Instagram Private Profile Deanonymization

If a private profile has a collaboration post with a public profile it is possible to access the post and the collaborators without authentication, only by knowing the private profile's username, thus expand the possible connections to the target of the investigation.

By opening https://www.instagram.com/szh4ck3r/ (unauthenticated) the browser will make a request to https://www.instagram.com/api/v1/users/web_profile_info/?username=szh4ck3r (old instagram API) which would list the user's collaboration posts with public profiles.

GQL api get feed:

• Literally nothing lmao

• Obv. listed

• Ohshi w(hy)tf

• no szh4ck"
  • aka Unauth is the new auth

• Haha it's just intentional behavior get fkd retard