I was wondering if servers can pick up password cracking? If they can, how would I protect myself from being detected?

My friends have let me practise on their accounts, but I don't know if Facebook will pull me up and blacklist my IP or something.

closed as off-topic by Xander, J.A.K., grochmal, S.L. Barth, Xiong Chiamiov Feb 1 '17 at 21:42

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – Xander, J.A.K., grochmal, S.L. Barth, Xiong Chiamiov
If this question can be reworded to fit the rules in the help center, please edit the question.

  • You do know that not all password cracking is the same right? Hashed passwords from a database are cracked offline. But bruteforcing web services, like you suggest, will definitely be picked up because you're sending thousands of requests. – J.A.K. Jan 30 '17 at 3:35
  • 1
    I obviously don't, or I wouldn't be asking the question... – MaliciouZzHD Jan 30 '17 at 4:02
  • 1
    If you're trying to crack someone else's Facebook password, you probably shouldn't even if the account owner gives you the permission to attempt that. The reason being that it's Facebook's system that you're cracking, so the account owner doesn't actually have the authority to give you permission to crack his account (unless by "friend", you mean Mark Zuckerberg). – Lie Ryan Jan 30 '17 at 10:07
  • 3
    Note that even if your friends let you do that, you may be still violating the TOS of Facebook. – Dmitry Grigoryev Jan 30 '17 at 10:07

Online password cracking, where you try different passwords against the actual service (e.g. Facebook) is incredibly noisy, since you are basically flooding the target with requests. On any serious system you are bound to be detected and blocked rather quickly.

You could try to spread out your attempts over longer times, direct them at different accounts and use different IPs. But unless it is a very simple password you don't have time to spare, and you will probably be detected anyway.

Offline password cracking is done in the privacy of your own home, and is therefore only noisy in the sense that it will cause your fans to spin a lot. But to crack a password offline you need to have the hash, and Facebook aint giving you that.

Finally do note that practising password cracking on your friends Facebook account is probably illegal and definetely a violation of their terms of service, even if you have your friends permission. You risk getting into serious trouble here. There are plenty of vulnerable-by-design systems out there that meant to be used to practice hacking on. I'd recommend you play around with one of those instead. In the long run, it will be more fun.


Define "noisy".

If I pull a NTLM hash from a Windows System, and attempt to brute force it, only I, myself, am aware of the brute force attempts.

Using the same scenario, but attempt to brute force on the same system, it would be fairly obvious due to increased resource usage.

Attempting to break into a web account is going to draw attention. Because for each password, you make a request to the server. Many websites now feature time-outs, locational restrictions, and others to prevent/deter brute-forcing a password.

Not the answer you're looking for? Browse other questions tagged or ask your own question.