Instagram

🔬 ATLAS SECURITY LAB

Stored XSS

Comment field renders innerHTML — try <img src=x onerror=alert(document.cookie)>

IDOR on Profiles

GET /api/users/[ID] — change ID to access any profile

Username Enumeration

Error messages reveal if username exists

CSRF on Follow

POST /follow?uid=X — no CSRF token required

OAuth Redirect Flaw

redirect_uri not validated — token leak possible

Instagram

🌸

sara_ah

🏖️

travel_k

🌴

nature_s

🔥

hot_pics

😊

atlas_hacker 2h

🌸

sara_ahmed 4h

Get the app.

🔬 LAB ACCOUNTS

atlas_hacker / lab123
victim_user1 / password1
admin_ig / admin2024

Any input works — local session only

👤

atlas_hacker

Atlas Hacker

Suggested for youSee All

👤

username

🌅