# How I was able to revoke your Instagram 2FA

Instagram signup OTP brute-force rate limit was IP-based; rotating IPs per request let an attacker guess the 6-digit SMS code and remove a victim's phone/2FA.

- Payout: $5,000
- Severity: medium
- Program: Meta / Facebook
- Credited: Dhiyaneshwaran
- Disclosed: 2021-10-23
- Write-up quality: 6/10
- Original: https://dhiyaneshgeek.github.io/web/security/2021/10/23/how-i-was-able-to-revoke-your-instagram-2fa/
- Library page: https://bugbountylibrary.com/r/blog%3Adhiyaneshgeek-github-io-web-security-2021-10-23-how-i-was-able-to-revoke-your-instagram-2fa
- Tags: domain:web impact:ato impact:integrity kind:bounty platform:blog sev:medium technique:recon vuln:auth-bypass vuln:business-logic vuln:mfa-bypass

**Target:** Instagram signup SMS OTP verification endpoint
**Root cause:** The OTP brute-force protection was enforced per source IP rather than per account/phone number, so rotating IPs per request evaded the attempt limit on a 6-digit code.
**Steps:**
1. Start Instagram signup at `https://www.instagram.com/` and enter an existing user's mobile number
2. Submit; server sends OTP and shows 6-digit code entry page
3. Enter any random OTP, intercept the request in Burp
4. Send to Intruder, set `sms_code` as payload position `$$`
5. Configure Burp to rotate source IP per request (upstream proxy pool)
6. Run attack; invalid codes return length 2547, correct code returns 3453 and 'Account Created'
7. Victim receives email 'Phone number removed as Two Factor Authentication Method'
**How found:** Read Neeraj Sonaniya's prior 'remove Instagram phone number' writeup and hypothesized the OTP attempt limit was IP-based, so IP rotation would bypass it.
**Exploitation:** Attacker enumerates the 6-digit OTP space via Burp Intruder while rotating source IP each request to avoid the per-IP block; on the matching code the account is created with the victim's number, which detaches it from the victim's account and disables SMS-based 2FA.
**Insight:** When a rate limit or lockout is keyed on source IP, test whether the protected secret (here a 6-digit OTP) can be brute-forced with per-request IP rotation via a proxy pool; also check whether re-registering a victim's phone number detaches it from their account.