[Th0r]

Hi!
Is there a way to hack an Instagram\Twitter account if I only know the username?
Thanks

[Mom]

This belongs here.

Also just the username? Literally nothing else? I guess bruteforcing counts, but-..

[Kuem]

you need to find out the email and the phone

[mothered]

The recovery options of any account Is the weakest point of security. It provides you with Information that (when researched further), can Identify the victim or his/her subsequent accounts.

For example, I've just entered a random name In Instagram's account recovery options and It's provided me with the first & last chars AND the email provider associated with the account:

Spoiler:

This Is an excellent starting point.

If I were to research this further with the recovery options In other major accounts, some may reveal (for example) the first 2 chars or characters In the middle, last 3 characters etc and without too much effort, I could formulate an entire email address. I'd then compromise that email account, send a "password reset link" to It (from Instagram's recovery options), reset the password and have full control of the target's Instagram's account.

Or I could use the email address to perform a reverse email lookup, see If It's associated with a Facebook account etc and build an Identity/profile of the target, then social engineer and compromise his/her account directly. Or alternatively, send a keylogger to the target's email address.
EDIT: Info added.

[Mom]

The recovery options of any account Is the weakest point of security. It provides you with Information that (when researched further), can Identify the victim or his/her subsequent accounts.

For example, I've just entered a random name In Instagram's account recovery options and It's provided me with the first & last chars AND the email provider associated with the account:

Spoiler:

This Is an excellent starting point.

If I were to research this further with the recovery options In other major accounts, some may reveal (for example) the first 2 chars or characters In the middle, last 3 characters etc and without too much effort, I could formulate an entire email address. I'd then compromise that email account, send a "password reset link" to It (from Instagram's recovery options), reset the password and have full control of the target's Instagram's account.

Or I could use the email address to perform a reverse email lookup, see If It's associated with a Facebook account etc and build an Identity/profile of the target, then social engineer and compromise his/her account directly. Or alternatively, send a keylogger to the target's email address.
EDIT: Info added.

Do keyloggers even still work when sent over email? Don't most computers ask for manual permission for anything to get into the computer from said email if not everywhere? Or do you just disguise it as something the recipient would want to download?

[MrSecurity]

depends..
if the (key-logger) have previously been identified then no
else yes you could do so. combined within portable document or else,
as far as detection windows with UAC (user account control) which asks you before launching untrusted or unknown application and am pretty sure most users have turned that off neither it protects you nor alert you from the actual nature,
add to info,
https://www.symantec.com/connect/article...keyloggers

[Mom]

depends..
if the (key-logger) have previously been identified then no
else yes you could do so. combined within portable document or else,
as far as detection windows with UAC (user account control) which asks you before launching untrusted or unknown application and am pretty sure most users have turned that off neither it protects you nor alert you from the actually nature,
add to info,
https://www.symantec.com/connect/article...keyloggers

People turn off UAC? Wild. Anyways thanks for the read. Keyloggers are easily the thing I'm most interested in.

[mothered]

Do keyloggers even still work when sent over email? Don't most computers ask for manual permission for anything to get into the computer from said email if not everywhere? Or do you just disguise it as something the recipient would want to download?

If the keylogger Is FUD and binded to a legit file, the user wouldn't know the difference- permissions prompted, UAC or otherwise.

[Th0r]

Wow - sorry for not being here for a long time...
Thank you for your great discussion!
@mothered @Mom @MrSecurity @Kuem

[alexiswashington17]

I don’t know ??‍♀️ how to hack twitter account