# How I Could Have Hacked Any Instagram Account

Instagram's account recovery code verify endpoint allowed brute-forcing the 6-digit passcode via concurrent requests from many IPs, enabling takeover of any account.

- Payout: $30,000
- Severity: critical
- Program: Meta / Facebook
- Credited: Laxman Muthiyah
- Disclosed: 2019-07-14
- Write-up quality: 7/10
- Original: https://thezerohack.com/hack-any-instagram
- Library page: https://bugbountylibrary.com/r/blog%3Athezerohack-com-hack-any-instagram
- Tags: domain:api domain:mobile impact:ato kind:bounty platform:blog sev:critical tech:rest technique:race-window vuln:account-takeover vuln:auth-bypass vuln:race-condition

**Target:** Mobile API endpoint /api/v1/accounts/account_recovery_code_verify/
**Root cause:** Rate limiting on the recovery code verification endpoint was per-IP and not concurrency-safe, so parallel requests from many IPs bypassed the limit while the 6-digit code space (1M) remained brute-forceable within the 10-minute expiry.
**Steps:**
1. POST /api/v1/users/lookup/ with `q=mobile_number&device_id=...` to trigger a 6-digit recovery passcode to victim's phone (expires in 10 min).
2. Brute-force POST /api/v1/accounts/account_recovery_code_verify/ with `recover_code=NNNNNN&device_id=...`.
3. Send concurrent requests across many IPs: ~200 requests per IP before rate limit; 1000 machines/IPs yielded 200k requests in tests.
4. Scale to ~5000 IPs (cloud VMs) to cover all 1M codes within the 10-minute window (~$150 cost).
5. On correct code, proceed to reset the victim's password.
**How found:** Started with forgot-password web flow (link-based, no bug), pivoted to mobile recovery flow; noticed 6-digit code and tested rate limiting — ~250/1000 requests passed, no blacklisting despite continuous requests; hypothesized per-IP limiting and concurrency gap, then tested race hazard plus IP rotation.
**Exploitation:** Attacker triggers a recovery passcode for the victim's phone number, then distributes concurrent verification requests across thousands of cloud IPs to brute-force the 6-digit code before the 10-minute expiry, then resets the password to take over the account.
**Escalation:** Scaling via IP rotation and concurrency (cloud VMs) to cover the full 1M code space within the expiry window.
**Insight:** When a short numeric OTP is guarded only by per-IP rate limits, test whether limits are concurrency-safe and whether the code space divided by (requests-per-IP × IPs) fits inside the code's expiry window — the math, not a single bypass, is the bug.