# How I Exposed Instagram's Private Posts by Blocking Users

Instagram oEmbed mobile-UA route used a superuser account to bypass blocks, letting attackers read private posts and media of users who blocked them.

- Payout: $14,500
- Severity: high
- Program: Meta / Facebook
- Credited: 003random
- Disclosed: 2023-10-12
- Write-up quality: 8/10
- Original: https://003random.com/posts/meta-bountycon-instagram-writeup/
- Library page: https://bugbountylibrary.com/r/blog%3A003random-com-posts-meta-bountycon-instagram-writeup
- Tags: domain:web impact:data-leak impact:pii-leak kind:bounty platform:blog sev:high tech:rest technique:chained technique:recon vuln:access-control vuln:auth-bypass vuln:xs-leak

**Target:** Instagram oEmbed API endpoint (/api/v1/oembed)
**Root cause:** The mobile user-agent code path of the oEmbed endpoint had an error case for region-blocked posts that fell back to a superuser account to fetch content, ignoring block/privacy restrictions.
**Steps:**
1. Request `https://www.instagram.com/api/v1/oembed/?hidecaption=0&maxwidth=540&url=https://www.instagram.com/p/<id>` with a normal UA from a blocked account -> 404 'No Media Match'
2. Repeat the same request with `User-Agent` containing `iphone` or `android`
3. Observe JSON returned with title, author, and CDN `thumbnail_url` for the private/blocked post
**How found:** Noticed Chrome (with mobile UA spoofer) returned JSON for a blocked private post while Burp returned 404; ruled out caching via hard refresh, diffed requests, isolated the only difference as the user agent, then fuzzed UA wordlist confirming only 'iphone'/'android' substrings trigger the bypass.
**Exploitation:** Attacker blocks victim (or victim blocks attacker), then requests the victim's post via oEmbed with an iphone/android UA to retrieve title, description, and authenticated CDN media URL. Combined with XS-Leak script-tag probing to enumerate which visitors are blocked, and automation across attacking accounts, could scale to mass private-post access.
**Escalation:** Chained with an XS-Leak (script onload/onerror on oEmbed) to identify victims who blocked the attacker, then automated blocking across accounts/regions for widespread private post harvesting.
**Insight:** When a response differs between your proxy and browser, diff every header — a mobile-UA branch can hit a separate code path with weaker authz (here a superuser fallback for region blocks). Fuzz UA substrings to find hidden mobile-only logic.