Forum Thread: How Elliot in Mr. Robot Brute Force Social Media and Email Accounts (Facebook, Instagram, Gmail) ?

I realy like to know the name of the tool used in mr.robot by eliot to brute force social media and email accounts

Join the Next Reality AR Community

Get the latest in AR — delivered straight to your inbox.

17 Responses

There is a script called CUPP (Common Users Password Profiler) that generates custom wordlists based on information you give it, much like the one he uses.

i know scripts to generate passwords but i want the script he use to brute force not to generate passwords ! thnx bro

I think it is a custom script he created he created himself....that accepts the information given and run the bruteforce along side it...

You're right, he used his custom script, and making the custom script means he know how does it work... and that's powerful

am not looking for password generator am looking for password cracker

Did you read the comments? They were specifically talking about password crackers.

hi ! since many people use their fav team or food or pet etc... its fairly easy to creat custom wordlist with some script and tools such as cupp but how to crack it? well its farily easy again if that website dosent limit you or have bot detection and captcha etc ... you can use hydra plus burp to start cracking it down (some email websites limit you to 100 try or 10 try like yahoo then it blocks you) so you gonna have hard time :P .

yep maybe i can use proxy or something else ! thnx bro !

Cracking passwords of native English speaking countries is much easier than countries where multiple languages are spoken. So regular crackers wont work.

Anything that can be done manually, can be automated by a bot.

To prevent such behaviour, website implement captchas and javascript to invalidate most common tools available to the average public. And haxor write libraries to overcome captchas and similar. This cat-and-mouse is always on favour of attackers, since they are always the most motivated to break a protection, anyhow, everywhere.

This said, to make a login bruteforcer for a specific platform like fb, twitter, instagram, you should make a script that mimics a browser behaviour, starting from the request headers, to accepting cookies, to resolving math javascript calculus just like a normal browser would do. It's tedious, and you will have to fix it from time to time as your target upgrades its protection scheme.

It's very likely that Elliot wrote those scripts on his own, and keeps them updated as he's used to hack everyone, on a daily base. I haven't bothered writing any (except an old one specific for my router) but with a little debugging of the connection (wireshark/burp), it's possible to replicate a manual browser connection and brute force login:pass.

I think elliot already got the password hash, all his script did was bruteforce the hash. CUPP would be a good tool to use here.

Now, how he got the hash is the question. Maybe wireshark or something similar? Thoughts guys?

That is not how it works, the cracking part is mostly unrealistic

it was realistic you just need to think about it,

you dont need to hack some one email to access all of his accounts all of us using many apps and register ourself in many website which they ask us to put email - user and password and 80% of us only one password easy ha? you get one app - webiste password you get all :)

ùmmm yes that's right looking for a web site and getting to database or brute force our target password in the web site like forum ! store .... !! does reeally work and 95% he use t he same password =D

Try using TOR browser or install Hola extension in chrome or firefox

Share Your Thoughts

  • Hot
  • Active