/Instagram_SSL_Pinning

Bypass Instagram SSL Pinning on Android

GNU General Public License v3.0GPL-3.0

Instagram SSL Pinning

Bypass Instagram SSL Pinning on Android (ARM and x86) Version 140.0.0.30.126

Requirements

  • Latest version of JDK (Download)

  • Burp Suite v1.7.36 (*.jar version) (Download)
    !!! Please DON'T USE CHARLES, FIDDLER OR MITMPROXY. Only use *.JAR VERSION of Burp Suit and ONLY VERSION 1.7.36, NOT v2 or v2020. And please run it with the LATEST VERSION OF JAVA !!!

  • Instagram APK (ARM - x86) - For root method only
    Download only from this links, not Google Play or somewhere else

  • a rooted Android device (Physical or virtual) - For root method only
    Genymotion Android 8+ recommended.
    Genymotion virtual devices is x86 and rooted by default.

  • ADB (Download) - For root method only
    Genymotion will install ADB automatically and you can find it on <Genymotion Installation path>/tools

Non-Root Method (Easier way, Recommended)

Usage

  1. Download and install patched APK (ARM - x86). (ARM on physical device recommended!)

    1.2. For x86 only, Open Instagram app (wait a few seconds) and close it.
    It's important to run Instagram app once, before setting the proxy!

  2. Run Burp Suite with /<JDK Installation path>/bin/java -jar burpsuite_community.jar and setting up proxy on your Android device.
    You should install Burp Suite certificate on your Android device

  3. That's it! Now open the Instagram app on your device and intercept the requests in Burp Suite !

Root Method

Watch tutorial video

Usage (It's important to do step by step)

  1. Download and install Instagram apk on your device.

  2. Open Instagram app (wait a few seconds) and close it.
    It's important to run Instagram app once, before start patching!

  3. Download the patched file (ARM - x86) and push it to the device:
    ARM: adb push libliger.so /data/data/com.instagram.android/lib-superpack-zstd/libliger.so
    x86: adb push libliger.so /data/data/com.instagram.android/lib-zstd/libliger.so

  4. Open Instagram app again (wait a few seconds) and close it.

  5. Run Burp Suite with /<JDK Installation path>/bin/java -jar burpsuite_community.jar and setting up proxy on your Android device.
    You must set the proxy in this step
    You should install Burp Suite certificate on your Android device

  6. That's it! Now open the Instagram app and intercept the requests in Burp Suite !

Instagram Signature Key for ARM and x86

  • v136.0.0.34.124: 46024e8f31e295869a0e861eaed42cb1dd8454b55232d85f6c6764365079374b
  • Versions greater than 136.0.0.34.124: SIGNATURE
    Example: signed_body=SIGNATURE.{"phone_id":"51df5a24-e59e-46cd-bc01-fe658aba9f18","_csrftoken":"mPzWvJ399rqCxOY5rn6Bggq7oOcFkf6U","usage":"prefill"}

Donations

If you want to show your appreciation, you can donate via PayPal.
Bitcoin: 1GhTaq5HqEj4xpP42drPxT4FNzxp8zUTfK
Iranian users can donate via IDPay.

Thanks.