Using the Mojang API to find glitched Minecraft accounts.

[MoneyWasted]

Using the Mojang API to look up the username "_" it returns an invalid UUID which bugs applications using the username and UUID lookup like NameMC.

Trying to look up the username on NameMC return an Error 500 which is a server error where something has gone wrong on the web site's server but the server could not be more specific on what the exact problem is. Thanks to APIs that Mojang makes public we can find what that problem is.

Going to the following URI returns the username and the invalid UUID

https://api.mojang.com/users/profiles/minecraft/_

This is what the query returns.

{
  "id": "3126ba4c6uud424c877d1347fa974d23",
  "name": "_"
}

As you can see the characters separated from the rest are invalid characters for a base 16 string.

3126ba4c6   uu   d424c877d1347fa974d23

Using the following URI requests the users Skin and Cape using the UUID.

https://sessionserver.mojang.com/session/minecraft/profile/3126ba4c6uud424c877d1347fa974d23

This is what the query returns.

{
  "id": "3126ba4c6uud424c877d1347fa974d23",
  "name": "_",
  "properties": [
    {
      "name": "textures",
      "value": "eyJ0aW1lc3RhbXAiOjE1NjcwMDM5NTQwODYsInByb2ZpbGVJZCI6IjMxMjZiYTRjNnV1ZDQyNGM4NzdkMTM0N2ZhOTc0ZDIzIiwicHJvZmlsZU5hbWUiOiJfIiwidGV4dHVyZXMiOnsiU0tJTiI6eyJ1cmwiOiJodHRwOi8vdGV4dHVyZXMubWluZWNyYWZ0Lm5ldC90ZXh0dXJlL2M2ZGI0YTg5YmY4OWIyM2NhZGQ4NDhmZmViZTUyMzA1YTc5NjE1ZTMwYzEwZWQ4N2JkMDFkMzZlZDg1MmU5NDcifSwiQ0FQRSI6eyJ1cmwiOiJodHRwOi8vdGV4dHVyZXMubWluZWNyYWZ0Lm5ldC90ZXh0dXJlL2EyZThkOTdlYzc5MTAwZTkwYTc1ZDM2OWQxYjNiYTgxMjczYzRmODJiYzFiNzM3ZTkzNGVlZDRhODU0YmUxYjYifX19"
    }
  ]
}

Decoding the textures value which is a Base64 string that contains the users skin and cape returns that the account has a skin and a 2012 Minecon Cape.

{
  "timestamp": 1567003954086,
  "profileId": "3126ba4c6uud424c877d1347fa974d23",
  "profileName": "_",
  "textures": {
    "SKIN": {
      "url": "http://textures.minecraft.net/texture/c6db4a89bf89b23cadd848ffebe52305a79615e30c10ed87bd01d36ed852e947"
    },
    "CAPE": {
      "url": "http://textures.minecraft.net/texture/a2e8d97ec79100e90a75d369d1b3ba81273c4f82bc1b737e934eed4a854be1b6"
    }
  }
}

After to talking to people in the community the account _ is a legacy account that was used when Minecraft use to have a demo. It was created by Mojang as a test account like X, Y and u. Why it has a Minecon cape is unknown. If anyone else finds any other glitched accounts share them here.