,omitempty"` // v1 / v6 — colon MAC form
	NodeIsMAC    bool   `json:"node_is_mac,omitempty"`
	ClockSeq     int    `json:"clock_seq,omitempty"` // v1 / v6

	Note string `json:"note,omitempty"`
}

Result is the decoded view of a UUID.

func Decode

func Decode(in string) (*Result, error)

Decode parses a UUID in any common textual form (8-4-4-4-12 dashed, 32 bare hex, urn:uuid: prefixed, or {brace}-wrapped) and reports its structure.