Facebash A Shell Script Tool for Facebook Brute-Force Testing Through Tor

Facebash is a Bash-based security tool designed to automate password-guessing attempts against Facebook login accounts. The project uses Tor for network routing and includes session management features intended to save and resume activity.

Because automated login attempts can trigger account protections and violate platform rules, Facebash should be understood as a password-attack tool rather than a general-purpose OSINT utility. Do not use it against accounts you do not own or have explicit authorization to test.

Key Features of Facebash

• Session management: The project advertises the ability to save and resume sessions.
• Tor integration: It is designed to route activity through the Tor network. Tor does not make unauthorized activity legal or guarantee anonymity.
• Password list: The original description advertises a bundled password list containing more than 39,000 entries. Its current contents and accuracy should be verified in the repository.
• Shell script implementation: The tool is written for command-line use in a Linux environment.

Requirements

The original project documentation identifies Curl and Tor as dependencies. Compatibility may vary depending on the operating system, installed packages, and the current state of the repository.

• A compatible Linux environment
• Bash and Git
• Curl
• Tor, if required by the project configuration

Understanding the Risks of Password Guessing

The original description warns that Facebook may temporarily restrict login attempts after repeated incorrect passwords and claims that the script is limited to 20 attempts per hour. This should not be treated as a guaranteed or current platform limit. Login protections can change, and repeated attempts may result in additional verification, account restrictions, or other security responses.

Tor only changes how network traffic is routed. It does not bypass account authentication requirements or provide permission to access someone else’s account. For defensive learning, review password security, rate limiting, and account protection practices instead.

Safer Alternatives for Security Learning

If your goal is to understand authentication security, use a test application or a lab environment where you control the accounts and have permission to run experiments. You can also explore open-source OSINT tools for research involving publicly available information.

For web security learning, see H2Buster, an HTTP/2 web directory scanner. It focuses on web application discovery rather than attempting to guess social media passwords.

Project Source

The original Facebash project was published on GitHub. Before examining or running old security tools, review the source code, dependencies, maintenance status, and potential risks associated with executing third-party scripts.

View the Facebash repository on GitHub

Disclaimer

This article is provided for cybersecurity education and defensive awareness. Attempting to access accounts without authorization may violate applicable laws and platform policies. Only conduct security testing on accounts and systems you own or are explicitly authorized to assess. Users are responsible for complying with all applicable laws and regulations.