Instagram OSINT Tools, Tips, Techniques

As you know, Instagram OSINT is always changing, and so this page will be updated regularly. Please join the newsletter (bottom of page) to be notified of updates.

Instagram OSINT Guide

The Instagram OSINT guide is coming soon!

Instagram OSINT Tips

1. Most of the time, you’ll be using Google Dorking instead of Instagram’s built-in search engine.
2. To search only Instagram posts, use site:instagram.com/p in Google.
3. To search only Instagram profiles, use site:instagram.com "[first name]" | "[first name] [last name] on" (including quotes"", but remove the brackets[]) on Google.
4. More Instagram OSINT tips coming soon.

Instagram OSINT Tools

• IntelTechniques Custom Instagram Tools – I use this frequently, and it’s pretty much the tool I start with (even before Google Dorking). IntelTechniques is created and run by Michael Bazzell who is pretty much the guy when it comes to OSINT and Privacy.
• Google Search – Honestly, Google Dorking indexed Instagram content is probably where most of what I find is.
• More Instagram OSINT tools coming soon.

Case Studies

Case 1: Find user name with real name and possible associate account (such as company they work for or own).

This case can be seen on Reddit. First, their question:

instagram advanced search
lets say that I am looking for a “John Doe” on instagram who I know has posts related to “johndoeacademy”. Is there a way for me to search instagram with filters so that it only shows me results for John Doe’s who have posts related to johndoeacademy?

Posted by u/historicalrhino

My solution:

I’m a little unsure of some specifics here. Is “johndoeacademy” a hashtag or a username?

If it’s a username, I would use Google Dorking (AKA Google Hacking) to do this.

site:instagram.com/p "@johndoeacademy" & "John on" | "John Smith on" -site:instagram.com/johndoeacademy

Breakdown:

site:instagram.com/p tells Google we only want to search for results from Instagram.com/p which is what all posts are under.

"@johndoeacademy" tells Google we only want to search for any pages (posts) by @johndoeacademy, so we need to add -site:instagram.com/johndoeacademy to remove most (if not all) posts by @johndoeacademy.

Since we’re pulling up any page that mentions @johndoeacademy, we want to add & "John on" | "John Smith on" which will help limit a lot of the SERs (Search Engine Results) down to Instagram Profiles. & makes sure we’re including these searches so the SER must have “@johndoeacademy” AND “John on” OR “John Smith on”, with | representing the OR.

Here’s an example:

site:instagram.com/p "@zuck" & "Harvard on" | "Harvard University on" -site:instagram.com/zuck

Drop that in Google and see what you get. We’ll get 3 SERs:

• Two posts from Harvard University’s Instagram account mentioning @zuck, and then
• One from Edwardo Saverin mentioning both @zuck and Harvard University in the same post.

You can see it prioritized the Harvard ones over the Saverin one because of what we specified we were searching for.

Also, as /u/JackedRightUp said, you can change “site:” to “+” to get broader SERs for checking Instagram caching sites.

Example:

+Instagram "@zuck" & "Harvard on" | "Harvard University on" -site:instagram.com/zuck

or 

+instagram.com/p "@zuck" & "Harvard on" | "Harvard University on" -site:instagram.com/zuck