Osintgram

Osintgram: A Deep Dive into Instagram OSINT

By Beyonddennis

In the dynamic realm of Open Source Intelligence (OSINT), tools designed to extract and analyze publicly available data are indispensable. Among these, Osintgram stands out as a robust, Python-based utility specifically tailored for gathering intelligence from Instagram profiles. This article, penned by Beyonddennis, aims to provide a comprehensive and uncensored exploration of Osintgram, detailing its functionalities, installation, usage, and critical ethical considerations.

What is Osintgram?

Osintgram is an OSINT tool developed by Datalux, designed to collect, analyze, and perform reconnaissance on Instagram accounts. It offers an interactive shell that allows users to extract various types of information from public Instagram profiles by simply using their nicknames. This tool leverages Instagram's API to gather publicly available data, making it a valuable asset for researchers, security analysts, and investigators interested in social media profiling and data gathering.

The term OSINT refers to Open Source Intelligence, a methodology focused on collecting and analyzing data from publicly accessible sources to derive actionable insights. Osintgram embodies this principle by focusing solely on information that Instagram users have made public. It is written in Python, making its code base accessible and its operation straightforward for those familiar with command-line interfaces.

Key Features and Capabilities

Osintgram provides a wide array of commands to extract specific data points from target Instagram profiles. These capabilities are designed to facilitate in-depth analysis and information gathering. Here's a breakdown of some of its core functionalities:

• addrs: Retrieves all registered addresses tagged by the target in their photos, including GPS information.
• captions: Extracts all captions used by the target in their photos.
• comments: Provides the total number of comments on the target's posts and can list users who commented.
• followers: Returns a list of the target's followers, including their IDs, nicknames, and full names.
• followings: Retrieves a list of users followed by the target, including their IDs, nicknames, and full names.
• fwersemail / fwingsemail: Attempts to retrieve email addresses of the target's followers or those they follow, if publicly available.
• fwersnumber / fwingsnumber: Attempts to retrieve phone numbers of the target's followers or those they follow, if publicly available.
• hashtags: Lists hashtags used by the target.
• info: Gathers comprehensive target information such as ID, full name, biography, follower/following counts, business account status, business category, verification status, business email, HD profile picture URL, connected Facebook page, WhatsApp number, city, and contact phone number.
• likes: Provides the total number of likes on the target's posts.
• mediatype: Determines the type of posts made by the user (photo or video).
• photodes: Extracts descriptions of the target's photos.
• photos: Allows downloading of the user's photos into an output folder, with the option to specify the number of photos to download.
• propic: Downloads the user's profile picture.
• stories: Downloads the user's stories.
• tagged: Lists users tagged by the target.
• wcommented: Gets a list of users who commented on the target's photos.
• wtagged: Gets a list of users who tagged the target.

The tool also provides options to save output to files, either as plain text or in JSON format, facilitating further analysis and integration with other tools.

Installation and Setup

Installing Osintgram is a straightforward process, primarily involving cloning the repository and setting up the Python environment. It is highly recommended to use a dummy or "throwaway" Instagram account for Osintgram to minimize risks to your primary account.

Prerequisites:

• Python 3
• Git
• A dedicated Instagram account (highly recommended)

Installation Steps:

1. Clone the Repository:

git clone https://github.com/Datalux/Osintgram.git

cd Osintgram

A virtual environment isolates the project's dependencies, preventing conflicts with other Python projects.

python3 -m venv venv

• On Linux and Git Bash:

  source venv/bin/activate

• On Windows Powershell:

  .\\venv\\Scripts\\activate.ps1

This command installs all necessary Python libraries for Osintgram to function.

pip install -r requirements.txt

You need to provide your Instagram account username and password. This can be done by manually editing the credentials.ini file or by running a setup command.

Manual Configuration:

cd config

Open credentials.ini (or username.conf and pw.conf in older versions/mirrors) using a text editor like nano:

nano credentials.ini

Enter your Instagram username and password:

[Instagram]  username = YOUR_INSTAGRAM_USERNAME  password = YOUR_INSTAGRAM_PASSWORD

Save and exit (Ctrl+O, Enter, Ctrl+X in nano).

Alternative (using Makefile with Docker setup):

If you are using Docker, a Makefile is provided for ease of use.

make setup

Also ensure a settings.json file exists in the config folder with "{}" as its content.

cd ..

(Navigate back to the main Osintgram directory if you entered the config folder.)

Running Osintgram:

Once installed and configured, you can run Osintgram:

python3 main.py <target_username>

Replace <target_username> with the Instagram handle of the account you wish to investigate. This will launch an interactive shell where you can execute various commands.

How to Use Osintgram: Practical Examples

After launching Osintgram with your target, you will be presented with an interactive prompt. You can type list or help to see all available commands.

Common Commands and Their Application:

Let's say your target is "example_user".

Getting Basic Information:

info

This command will display essential details about "example_user", such as their ID, full name, biography, business account status, and more.

propic

This will download the high-definition profile picture of "example_user" to your output folder.

followers

This command will output a list of all followers of "example_user", including their Instagram IDs and usernames. Be aware that for accounts with many followers, this can take time, and there might be practical limits to how much data can be extracted.

photos

After executing this, Osintgram will prompt you to specify how many photos you want to download. You can press Enter to download all available photos or type a number for a specific quantity.

You can enable saving command output to files (txt or JSON) using the FILE and JSON commands.

FILE=y

JSON=y

Now, when you run a command like comments, the output will also be saved to a file named <target_username>_comments.txt or <target_username>_comments.json in the output folder.

exit

This command closes the Osintgram interactive session.

Ethical and Legal Considerations

While Osintgram is a powerful tool, it is paramount to understand and adhere to the ethical and legal boundaries of OSINT. The developers explicitly state that the tool is for "EDUCATIONAL PURPOSE ONLY" and do not assume responsibility for its misuse.

Key Considerations:

• Publicly Available Information: Osintgram primarily extracts information that is publicly available on Instagram profiles. This means data from private accounts is generally inaccessible without authorized access (i.e., being a follower of that private account with their consent). Attempting to bypass privacy settings or gain unauthorized access to private accounts can violate platform policies and local laws, leading to significant legal repercussions.
• Instagram's Terms of Service: Instagram's terms of service generally prohibit unauthorized data scraping. While the legality of scraping publicly available data can be nuanced, using collected data for malicious purposes, such as spamming, identity theft, or harassment, is unequivocally illegal and unethical.
• Consent and Privacy: Always prioritize user privacy. If you are collecting data for research or legitimate business purposes, obtain consent whenever possible. Transparency about your data collection methods and respect for user autonomy are critical ethical principles.
• Responsible Use: The power of OSINT tools comes with a responsibility to use them ethically and lawfully. Using a dedicated, non-personal Instagram account for operating Osintgram is a practical measure to mitigate personal risks.
• Rate Limits: Be mindful of Instagram's rate limits. Excessive requests can lead to your IP address being blocked or your Instagram account being flagged by the platform.

Beyonddennis stresses that this tool should be used for legitimate investigative, security research, or educational purposes only, with full awareness of the legal frameworks in your jurisdiction and the platform's terms of service. Misuse can lead to serious consequences.

Limitations and Alternatives

Despite its capabilities, Osintgram has certain limitations. Its primary focus is Instagram, meaning it cannot gather intelligence from other social media platforms directly. Furthermore, its effectiveness is significantly reduced when dealing with private Instagram accounts, as it relies on publicly accessible data. While some developers are working on enhancing capabilities for private account analysis, this typically involves sophisticated methods that still adhere to ethical and legal standards, often by inferring connections from publicly visible elements like shared followers or comments, rather than direct access to restricted content.

For broader OSINT investigations across multiple platforms or for more advanced analytical needs, alternatives and complementary tools exist. These include:

• Instaloader: Another Python tool for downloading Instagram content, often used for archiving and detailed metadata extraction.
• SpiderFoot: An automated OSINT framework with over 200 modules for gathering intelligence from various sources.
• Maltego: A visual OSINT tool that helps map relationships between data points, valuable for complex investigations.
• Social-Analyzer: An API, CLI, and web app for finding and analyzing a person's profile across thousands of social media sites.
• Knowlesys: A more comprehensive OSINT monitoring system designed for large-scale data collection, analysis, and reporting across multiple platforms, often used by intelligence professionals for its robust features and compliance focus.

These tools, combined with human analytical skills, can provide a more holistic view in complex investigations.

This detailed overview, presented by Beyonddennis, reveals Osintgram as a potent instrument for targeted Instagram intelligence gathering. Its command-line interface provides direct access to a wealth of public data, empowering researchers and security enthusiasts. However, the true power of such a tool is unlocked only when wielded with a deep understanding of its ethical implications and legal boundaries. Knowledge is indeed power, but responsible application is key.