Credits for this goes to www.skullsecurity.org/blog/
First and foremost: if you want to cut to the chase, just download thetorrent. If you want the full story, please read on....
Way back when I worked at Symantec, my friend Nick wrote a blog that caused a little bit of trouble for us:Attack of the Facebook Snatchers. I was blog editor at the time, and I went through the usual sign off process and, eventually, published it. Facebook was none too happy, but we fought for it and, in the end, we got to leave the blog up in its original form.
My first idea was simple: spider the lists, generate first-initial-last-name (and similar) lists, then hand them over to@Ithilgoreto use in Nmap's awesome new bruteforce tool he's working on,Ncrack.
But as I thought more about it, and talked to other people, I realized that this is a scary privacy issue. I can find the name of pretty much every person on Facebook. Facebook helpfully informs you that "[a]nyone can opt out of appearing here by changing their Search privacy settings" -- but that doesn't help much anymore considering I already have them all (and you will too, when you download thetorrent). Suckers!
Once I have the name and URL of a user, I can view, by default, their picture, friends, information about them, and some other details. If the user has set their privacy higher, at the very least I can view their name and picture. So, if any searchable user has friends that are non-searchable, those friends just opted into being searched, like it or not! Oops :)
Which brings me to the next topic: the list! I wrote aquick Ruby script(which has since become a more involvedNmap Scriptthat I haven't used for harvesting yet) that I used to download the full directory. I should warn you that it isn't exactly the most user friendly interface -- I wrote it for myself, primarily, I'm only linking to it for reference. I don't really suggest you try to recreate my spidering. It's a waste of several hundred gigs of bandwidth.
The results were spectacular.171 millionnames (100 millionunique). My original plan was to use this list to generate alist of the top usernames(based on first initial last name):
So, those are the top 10 lists. But I'll bet you want everything!
But it occurred to me that this is public information that Facebook puts out, I'm assuming for search engines or whatever, and that it wouldn't be right for me to keep it private. Why waste Facebook's bandwidth and make everybody scrape it, right?
So, I present you with:a torrent! If you haven't download it, download it now! And seed it for as long as you can.
This torrent contains:
The URL of every searchable Facebook user's profile
The name of every searchable Facebook user, both unique and by count (perfect for post-processing, datamining, etc)
Processed lists, including first names with count, last names with count, potential usernames with count, etc
The programs I used to generate everything
So, there you have it: lots of awesome data from Facebook. Now, I just have to find one more problem with Facebook so I can write "Revenge of the Facebook Snatchers" and complete the trilogy. Any suggestions? >:-)