[maxbd]

Hello, I would like to bring a problem I have been having to light, in this community as it seems to fit in with the theme in a way. Recently I have been experimenting with a Python 3.6 script to see if I could login to an alternate account on a popular gaming website "ROBLOX," using a password list I had compiled. It works without proxies, but then there's Captcha, so I need to implement use of proxies. In this case I am using free (So slow and public, but still usable) HTTP proxies. If I implement the use of proxies into the program, sometimes it works when the password is low in the list, but if I move it higher up it seems to fail and give me an attempt failed message.


If anyone wouldn't mind analyzing my messy Python code for me and telling me if anything is wrong with it.
The PasteBin link code is "1mHxJJ37" or "raw/1mHxJJ37."
Sorry for the inconvenience, I can not paste the script here as HackForums blocks it.

(Yes, the correct password is in the list, and both passwords.txt and proxies.txt are in the same file as the Python script and both have content.)
(Details: Python 3.6, using IDLE 32-bit)

[moneyyyy]

There are a lot of programs already working,
for example take a look here:
tools.kali.org/password-attacks/hydra

[Woes]

Please use functions in your code!

[maxbd]

There are a lot of programs already working,
for example take a look here:
tools.kali.org/password-attacks/hydra

That defeats the whole point as to what I am trying to accomplish.

[Mohinder]

Please use functions in your code!

Not necessarily needed here in my opinion.

Depending on the size of the password list, and proxy list your are providing, I would suggest using multiple threads to make this go even faster.
When I get home I will write something cool for you.

Edit: 420 posts <3 Blaze it

[moneyyyy]

Not necessarily needed here in my opinion.

Depending on the size of the password list, and proxy list your are providing, I would suggest using multiple threads to make this go even faster.
When I get home I will write something cool for you.

Edit: 420 posts <3 Blaze it

I had done some tests and the same code with functions are very much faster than without them.

---

That defeats the whole point as to what I am trying to accomplish.

Sorry, I didn't get it, can you explain better?

[Mohinder]

I had done some tests and the same code with functions are very much faster than without them.

---

Sorry, I didn't get it, can you explain better?

I would love to see those tests. At the end, when running threads functions are needed to target the threads.

[vorticalbox]

I would love to see those tests. At the end, when running threads functions are needed to target the threads.

I would love to see that too

Not necessarily needed here in my opinion.

Depending on the size of the password list, and proxy list your are providing, I would suggest using multiple threads to make this go even faster.
When I get home I will write something cool for you.

Edit: 420 posts <3 Blaze it

This doesn't really help seeing as the problem is that a password at the top of the list works but when moved down it doesn't

Seeing as the password files when it's lwoer int he list I would say that the lower proxies are the cause of the problem.
-- snip

All I can

[moneyyyy]

I would love to see those tests. At the end, when running threads functions are needed to target the threads.

I was talking that is faster to execute many little functions instead of one large function

[IWannaLearn144]

Just looked through code yes you should implement functions into your code it makes your program much easier to understand and scale later if you would like to. One thing id suggest is instead of using a proxy list try connecting over tor instead iv done that on a twitter account bruteforcer before and it works fine if you reset your ip every 20 or so tries.

[maxbd]

Just looked through code yes you should implement functions into your code it makes your program much easier to understand and scale later if you would like to. One thing id suggest is instead of using a proxy list try connecting over tor instead iv done that on a twitter account bruteforcer before and it works fine if you reset your ip every 20 or so tries.

Wow, that's actually really smart. I will try that, I've also heard of people exploiting the site's login API to use something they called "Device Handles" to give them 20 tries per hour, and producing a bunch of device handles to use in a list instead of proxies.

[scrubjay]

Wow, that's actually really smart. I will try that, I've also heard of people exploiting the site's login API to use something they called "Device Handles" to give them 20 tries per hour, and producing a bunch of device handles to use in a list instead of proxies.

Bruteforcing is just dumb. "20 tries per hour" is WAY to low. I do 1500 tries per second with aircrack and even then you need like a century to crack a 12 character password ("abcdefghijkl"). I would never ever brute force a account. It just takes too long.

Instead of brute force try Social Engineering. It's way faster and cheaper (Bruteforcing costs much electricity)

[IWannaLearn144]

Bruteforcing is just dumb. "20 tries per hour" is WAY to low. I do 1500 tries per second with aircrack and even then you need like a century to crack a 12 character password ("abcdefghijkl"). I would never ever brute force a account. It just takes too long.

Instead of brute force try Social Engineering. It's way faster and cheaper (Bruteforcing costs much electricity)

Bro wtf are you on about? Aircrack is cracking a wpa hash stored on your harddrive so your limited by your gpu speed. Which 1500 is still slow af. When bruteforcing a login over a network your limited by the network speed as well as how often the server will let you try login so you have no idea what your talking about.

Also 20 tries per hour is too slow. Fastest twitter bruteforcer iv seen over tor is 400 a second which was made in batch.

[maxbd]

Bruteforcing is just dumb. "20 tries per hour" is WAY to low. I do 1500 tries per second with aircrack and even then you need like a century to crack a 12 character password ("abcdefghijkl"). I would never ever brute force a account. It just takes too long.

Instead of brute force try Social Engineering. It's way faster and cheaper (Bruteforcing costs much electricity)

The point was people would collect lists of them, so they could have around hundreds of thousands of tries. And looking at passwords of accounts, most of them are weak when made by unsuspecting people. The type of passwords you would find in password lists. It's not really a brute force, more like a dictionary attack. Anyways, I'm thinking about trying to write a program that looks at a user, and tries to find out about them using their profile, other linked platforms, ETC. And it would then create a password list based on that person and their interests, and other things.

[vorticalbox]

Bruteforcing is just dumb. "20 tries per hour" is WAY to low. I do 1500 tries per second with aircrack and even then you need like a century to crack a 12 character password ("abcdefghijkl"). I would never ever brute force a account. It just takes too long.

Instead of brute force try Social Engineering. It's way faster and cheaper (Bruteforcing costs much electricity)

Or a password list of the most commonly used password. rockyou is a pretty extensive list