# InstaBrute: Two Ways to Brute-force Instagram Account Credentials

Instagram's mobile login rate-limit bug and web registration credentials oracle allowed unlimited password brute-force, enabling account takeover of weak-password accounts.

- Payout: $5,000
- Severity: high
- Program: Meta / Facebook
- Credited: Arne Swinnen
- Disclosed: 2016-05-19
- Write-up quality: 7/10
- Original: https://www.arneswinnen.net/2016/05/instabrute-two-ways-to-brute-force-instagram-account-credentials/
- Library page: https://bugbountylibrary.com/r/blog%3Aarneswinnen-net-2016-05-instabrute-two-ways-to-brute-force-instagram-account-credentials
- Tags: domain:mobile domain:web impact:ato kind:bounty platform:blog sev:high tech:rest technique:recon vuln:auth-bypass vuln:business-logic vuln:info-disclosure

**Target:** Mobile authentication endpoint and web registration endpoint
**Root cause:** Mobile login rate limiter alternated reliable/unreliable responses after 2000 guesses, and the web registration endpoint returned distinct responses for correct vs incorrect passwords without rate limiting.
**Steps:**
1. Bypass SSL pinning and phish HMAC key to sign requests to `https://i.instagram.com/api/v1/accounts/login/`
2. Send >2000 login guesses; observe alternating 'username not found' and real responses
3. Replay unreliable responses until a reliable answer is received (~2 requests per guess)
4. For issue #2, replay registration request with only `username` and `password` params
5. Observe distinct response for correct vs incorrect password (credentials oracle)
6. Run Burp Intruder over 10001 passwords to confirm brute-force
**How found:** Noticed rate-limit response changed to 'username not found' after ~1000 guesses, then alternated reliably/unreliably after 2000; separately replayed a registration request and saw differing responses, then stripped params to isolate the oracle.
**Exploitation:** Attacker enumerates usernames via incremental userIDs, then brute-forces passwords through the mobile login endpoint (replaying unreliable responses) or the web registration oracle, logging in with harvested credentials since no lockout or 2FA blocked it.
**Escalation:** Combined user enumeration, weak 6-char password policy, absent 2FA and no lockout to scale to mass account compromise including high-profile accounts.
**Insight:** When a rate limiter returns a misleading error after a threshold, test whether responses alternate deterministically — replaying 'unreliable' responses can recover a full brute-force channel. Also strip registration requests to minimal params to expose credential oracles.