Skip to content

Instantly share code, notes, and snippets.

@dtmrc

dtmrc/discord-account-generator.py

Last active February 7, 2022 20:34
Show Gist options
  • Save dtmrc/edc9e04aebb74b7818b5b7b80b740dbd to your computer and use it in GitHub Desktop.
Save dtmrc/edc9e04aebb74b7818b5b7b80b740dbd to your computer and use it in GitHub Desktop.
Download ZIP
reddit post - discord account generator
Raw
discord-account-generator.py
#!/usr/bin/env python
# see https://www.reddit.com/r/discordapp/comments/smoh49/im_sending_fake_discord_sites_with_fake_user_data/
from selenium import webdriver
from selenium.webdriver.common.by import By
from selenium.webdriver.support.ui import WebDriverWait
from selenium.webdriver.chrome.options import Options
from selenium.webdriver.support import expected_conditions as EC
import random, time
from faker import Faker
fake = Faker()
options = Options()
options.headless = False
driver = webdriver.Chrome('C:\\Users\\user\\Documents\\ChromeDriver\\chromedriver.exe', chrome_options=options)
url = """
URL goes here
"""
var = ''
driver.get(url)
char_list = ["^","%","$","#","@","!"]
emails = ["@gmail.com", "@yahoo.com", "@hotmail.com", "@outlook.com", "@webnet.com", "@comcast.net", "@email.net"]
try:
var = 'website failed to load'
while True:
choice = random.choice(char_list)
username = WebDriverWait(driver, 20).until(EC.presence_of_element_located((By.XPATH, '//*[@id="app-mount"]/div[2]/div/div/div[2]/div/form/div/div/div[1]/div[2]/div[1]/div/div[2]/input')))
username1 = fake.name().replace(" ","") + random.choice(emails)
username.clear()
username.send_keys(username1)
password = WebDriverWait(driver, 20).until(EC.presence_of_element_located((By.XPATH, '//*[@id="app-mount"]/div[2]/div/div/div[2]/div/form/div/div/div[1]/div[2]/div[2]/div/input')))
password1 = fake.password(length=random.randint(6,20))
password.clear()
password.send_keys(password1)
password.submit()
print("Sent Username: {} Password: {}".format(username1,password1))
var = 'username + password'
time.sleep(1)
except:
print(var)
print('non existant')
driver.quit()
Raw
notes.md

sources

I've been running this script for about 20 hours. Hopefully this will prevent some from getting their accounts stolen.

This was prompted after yet another compromised account started spamming in one of the Discord servers i'm in.

I figured that i should share what i've been doing to encourage others in obfuscating real user data on these scummy phishers.

This is done via Window's own built in sandbox (windows 10 pro feature) and VPN software (to send various IP addresses)

Currently using ChromeDriver with Selenium and Faker in Python. I'll be building my own database of fake usernames and passwords that look even more believable.

No need for threading or async code here. Single instance app.

More requests a second would be redundant.

See comment here: https://old.reddit.com/r/discordapp/comments/smoh49/im_sending_fake_discord_sites_with_fake_user_data/hvxwndd/

sync runs everything on one thread. multiprocessing would let you utilize multiple cpu cores to do work.

multiprocessing is a package that supports spawning processes using an API similar to the threading module. The multiprocessing package offers both local and remote concurrency, effectively side-stepping the Global Interpreter Lock by using subprocesses instead of threads. Due to this, the multiprocessing module allows the programmer to fully leverage multiple processors on a given machine.

See here https://old.reddit.com/r/discordapp/comments/smoh49/im_sending_fake_discord_sites_with_fake_user_data/hvxpvys/

wait till you realize you can automate all this!

For me it's a simple right mouse click, copy as Python-Requests. Pretty sure Chrome has a built in "copy as cURL" which can then be converted to Python using https://curlconverter.com/

VPN software (to send various IP addresses)

This isn't nearly as hard to stop as people think.

Like, for one, you can reverse lookup a lot of these addresses and see that its a VPN company that owns it, and then drop the records. I do this all the time with my company purchase form. Scammers think they're slick using VPN and server farms to hide their IP and then forget that half the addresses are owned by "Scummy VPN company" and none of our legitimate customers are purchasing products from "AWS".

Also, if you're rotating the IP addresses any less frequently than one-per, you can filter out pretty much all the posts that are using multiple accounts from the same IP.

Theres also a fuck ton of front end ways to detect this kind of thing, though thats not really going to help unless they've already implemented them. Things like monitoring typing speed, detecting chromedriver (Cloudflare does this) etc.

Honestly though, I think the biggest issue here is the data, since most of those records could be filtered out using a regex expression. Most people aren't using FirstLast email addresses IME and those password manager looking passwords are also a lot rarer IRL than most people would probably want to admit. Cross that with the fact that the UA on all of these posts is going to be the same and you've probably got a 99.99% filter on the data with minimal false positives right there.

Did you check to make sure you're not passing any session cookies over or anything?

This may be mildly annoying for anyone who isn't experienced in dealing with this sort of thing. Its worth a shot for some fun. Anyone with any real world experience though, this should be pretty easy to recover from with minimal effort.

ip spoofing

I'd say it was a while ago- But these days pretty much all network hardware has preventative measures:

https://www.cloudflare.com/learning/ddos/glossary/ip-spoofing/

Supposedly even verifying outgoing packets on consumer grade machines. Sorry if i framed it to never have been possible, or that it isnt possible. Was trying to frame it in a simpler light.

I literally spoofed an IP header last week. It is very much possible and it isn't even incredibly difficult if you know what you are doing. You can put whatever you want in the src field of a ip packet

Did you report to the company hosting the server, and https://www.cisa.gov/uscert/report-phishing ?

more

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment