Video summary

How Hackers Find Anyone's Info From Just Their Instagram...

Main summary

Key takeaways

Technology

Overview

The video demonstrates an OSINT workflow for finding personal details from a single Instagram username (the subtitles note that the creator claims to use only their own accounts and warns against misuse).

Core Concept / Threat Model

The workflow uses OSINT (open-source intelligence)—collecting publicly available information about a person from across the internet.

Starting from one Instagram handle, the process is claimed to reveal:

  • Real name
  • City/location
  • Phone number
  • Other accounts the person has used online

The video also includes a legal/ethical warning: while OSINT itself is legal, using it to stalk, harass, or scam is illegal.

Tool 1: OSINTGram (Instagram handle → public leaked account data)

OSINTGram is described as a GitHub tool (“pretty popular”).

Input / Output

  • Input: one Instagram username
  • Output: “everything Instagram is publicly leaking” for that account

Setup / Installation

As described in the video:

  1. Clone the repository bash git clone ...

  2. Use a virtual environment

  3. Install dependencies: bash pip install -r requirements.txt

  4. Configure credentials in config/credentials.ini, including:

    • username
    • password
    • hiker_api_token (token-based approach recommended)

Authentication approach

The tool warns that using a normal Instagram login/password may trigger bot detection and lead to locking/banning.

Instead, it recommends a Hiker API token, including notes such as:

  • “First 100 requests are free after registration and confirmation with your Telegram.”
  • It demonstrates obtaining an access key and saving it to the tool’s config.

Execution

  • Run: bash python3 main.py <target_username>

  • It opens an interactive prompt with commands including:

    • info (basic profile info)
    • addrs/address (addresses found via photos)
    • following email (emails of users followed by the target)
    • others (e.g., cache clearing)

Example results shown

  • info returns profile details such as:

    • Instagram ID
    • Full name and bio
    • follower/following counts
    • number of photos/posts
    • business/verified indicators
    • HD profile picture

  • address/addrs claims to extract a specific address by leveraging Instagram location tagging behavior:

    • Users drop a pin, and Instagram labels it with a nearby name (e.g., “Anthony, Texas”)
    • Behind the label is a more precise location (pin/address), which the tool extracts
    • The demo maps the address on Google Maps and correlates it with a photo location (e.g., a “Welcome to Texas” sign)

  • following email finds emails associated with accounts the target follows

    • Example accounts referenced: Hack The Box, Network Chuck, David Bombal (the list is described as partial)
    • The video frames this as “leverage” for phishing/social engineering via personalized DMs/emails that impersonate the target

Tool 2: Sherlock (username → account presence across many sites)

Sherlock checks whether a username exists across 400+ websites.

Input options

  • single username
  • multiple usernames
  • usernames from a TXT file
  • optional --site filtering to reduce runtime
  • mentions it can check NSFW websites as well

Execution shown

  • sherlock --help to view options
  • sherlock <username> for a basic run

Example output / limitation

  • Example: 46 results across platforms (e.g., Discord, Reddit, YouTube, TryHackMe, etc.)
  • Limitation: it primarily finds which sites/URLs contain the username, not deeper profile details.

Tool 3: Maigret (username → richer cross-site aggregation)

Maigret performs a similar cross-site search with more information gathering.

Setup

pip install maigret

Execution

  • maigret <username>

Claimed behavior

  • Searches the username across ~500 sites
  • Returns more profile metadata (not only links)

Example shown

For GitHub, it extracts details like follower/following counts, name, and location (example: Germany).

The video emphasizes that this reduces manual effort because you don’t have to inspect each site’s profile info one-by-one.

“How to make sure it doesn’t happen to you” (privacy guidance)

The video advises:

  • Search yourself on Google and review results for your name
  • If you don’t like what’s shown:
    • change usernames
    • make social media accounts private
  • If content you don’t control appears (e.g., an old tournament result):
    • contact the site owner to request removal (email/DM)

Main Speakers / Sources (as implied)

Speaker / host

  • The video creator/host, who references multiple prior OSINT videos and a Discord link.

Mentioned example account

  • “Network Chuck” is mentioned as an example account shown in results (not as a tooling source).

Tools / primary sources mentioned

  • OSINTGram (GitHub tool)
  • Sherlock (sherlockproject)
  • Maigret (maigret)

Authentication service mentioned

  • Hiker API (for Instagram request handling)

Original video