Part 2: I Broke Out of YouTube My Bot Now Hits Instagram & Twitter/X Too (3 Platforms, 3 Completely Different Protection Models)

Description and use

A Telegram bot originally built for YouTube media was expanded to support Instagram and Twitter/X, handling distinct protection models, authentication, and rate limits.

Problem

Expanding a Telegram bot that downloads YouTube content to also fetch Instagram and Twitter/X media required handling three distinct protection models, authentication schemes, and rate‑limiting behaviors.

Outcome

The bot now supports downloading media from YouTube, Instagram, and Twitter/X, handling authentication, diverse content types, and platform‑specific rate limits while maintaining performance and reliability.

Workflow

• Detect platform with regex router
• Validate URL and prevent SSRF
• For YouTube: use yt‑dlp with cookies and signature bypass
• For Instagram: load sessionid cookie, fetch CDN URLs via yt‑dlp extractor, handle public and authenticated content
• For Twitter/X: use yt‑dlp extractor, manage mixed media
• Download media with FFmpeg, apply hardware acceleration
• Deliver file via Telegram Bot API or MTProto based on size
• Update admin panel stats and logs
• Run automated tests for each platform

Evidence

Three platforms. Three protection models. Three sets of rules about what you can fetch without authentication, what you can't, and what will quietly rate-limit you into oblivion if you're not careful.

Source

For authenticated content (stories, highlights), the extractor needs a valid sessionid cookie — the same session token your browser uses when you're logged into Instagram.

Source

The SSRF check runs before platform detection. An attacker sending http://192.168.1.1/admin disguised as any platform URL gets rejected at this layer, not inside any platform-specific handler.

Source