182 lines
10 KiB
Markdown
182 lines
10 KiB
Markdown
---
|
||
name: sms-verification-automation
|
||
description: Automated SMS verification for service activation via SMS providers (HeroSMS, GrizzlySMS, 365sms) and ADB-controlled Android device. Covers MyJio and Gemini but generalises to any app requiring SMS OTP.
|
||
trigger: User asks to verify a phone number, get OTP, activate a service via SMS, or automate login with phone verification.
|
||
---
|
||
|
||
# SMS Verification Automation
|
||
|
||
Automate SMS-based phone verification for any service using SMS activation providers and ADB-controlled Android device.
|
||
|
||
## References
|
||
- `references/credentials.md` — account credentials for all SMS providers
|
||
- `references/pvacodes-api-jiofarm.md` — PVACodes API (TLS-blocked, browser-bridge required), Jio service prices India, jiofarm integration (2026-09-19)
|
||
- `references/2nd-no-free-polish-numbers.md` — **2nd-no.com: бесплатные польские номера** (5/день, 3 дня живёт), полный Playwright-флоу реги/логина/модала номера, API-карта 2no.pl (JSON-RPC), tempmail.lol v2 query-token питфолл (2026-09-19)
|
||
|
||
## Бесплатные веб-SMS сервисы (без балансов/платежей)
|
||
|
||
- **2nd-no.com** (Польша, +48) — рега по email, 5 бесплатных номеров/день, живут 3 дня, продлеваются при входящем SMS. Только через браузер (API за Cloudflare). Полный playbook: `references/2nd-no-free-polish-numbers.md`.
|
||
- Каталог остальных бесплатников (temp-number.com, quackr.io, sms-activate.guru free и их статусы): skill `cybersec/temp-sms-free`.
|
||
- Правило: крупные сервисы (Google/Facebook/GitLab) часто режут VoIP/фри-номера — проверять доставку до массового использования.
|
||
- Resend-троттл живёт на ЦЕЛЕВОМ пользователе, не на номере: сервисы (WorkOS-класс) рисуют «код отправлен» на verify-странице, но молча не доставляют повторные SMS тому же user в пределах ~1-2ч — ротация номера не помогает и только жжёт слоты. Ждать cooldown или верифицировать нового user (новый аккаунт = SMS доставляется сразу).
|
||
- **Twilio-based верификация (MLH и подобные US-платформы) — блок КАТЕГОРИЧЕСКИЙ**: арендные/виртуальные номера не получают SMS НИ в одной стране (add/resend возвращают 200, SMS не приходит никогда; проверено на 8 номерах/7 стран hero-sms, включая пулы с 25k+ physicalCount). НЕ итерировать страны — сразу реальная SIM (попросить юзера продиктовать один код). Мёртвый рент возвращает ban+refund (`setStatus status=8`). Детали: skill `ai-provider-autoreg` → `references/mlh-ghw-promo-claim.md`.
|
||
|
||
## Providers (ordered by effectiveness for Jio/Indian services)
|
||
|
||
| Provider | API URL | Key Location | Best For | Notes |
|
||
|----------|---------|--------------|----------|-------|
|
||
| GrizzlySMS | `api.grizzlysms.com/stubs/handler_api.php` | Account → Settings → API tab | MyJio, real SIM cards | Requires browser login to get key; MyJio is dedicated service |
|
||
| HeroSMS | `hero-sms.com/stubs/handler_api.php` | User provides | General | DO NOT use `herosms.com` (wrong domain) |
|
||
| 365sms | `365sms.org/stubs/handler_api.php` | In `HEROSMS_CLIENT_GPT55_Gothbreach.py` | General | Jio OTP does NOT arrive on this provider |
|
||
| PVACodes | `beta.pvacodes.com/app/api.php` | Дашборд ?page=user/api (Влад: [REDACTED-NAME]@gmail.com) | India ($0.16-0.33), 50+ стран | **TLS(JA3)-блок: только через Playwright bridge** :18085 (API, `credentials:'omit'` — include ломает ключ) + :18086 (дашборд, persistent_context). См. references/pvacodes-api-jiofarm.md |
|
||
|
||
All three use sms-activate compatible API protocol.
|
||
|
||
## Crucial Pitfall: Jio Blocks Virtual Numbers
|
||
|
||
**Jio (MyJio) checks if the phone number is a real Jio subscriber.** Virtual numbers from HeroSMS/365sms will NOT receive the OTP — the SMS is never sent. Status will be `STATUS_WAIT_CODE` indefinitely or `STATUS_CANCEL`.
|
||
|
||
**PVACodes Jio-сервисы: ВСЕ 9 купленных номеров (Jio11/JIO7/Jio17/Jio19/JioSaavn7) = НЕ Jio-абоненты** (2026-09-19 финал: sendOtp → `400 INVALID_JIONUMBER_ERROR`). Jio17 отдаёт ПОЛНЫЙ номер прямо из API (`+916393438597`), в отличие от маскированных Jio11/JIO7 (+919****1247). Все Jio-сервисы в каталоге имеют success_count=0. `cancel_number` = полный авто-рефанд пока код не получен, НО не раньше 60с после покупки («Please wait 60 more seconds before cancelling») — в скриптах ждать 65с. Out of Stock деньги не списывает. Rent-каталог India пуст. PVACodes для Jio = мёртвый путь. Детали: `references/pvacodes-api-jiofarm.md`.
|
||
|
||
**Only GrizzlySMS explicitly supports MyJio** with real SIM cards (Airtel/Jio/Vodafone). It is the only provider observed to have a chance of receiving Jio OTP.
|
||
|
||
**Дешёвый pre-check любого номера на Jio (до покупки следующего):** POST `https://www.jio.com/api/jio-login-service/login/sendOtp` body `{"mobileNumber":"<10 цифр>","loginFlowType":"MOBILE","alternateNumber":""}` (формат подтверждён сетевым перехватом с jio.com/selfcare/login). Ответ `INVALID_JIONUMBER_ERROR` = номер не Jio → cancel+refund. Это валидация за $0 вместо ожидания OTP 120с.
|
||
|
||
## GrizzlySMS Setup
|
||
|
||
### Registration
|
||
1. Open `https://grizzlysms.com/registration` in browser (Chrome DevTools MCP works)
|
||
2. Fill: Name, Email (use guerrillamail.com), Password, Confirm Password
|
||
3. Check both checkboxes (privacy + public offer)
|
||
4. Click Registration
|
||
5. Accept cookie banner if present
|
||
|
||
### Getting API Key
|
||
1. Log in at `https://grizzlysms.com/authorization`
|
||
2. Navigate to Settings → API tab
|
||
3. Copy API key (readonly textbox, format: 32-char hex)
|
||
|
||
### Top-Up
|
||
- Balance is $0 after registration
|
||
- Click "Top Up balance" in header
|
||
- Minimum deposit required (check UI)
|
||
|
||
### API Usage
|
||
```
|
||
# Check balance
|
||
curl "https://api.grizzlysms.com/stubs/handler_api.php?api_key=[REDACTED]"
|
||
|
||
# Get MyJio number — use service code from web UI (not 'myjio' in API)
|
||
# Check the service code in the Price page or web UI
|
||
curl "https://api.grizzlysms.com/stubs/handler_api.php?api_key=[REDACTED]"
|
||
|
||
# Poll for SMS
|
||
curl "https://api.grizzlysms.com/stubs/handler_api.php?api_key=[REDACTED]"
|
||
```
|
||
|
||
## HeroSMS Usage
|
||
|
||
Domain: `hero-sms.com` (NOT `herosms.com` — connection reset).
|
||
|
||
```
|
||
# Check balance
|
||
curl "https://hero-sms.com/stubs/handler_api.php?api_key=[REDACTED]"
|
||
|
||
# Get number for India (country=22), try any service
|
||
curl "https://hero-sms.com/stubs/handler_api.php?api_key=[REDACTED]"
|
||
|
||
# Services with most Indian numbers: tg, li, go, ig, dr, wb, vk
|
||
# But Jio OTP will NOT arrive on these — use only for non-Jio services
|
||
```
|
||
|
||
## Android Device Control via ADB
|
||
|
||
### Device Info
|
||
- Model: Xiaomi 24117RN76E (Android 15, MIUI)
|
||
- Serial: `furcwslfnn6d7drk`
|
||
- ADB path: `C:/Users/User/AppData/Local/Android/Sdk/platform-tools/adb.exe`
|
||
- Resolution: 1080x2400
|
||
|
||
### Critical: ADB from execute_code vs terminal
|
||
- `execute_code` sandbox CANNOT connect to ADB — commands time out
|
||
- Use `terminal` tool for ALL ADB commands
|
||
- Always use full path to adb.exe
|
||
|
||
### Essential ADB Commands
|
||
```bash
|
||
ADB="C:/Users/User/AppData/Local/Android/Sdk/platform-tools/adb.exe"
|
||
DEV="furcwslfnn6d7drk"
|
||
|
||
# Wake device
|
||
"$ADB" -s "$DEV" shell input keyevent 26
|
||
|
||
# Launch MyJio (monkey works, am start may fail)
|
||
"$ADB" -s "$DEV" shell monkey -p com.jio.myjio 1
|
||
|
||
# Tap coordinates (MyJio: number field ~540,1100; Generate OTP ~540,1400)
|
||
"$ADB" -s "$DEV" shell input tap X Y
|
||
|
||
# Enter text
|
||
"$ADB" -s "$DEV" shell input text "PHONE_NUMBER"
|
||
|
||
# Delete characters
|
||
"$ADB" -s "$DEV" shell input keyevent 67 # KEYCODE_DEL
|
||
|
||
# Check screen state
|
||
"$ADB" -s "$DEV" shell dumpsys power | grep mWakefulness
|
||
# "Awake" = screen on, "Asleep" = screen off → wake with keyevent 26
|
||
|
||
# Screenshot (may be black due to FLAG_SECURE)
|
||
"$ADB" -s "$DEV" shell screencap -p /sdcard/screen.png
|
||
"$ADB" -s "$DEV" pull /sdcard/screen.png "C:/Users/User/screen.png"
|
||
```
|
||
|
||
### MyJio App Quirks
|
||
- Package: `com.jio.myjio`
|
||
- Installed via Xiaomi GetApps (not Google Play)
|
||
- Version: 8.0.37
|
||
- **FLAG_SECURE enabled** — screenshots show black screen
|
||
- Login flow: enter number → "Generate OTP" → OTP screen → auto-reads SMS from device
|
||
- No Skip/Guest option on start screen
|
||
- "Try another way to get OTP" → "Get OTP on call" option exists but doesn't work with virtual numbers
|
||
|
||
## OTP Polling Pattern
|
||
|
||
```bash
|
||
ACT_ID="activation_id"
|
||
for i in $(seq 1 30); do
|
||
sleep 4
|
||
resp=$(curl -s --max-time 10 "https://API_URL?api_key=[REDACTED]")
|
||
if [ $((i % 5)) -eq 0 ]; then echo "[$i] $resp"; fi
|
||
if echo "$resp" | grep -q "STATUS_OK"; then
|
||
code=$(echo "$resp" | cut -d: -f2)
|
||
echo "OTP: $code"
|
||
# Enter code on device
|
||
"$ADB" -s "$DEV" shell input text "$code"
|
||
break
|
||
elif [ "$resp" != "STATUS_WAIT_CODE" ]; then
|
||
echo "[$i] $resp"
|
||
break
|
||
fi
|
||
done
|
||
```
|
||
|
||
Status codes: `STATUS_WAIT_CODE` (waiting), `STATUS_OK:CODE` (SMS received), `STATUS_CANCEL` (expired/failed).
|
||
|
||
## Helicopter View: Decision Tree
|
||
|
||
```
|
||
Need SMS OTP?
|
||
├── Is it Jio/MyJio?
|
||
│ ├── YES → GrizzlySMS only (real SIM cards needed)
|
||
│ │ ├── PVACodes/365sms/HeroSMS = non-Jio номера (INVALID_JIONUMBER_ERROR, проверено)
|
||
│ │ └── Need to top up balance first (min deposit ~$5-10)
|
||
│ ├── Sender is Twilio-based (MLH etc.)?
|
||
│ │ └── YES → REAL SIM only (virtual numbers = zero SMS in ANY country)
|
||
│ └── NO → HeroSMS or 365sms (virtual numbers work for most services)
|
||
│ ├── HeroSMS: hero-sms.com, ~$4.20 balance
|
||
│ └── 365sms: 365sms.org, ~$0.52 balance
|
||
└── Need browser interaction?
|
||
└── Use Chrome DevTools MCP (mcp__chrome_devtools__*)
|
||
NOT execute_code (sandbox has network restrictions)
|
||
``` |