asedefecio
Newbie
- Jun 24, 2020
- 1
- 0
I want to log in into android Instagram using web browser sessionid cookie.
As you may know, the web browser doesn't allow you to see temporary photos or videos, and afaik the only way to see them is with the mobile app. (btw if there's a simpler way just tell me haha)
This post may also be of interest to people making bots so I thought i'd post this here.
So far I've made a lot of progress, being able to do everything except this.
I've been able to log in with chrome using both web and app sessionid, and I've also managed to log in using android's app using another cookie made with the app.
But I just can't log into android using web cookies, and I know for a fact that the cookie is sent alright because the session id gets deleted (I cant log in with chrome anymore)
I know that the android app cookies are stored in /data/data/com.instagram.android/shared_prefs/UserCookiePrefsFile_xxxxxx.xml, where xxxxx is the user ID.
There the cookies are stored in the usual sessionid, csrftoken, ds_user_id forms, except that they are pseudo encrypted in hex. Here's an example:
<?xml version='1.0' encoding='utf-8' standalone='yes' ?>
<map>
<string name="cookie_ds_user">ACED000573720054636F6D2E696E737....</string>
<string name="cookie_ds_user_id">ACED00057372005463....>
<string name="cookie_sessionid">ACED000573720054636F6D2E696E73746167....</string>
...
</map>
Here you can easily get the xxxxxx%3Axxxxxx%3Axx session cookie using any online hex to ascii converter. I copypasted this value into Chrome with success. I also pasted another phone's sessionid here successfully. But when I turn a web sessionid into hex and paste it here it just won't work.
There's other info in that string that comes out as illegible text using the hex->ASCII method that I suspect is the real key to this. Following this page (https://sub0709.tistory.com/131) I managed to get the encode/decodecookies function in java (https://pastebin.com/t9quPM62). Problem is, I don't know how to code in Java, only Python.
PS: Im kinda surprised you can log in using only sessionid, I would've thought you also needed csfrtoken
As you may know, the web browser doesn't allow you to see temporary photos or videos, and afaik the only way to see them is with the mobile app. (btw if there's a simpler way just tell me haha)
This post may also be of interest to people making bots so I thought i'd post this here.
So far I've made a lot of progress, being able to do everything except this.
I've been able to log in with chrome using both web and app sessionid, and I've also managed to log in using android's app using another cookie made with the app.
But I just can't log into android using web cookies, and I know for a fact that the cookie is sent alright because the session id gets deleted (I cant log in with chrome anymore)
I know that the android app cookies are stored in /data/data/com.instagram.android/shared_prefs/UserCookiePrefsFile_xxxxxx.xml, where xxxxx is the user ID.
There the cookies are stored in the usual sessionid, csrftoken, ds_user_id forms, except that they are pseudo encrypted in hex. Here's an example:
<?xml version='1.0' encoding='utf-8' standalone='yes' ?>
<map>
<string name="cookie_ds_user">ACED000573720054636F6D2E696E737....</string>
<string name="cookie_ds_user_id">ACED00057372005463....>
<string name="cookie_sessionid">ACED000573720054636F6D2E696E73746167....</string>
...
</map>
Here you can easily get the xxxxxx%3Axxxxxx%3Axx session cookie using any online hex to ascii converter. I copypasted this value into Chrome with success. I also pasted another phone's sessionid here successfully. But when I turn a web sessionid into hex and paste it here it just won't work.
There's other info in that string that comes out as illegible text using the hex->ASCII method that I suspect is the real key to this. Following this page (https://sub0709.tistory.com/131) I managed to get the encode/decodecookies function in java (https://pastebin.com/t9quPM62). Problem is, I don't know how to code in Java, only Python.
PS: Im kinda surprised you can log in using only sessionid, I would've thought you also needed csfrtoken