Datalux / instagram-weak-encryption

Get the length of the Instagram encrypted password
43 stars 9 forks source link

Can't generate password #1

Open pauloswear opened 1 year ago

pauloswear commented 1 year ago

Hello, i am using your model to try generate encrypted password, i will post my code, hope can you help-me

from Crypto.Cipher import AES
from Crypto.Random import get_random_bytes
import base64
import struct
from datetime import datetime

def encrypt_password(password, key_id, public_key, version):
    iv = get_random_bytes(12)
    key = get_random_bytes(32)
    ad = str(int(datetime.now().timestamp())).encode()

    cipher = AES.new(key, AES.MODE_GCM, nonce=iv)
    ciphertext, tag = cipher.encrypt_and_digest(password.encode())

    encrypted_key = base64.b64encode(seal_key(key, public_key)).decode()

    result = bytearray([1, int(key_id)])
    result.extend(struct.pack('<H', len(encrypted_key)))
    result.extend(base64.b64decode(encrypted_key))
    result.extend(tag)
    result.extend(ciphertext)

    payload = base64.b64encode(result).decode()

    return f"#PWD_INSTAGRAM_BROWSER:{version}:{int(datetime.now().timestamp())}:{payload}"

def seal_key(key, public_key):
    return public_key.encode() + key

But when I request login endpoint I can't login, it happens:

{"message":"CSRF token missing or incorrect","status":"fail"}

Non encrypted password with 0 version works fine

h9nt commented 1 year ago

U have to put the csrftoken and valid app id lol

pauloswear commented 1 year ago

both are valid

h9nt commented 1 year ago

both are valid

Btw I prefer to use mobile api.

godxgamer commented 7 months ago

hey your code wrong because you are adding iv and session key

user29042001 commented 2 weeks ago

hey your code wrong because you are adding iv and session key

any document or tutorial for leaning to decrupt password of website like this, bro