I am wondering how does a user use Kali with python Brute Force Algorithm to brute force accounts like a facebook account when there are security measure in place like:Pause your try after 3 unsuccessful login?

Edit: https://www.youtube.com/watch?v=bsh9_se3UC0

In the above video, the user used Kali and ran a python script that ran a "dictionlist".txt against a specific fb account, so i am wondering why it seemed that the account didnt block the attempt after 3 times?

  • Kali is a Linux distribution not a tool for brute-force.
    – Ulkoma
    Apr 3, 2016 at 6:06
  • Sorry i phrased the question badly. I edited it
    – John
    Apr 3, 2016 at 6:12
  • 1
    @John can you give more details like which Python program you are using and its source code?
    – Sravan
    Apr 3, 2016 at 7:41
  • 1
    Your question implies that this is possible, and that Kali has some characteristic that makes it useful for this. If your question had been "how come facebook accounts still get brute forced when there are security measures in place like Pause your try after 3 unsuccessful logins?" I would say that criminals usually go after any account, and so they try just a few common passwords on millions of accounts.
    – Law29
    Apr 3, 2016 at 9:18
  • 1
    The video is from 2014. This leads me to believe this was made around the time when Facebook had missing throttling on few actions (pwndizzle.blogspot.fi/2014/02/…), probably one of them was the recovery code (6 digits, 1 million possibilities) The "attacker" didn't really brute-force the password; he brute-forced this recovery code. Incidentally, a month ago somebody discovered the same issue with Facebook beta installation (More here: anandpraka.sh/2016/03/…)
    – Adi
    Apr 3, 2016 at 17:29

1 Answer 1


They don't.

If an attacker is trying to get into a specific account, he will rely on phishing or malware.

If an attacker is just trying to get working accounts, he will have a wordlist of emails and passwords that he'll try, thereby bypassing the restriction of password attempts simply because it's not being attempted on the same account.

  • Please post comment to a comment under the comment not in an unrelated answer. Have a look how SE sites work, how answers and comments are displayed (and hidden, often deleted) and try to imagine that it is not easy to follow loose references. If you can't comment yet, please wait till you can.
    – techraf
    Apr 3, 2016 at 11:14
  • I didn't have the required reputation to post a comment, which in my opinion is stupid, but there you have it.
    – Awn
    Apr 3, 2016 at 11:34
  • Hi, sorry for the confusing question etc...i wrote the original question because i was doing some research and saw a youtube vid, that the user was on Kali and used a python script that he include a "list".txt for the brute force on a specific account on facebook, so i wondered. This is the vid. youtube.com/watch?v=bsh9_se3UC0
    – John
    Apr 3, 2016 at 11:40
  • He doesn't show the scripts source, nor the password being cracked
    – Awn
    Apr 3, 2016 at 11:46
  • From that, you can't really ascertain much
    – Awn
    Apr 3, 2016 at 11:46

Not the answer you're looking for? Browse other questions tagged or ask your own question.