Forum Thread: How Elliot in Mr. Robot Brute Force Social Media and Email Accounts (Facebook, Instagram, Gmail) ?

There is a script called CUPP (Common Users Password Profiler) that generates custom wordlists based on information you give it, much like the one he uses.

i know scripts to generate passwords but i want the script he use to brute force not to generate passwords ! thnx bro

I'm curious too. Maybe this is where the necessary unrealistic things in Mr. Robot kick in?

-Phoenix750

You can use password lists in Hydra, and maybe even John.

I'm sure with a little reverse engineering a list generator and a cracker could be put together into one tool.

the question is what he used to brute-force the list, not how to generate one.

-Phoenix750

I understand that. I'm simply saying that a tool such as the one he's asking about could be built.

I think it is a custom script he created he created himself....that accepts the information given and run the bruteforce along side it...

You're right, he used his custom script, and making the custom script means he know how does it work... and that's powerful

The comments in this article should hopefully prove useful.

am not looking for password generator am looking for password cracker

Did you read the comments? They were specifically talking about password crackers.

yep i did & thnx bro

yep maybe i can use proxy or something else ! thnx bro !

Cracking passwords of native English speaking countries is much easier than countries where multiple languages are spoken. So regular crackers wont work.

Anything that can be done manually, can be automated by a bot.

To prevent such behaviour, website implement captchas and javascript to invalidate most common tools available to the average public. And haxor write libraries to overcome captchas and similar. This cat-and-mouse is always on favour of attackers, since they are always the most motivated to break a protection, anyhow, everywhere.

This said, to make a login bruteforcer for a specific platform like fb, twitter, instagram, you should make a script that mimics a browser behaviour, starting from the request headers, to accepting cookies, to resolving math javascript calculus just like a normal browser would do. It's tedious, and you will have to fix it from time to time as your target upgrades its protection scheme.

It's very likely that Elliot wrote those scripts on his own, and keeps them updated as he's used to hack everyone, on a daily base. I haven't bothered writing any (except an old one specific for my router) but with a little debugging of the connection (wireshark/burp), it's possible to replicate a manual browser connection and brute force login:pass.

I think elliot already got the password hash, all his script did was bruteforce the hash. CUPP would be a good tool to use here.

Now, how he got the hash is the question. Maybe wireshark or something similar? Thoughts guys?

it was realistic you just need to think about it,

you dont need to hack some one email to access all of his accounts all of us using many apps and register ourself in many website which they ask us to put email - user and password and 80% of us only one password easy ha? you get one app - webiste password you get all :)

Try using TOR browser or install Hola extension in chrome or firefox