{"id":13844735,"url":"https://github.com/urbanadventurer/Android-PIN-Bruteforce","last_synced_at":"2025-07-12T00:31:27.291Z","repository":{"id":37349784,"uuid":"288351538","full_name":"urbanadventurer/Android-PIN-Bruteforce","owner":"urbanadventurer","description":"Unlock an Android phone (or device) by bruteforcing the lockscreen PIN. Turn your Kali Nethunter phone into a bruteforce PIN cracker for Android devices! (no root, no adb)","archived":false,"fork":false,"pushed_at":"2023-10-10T07:00:48.000Z","size":2444,"stargazers_count":4058,"open_issues_count":31,"forks_count":731,"subscribers_count":211,"default_branch":"master","last_synced_at":"2024-11-20T20:42:47.673Z","etag":null,"topics":["android","android-security","bruteforce","kali-linux","nethunter","security","security-tools","usb-hid"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/urbanadventurer.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2020-08-18T04:08:50.000Z","updated_at":"2024-11-20T11:08:05.000Z","dependencies_parsed_at":"2024-01-07T12:52:52.761Z","dependency_job_id":"6d4527bc-4799-4b49-9888-998908f49daf","html_url":"https://github.com/urbanadventurer/Android-PIN-Bruteforce","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/urbanadventurer%2FAndroid-PIN-Bruteforce","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/urbanadventurer%2FAndroid-PIN-Bruteforce/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/urbanadventurer%2FAndroid-PIN-Bruteforce/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/urbanadventurer%2FAndroid-PIN-Bruteforce/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/urbanadventurer","download_url":"https://codeload.github.com/urbanadventurer/Android-PIN-Bruteforce/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225772739,"owners_count":17521881,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["android","android-security","bruteforce","kali-linux","nethunter","security","security-tools","usb-hid"],"created_at":"2024-08-04T17:02:54.394Z","updated_at":"2024-11-21T17:30:45.318Z","avatar_url":"https://github.com/urbanadventurer.png","language":"Shell","funding_links":[],"categories":["Shell","Shell (473)","Mobile"],"sub_categories":["Android"],"readme":"# 🔓📱 Android-PIN-Bruteforce\n\nUnlock an Android phone (or device) by bruteforcing the lockscreen PIN.\n\nTurn your Kali Nethunter phone into a bruteforce PIN cracker for Android devices! \n\n## 📱 How it works\n\nIt uses a USB OTG cable to connect the locked phone to the Nethunter device. It emulates a keyboard, automatically tries PINs, and waits after trying too many wrong guesses.\n\n![How to Connect Phones](https://user-images.githubusercontent.com/101783/91640968-b7d46280-ea64-11ea-8340-94e3bacb706e.png)\n\n[Nethunter phone] \u003c--\u003e [USB cable] \u003c--\u003e [USB OTG adaptor] \u003c--\u003e [Locked Android phone]\n\nThe USB HID Gadget driver provides emulation of USB Human Interface Devices (HID). This enables an Android Nethunter device to emulate keyboard input to the locked phone. It's just like plugging a keyboard into the locked phone and pressing keys.\n\n⏱ This takes just over 16.6 hours with a Samsung S5 to try all possible 4 digit PINs, but with the optimised PIN list it should take you much less time.\n\n### You will need\n\n- A locked Android phone\n- A Nethunter phone (or any rooted Android with HID kernel support)\n- USB OTG (On The Go) cable/adapter (USB male Micro-B to female USB A), and a standard charging cable (USB male Micro-B to male A).\n- That's all!\n\n## 🌟 Benefits\n\n- Turn your NetHunter phone into an Android PIN cracking machine\n- Unlike other methods, you do not need ADB or USB debugging enabled on the locked phone\n- The locked Android phone does not need to be rooted\n- You don't need to buy special hardware, e.g. Rubber Ducky, Teensy, Cellebrite, XPIN Clip, etc.\n- You can easily modify the backoff time to crack other types of devices\n- It works!\n\n## ⭐ Features\n\n- Crack PINs of any length from 1 to 10 digits\n- Use config files to support different phones\n- Optimised PIN lists for 3,4,5, and 6 digit PINs\n- Bypasses phone pop-ups including the Low Power warning\n- Detects when the phone is unplugged or powered off, and waits while retrying every 5 seconds\n- Configurable delays of N seconds after every X PIN attempts\n- Log file\n\n## Installation\n\nTBC\n\n## Executing the script\n\nIf you installed the script to /sdcard/, you can execute it with the following command.\n\n```bash ./android-pin-bruteforce``` \n\nNote that Android mounts /sdcard with the noexec flag. You can verify this with ```mount```.\n\n\n## Usage\n\n```\n\nAndroid-PIN-Bruteforce (0.2) is used to unlock an Android phone (or device) by bruteforcing the lockscreen PIN.\n  Find more information at: https://github.com/urbanadventurer/Android-PIN-Bruteforce\n\nCommands:\n  crack                Begin cracking PINs\n  resume               Resume from a chosen PIN\n  rewind               Crack PINs in reverse from a chosen PIN\n  diag                 Display diagnostic information\n  version              Display version information and exit\n\nOptions:\n  -f, --from PIN       Resume from this PIN\n  -a, --attempts       Starting from NUM incorrect attempts\n  -m, --mask REGEX     Use a mask for known digits in the PIN\n  -t, --type TYPE      Select PIN or PATTERN cracking\n  -l, --length NUM     Crack PINs of NUM length\n  -c, --config FILE    Specify configuration file to load\n  -p, --pinlist FILE   Specify a custom PIN list\n  -d, --dry-run        Dry run for testing. Doesn't send any keys.\n  -v, --verbose        Output verbose logs\n\nUsage:\n  android-pin-bruteforce \u003ccommand\u003e [options]\n```\n\n\n## Supported Android Phones/Devices\n\nThis has been successfully tested with various phones including the Samsung S5, S7, Motorola G4 Plus and G5 Plus.\n\nIt can unlock Android versions 6.0.1 through to 10.0. The ability to perform a bruteforce attack doesn't depend on the Android version in use. It depends on how the device vendor developed their own lockscreen.\n\nCheck the Phone Database for more details\nhttps://github.com/urbanadventurer/Android-PIN-Bruteforce/wiki/Phone-Database\n\n## 🎳 PIN Lists\n\nOptimised PIN lists are used by default unless the user selects a custom PIN list.  \n\n### Cracking PINs of different lengths\n\nUse the `--length` commandline option.\n\nUse this command to crack a 3 digit PIN, \n`./android-pin-bruteforce crack --length 3`\n\nUse this command to crack a 6 digit PIN\n`./android-pin-bruteforce crack --length 6`\n\n### Where did the optimised PIN lists come from?\n\nThe optimised PIN lists were generated by extracting numeric passwords from database leaks then sorting by frequency. All PINs that did not appear in the password leaks were appended to the list. \n\nThe optimised PIN lists were generated from *Ga$$Pacc DB Leak* (21GB decompressed, 688M Accounts, 243 Databases, 138920 numeric passwords).\n\n#### The 4 digit PIN list\n\nThe reason that the 4 digit PIN list is used from a different source is because it gives better results than the generated list from *Ga$$Pacc DB Leak*.\n\n`optimised-pin-length-4.txt` is an optimised list of all possible 4 digit PINs, sorted by order of likelihood.\nIt can be found with the filename `pinlist.txt` at https://github.com/mandatoryprogrammer/droidbrute\n\nThis list is used with permission from Justin Engler \u0026 Paul Vines from Senior Security Engineer, iSEC Partners,\nand was used in their Defcon talk, [Electromechanical PIN Cracking with Robotic Reconfigurable Button Basher (and C3BO)](https://www.defcon.org/html/defcon-21/dc-21-speakers.html#Engler)\n\n### Cracking with Masks\n\nMasks use regular expressions with the standard grep extended format.\n\n`./android-pin-bruteforce crack --mask \"...[45]\" --dry-run`\n\n- To try all years from 1900 to 1999, use a mask of `19..`\n- To try PINs that have a 1 in the first digit, and a 1 in the last digit, use a mask of `1..1`\n- To try PINs that end in 4 or 5, use `...[45]`\n\n## 📱 Configuration for different phones\n\nDevice manufacturers create their own lock screens that are different to the default or stock Android. \nTo find out what keys your phone needs, plug a keyboard into the phone and try out different combinations.\n\nLoad a different configuration file, with the `--config FILE` commandline parameter.\n\nExample:\n`./android-pin-bruteforce --config ./config.samsung.s5 crack`\n\nYou can also edit the `config` file by customising the timing and keys sent.\n\nThe following configuration variables can be used to support a different phone's lockscreen.\n\n```\n# Timing\n## DELAY_BETWEEN_KEYS is the period of time in seconds to wait after each key is sent\nDELAY_BETWEEN_KEYS=0.25\n\n## The PROGRESSIVE_COOLDOWN_ARRAY variables act as multi-dimensional array to customise the progressive cooldown\n## PROGRESSIVE_ARRAY_ATTEMPT_COUNT__________ is the attempt number\n## PROGRESSIVE_ARRAY_ATTEMPTS_UNTIL_COOLDOWN is how many attempts to try before cooling down\n## PROGRESSIVE_ARRAY_COOLDOWN_IN_SECONDS____ is the cooldown in seconds\n\nPROGRESSIVE_ARRAY_ATTEMPT_COUNT__________=(1  11 41)\nPROGRESSIVE_ARRAY_ATTEMPTS_UNTIL_COOLDOWN=(5   1  1)\nPROGRESSIVE_ARRAY_COOLDOWN_IN_SECONDS____=(30 30 60)\n\n## SEND_KEYS_DISMISS_POPUPS_N_SECONDS_BEFORE_COOLDOWN_END defines how many seconds before the end of the cooldown period, keys will be sent\n# set to 0 to disable\nSEND_KEYS_DISMISS_POPUPS_N_SECONDS_BEFORE_COOLDOWN_END=5\n## SEND_KEYS_DISMISS_POPUPS_AT_COOLDOWN_END configures the keys that are sent to dismiss messages and popups before the end of the cooldown period\nSEND_KEYS_DISMISS_POPUPS_AT_COOLDOWN_END=\"enter enter enter\"\n\n## KEYS_BEFORE_EACH_PIN configures the keys that are sent to prompt the lock screen to appear. This is sent before each PIN.\n## By default it sends \"escape enter\", but some phones will respond to other keys.\n\n# Examples:\n# KEYS_BEFORE_EACH_PIN=\"ctrl_escape enter\"\n# KEYS_BEFORE_EACH_PIN=\"escape space\"\nKEYS_BEFORE_EACH_PIN=\"escape enter\"\n\n## KEYS_STAY_AWAKE_DURING_COOLDOWN the keys that are sent during the cooldown period to keep the phone awake\nKEYS_STAY_AWAKE_DURING_COOLDOWN=\"enter\"\n\n## SEND_KEYS_STAY_AWAKE_DURING_COOLDOWN_EVERY_N_SECONDS how often the keys are sent, in seconds\nSEND_KEYS_STAY_AWAKE_DURING_COOLDOWN_EVERY_N_SECONDS=5\n\n## DELAY_BEFORE_STARTING is the period of time in seconds to wait before the bruteforce begins\nDELAY_BEFORE_STARTING=2\n## KEYS_BEFORE_STARTING configures the keys that are sent before the bruteforce begins\nKEYS_BEFORE_STARTING=\"enter\"\n```\n\n### Popups\n\nWe send keys before the end of the cooldown period, or optionally during the cooldown period. This is to keep the lockscreen app active and to dismiss any popups about the number of incorrect PIN attempts or a low battery warning.\n\n## Test sending keys from the NetHunter phone\n\n### Test sending keys from the terminal\n\nUse ssh from your laptop to the NetHunter phone, and use this command to test sending keys:\n\nIn this example, the enter key is sent.\n\n`echo \"enter\" | /system/xbin/hid-keyboard /dev/hidg0 keyboard`\n\nIn this example, ctrl-escape is sent. \n\n`echo \"left-ctrl escape\" | /system/xbin/hid-keyboard /dev/hidg0 keyboard`\n\nNote: Sending combinations of keys in `config` file variables is different. Currently only `ctrl_escape` is supported.\n\nIn this example, keys a, b, c are sent.\n\n`echo a b c | /system/xbin/hid-keyboard /dev/hidg0 keyboard`\n\n### Test sending keys from an app\n\nThis Android app is a virtual USB Keyboard that you can use to test sending keys.\n\nhttps://store.nethunter.com/en/packages/remote.hid.keyboard.client/\n\n### How to send special keys\n\nUse this list for the following variables:\n\n- KEYS_BEFORE_EACH_PIN\n- KEYS_STAY_AWAKE_DURING_COOLDOWN\n- KEYS_BEFORE_STARTING\n\nTo send special keys use the following labels. \nThis list can be found in the hid_gadget_test source code.\n\n| Key label     | Key label     |\n| ------------- | ------------- |\n| left-ctrl     | f6            |\n| right-ctrl    | f7            |\n| left-shift    | f8            |\n| right-shift   | f9            |\n| left-alt      | f10           |\n| right-alt     | f11           |\n| left-meta     | f12           |\n| right-meta    | insert        |\n| return        | home          |\n| esc           | pageup        |\n| bckspc        | del           |\n| tab           | end           |\n| spacebar      | pagedown      |\n| caps-lock     | right         |\n| f1            | left          |\n| f2            | down          |\n| f3            | kp-enter      |\n| f4            | up            |\n| f5            | num-lock      |\n\nTo send more than one key at the same time, use the following list:\n\n- ctrl_escape (This sends left-ctrl and escape)\n\nIf you need more key combinations please open a new issue in the GitHub issues list.\n\n### Customising the Progressive Cooldown\n\nThe following section of the `config` file controls the progressive cooldown.\n\n```\n## The PROGRESSIVE_COOLDOWN_ARRAY variables act as multi-dimensional array to customise the progressive cooldown\n## PROGRESSIVE_ARRAY_ATTEMPT_COUNT__________ is the attempt number\n## PROGRESSIVE_ARRAY_ATTEMPTS_UNTIL_COOLDOWN is how many attempts to try before cooling down\n## PROGRESSIVE_ARRAY_COOLDOWN_IN_SECONDS____ is the cooldown in seconds\n\nPROGRESSIVE_ARRAY_ATTEMPT_COUNT__________=(1  11 41)\nPROGRESSIVE_ARRAY_ATTEMPTS_UNTIL_COOLDOWN=(5   1  1)\nPROGRESSIVE_ARRAY_COOLDOWN_IN_SECONDS____=(30 30 60)\n\n```\n\nThe array is the same as this table.\n\n| attempt number   | attempts until cooldown  | cooldown   |\n| ---------------- | ------------------------ | ---------- |\n| 1                | 5                        | 30         |\n| 11               | 1                        | 30         |\n| 41               | 1                        | 60         |\n\n\n### Why can't you use a laptop, or is a Windows or Linux version coming soon?\n\nThis script works by emulating USB Human Interface Devices (HID), in this case it is keyboard and mouse input. Laptops have uni-directional USB ports and an Android mobile device/ phone has a bi-directional USB port. A bi-directional port is required to emulate a keyboard.\n\nThis might change in the future as USB-C is supposed to be uni-directional.\n\n### How Android emulates a keyboard\n\nKeys are sent using `/system/xbin/hid-keyboard`. To test this and send the key 1 you can use `echo 1 | /system/xbin/hid-keyboard dev/hidg0 keyboard`\n\nIn Kali Nethunter, `/system/xbin/hid-keyboard` is a compiled copy of `hid_gadget_test.c`. This is a small program for testing the HID gadget driver that is included in the Linux Kernel. The source code for this file can be found at https://www.kernel.org/doc/html/latest/usb/gadget_hid.html and https://github.com/aagallag/hid_gadget_test.\n\n## 🔧 Troubleshooting\n\n### If it is not bruteforcing PINs\n\n#### Check the orientation of the cables\n\nThe Nethunter phone should have a regular USB cable attached, while the locked phone should have an OTG adaptor attached.\n\nThe OTG cable should be connected to the locked Android phone. The regular USB cable should be connected to the Nethunter phone.\n\nRefer to the graphic on how to connect the phones.\n\n#### Check it is emulating a keyboard\n\nYou can verify that the NetHunter phone is succesfully emulating a keyboard by connecting it to a computer using a regular charging/data USB cable. Open a text editor like Notepad while it is cracking and you should see it entering PIN numbers into the text editor.\n\nNote that you will not need an OTG cable for this. \n\n#### Try restarting the phones\n\nTry powering off the phones and even taking out the batteries if that is possible.\n\n#### Try new cables\n\nTry using new cables/adaptors as you may have a faulty cable/adaptor.\n\n### If it doesn't unlock the phone with a correct PIN\n\nYou might be sending keys too fast for the phone to process. Increase the DELAY_BETWEEN_KEYS variable in the config file.\n💡 If you don't see 4 dots come up on the phone's screen then maybe it is not receiving 4 keys.\n\n### 🔋 Managing Power Consumption\n\nIf your phone runs out of power too soon, follow these steps:\n\n- Make sure both phones are fully charged to 100% before you begin\n- Reduce the screen brightness on both the victim phone and NetHunter phone if possible\n- Place both phones into Airplane mode, however you may want to enable WiFi to access the NetHunter phone via SSH.\n- The locked phone will power the NetHunter phone, because it appears as a keyboard accessory\n- Use a USB OTG cable with a Y splitter for an external power supply, to allow charging of the NetHunter phone while cracking\n- Take breaks to charge your devices. Pause the script with CTRL-Z and resume with the `fg` shell command.\n- Avoid the SEND_KEYS_STAY_AWAKE_DURING_COOLDOWN_EVERY_N_SECONDS configuration option. This will cause the locked phone to use more battery to keep the screen powered. Instead use the SEND_KEYS_DISMISS_POPUPS_N_SECONDS_BEFORE_COOLDOWN_END option (Default).\n\n### Check the Diagnostics Report\n\nUse the command `diag` display diagnostic information.\n\n```bash ./android-pin-bruteforce diag```\n\nIf you receive this message when the USB cable is plugged in then try taking the battery out of the locked Android phone and power cycling it.\n\n```[FAIL] HID USB device not ready. Return code from /system/xbin/hid-keyboard was 5.```\n\n### How the usb-devices command works\n\nThe diagnostics command uses the `usb-devices` script but it is only necessary as part of determining whether the USB cables are incorrectly connected. This can be downloaded from\nhttps://github.com/gregkh/usbutils/blob/master/usb-devices\n\n### Use verbose output\n\nUse the `--verbose` option to check the configuration is as expected. This is especially useful when you are modifying the configuration.\n\n### Use the dry-run\n\nUse the `--dry-run` option to check how it operates without sending any keys to a device. This is especially useful when you are modifying the configuration or during development.\n\nDry run will:\n\n- Not send any keys\n- Will continue instead of aborting if the `KEYBOARD_DEVICE` or `HID_KEYBOARD` is missing.\n\n### HID USB Mode\n\nTry this command in a shell on the NetHunter phone:\n```/system/bin/setprop sys.usb.config hid```\n\n## 💣 Known Issues\n\n- This cannot detect when the correct PIN is guessed and the phone unlocks.\n- Your phones may run out of 🔋 battery before the correct PIN is found.\n- Don't trust phone configuration files from unknown sources without reviewing them first. The configuration files are shell scripts and could include malicious commands.\n\n## 🚀 Roadmap\n\n- [DONE] Works\n- [DONE] Detects USB HID failures\n- [DONE] Improve Usage and commandline options/config files\n- [DONE] Add bruteforce for n digit PINs\n- [DONE] Mask for known digits\n- [DONE] Crack PIN list in reverse (to find which recent PIN unlocked the device)\n- [DONE] Implement configurable lockscreen prompt\n- [DONE] Implement cooldown change after 10 attempts\n- [WORKING] Find/test more devices to bruteforce\n- Add progress bar\n- Add ETA\n- ASCII art\n- Nicer GUI for NetHunter\n- Implement for iPhone\n- Detect when a phone is unlocked (Use Nethunter camera as a sensor?)\n- Crack Android Patterns (try common patterns first)\n\n## 🙋 Contributing\n\nPull requests are welcome. For major changes, please open an issue first to discuss what you would like to change.\n\nPlease make sure to update tests as appropriate.\n\n## 😎 Authors and acknowledgment\n\nDeveloped by Andrew Horton (@urbanadventurer).\n\n👏 The following people have been very helpful:\n\n- Vlad Filatov (@v1adf): Testing many phones for the Wiki Phone Database \n\n\n### Motivation\n\nMy original motivation to develop this was to unlock a Samsung S5 Android phone. It had belonged to someone who had passed away, and their family needed access to the data on it. As I didn't have a USB Rubber Ducky or any other hardware handy, I tried using a variety of methods, and eventually realised I had to develop something new.\n\n### Credit\n\nThe optimised PIN list is from Justin Engler (@justinengler) \u0026 Paul Vines from Senior Security Engineer, iSEC Partners\nand was used in their Defcon talk, [Electromechanical PIN Cracking with Robotic Reconfigurable Button Basher (and C3BO).](https://www.defcon.org/html/defcon-21/dc-21-speakers.html#Engler).\n\n### Graphics\n\nDesigned by Andrew Horton and gratefully using these free vector packs:\n\n- [USB Ports Isometric Free Vector by VisionHeldup](https://www.vecteezy.com/vector-art/159576-usb-ports-isometric-free-vector)\n- [HDMI and USB Vector Set by Mary Winkler](https://www.vecteezy.com/vector-art/107006-hdmi-and-usb-vector-set)\n- [Isometric Data Security Illustration by Rizal.Medanguide](https://www.vecteezy.com/vector-art/661831-isometric-data-security-illustration)\n- Kali NetHunter Logo\n\n## 🗿 Comparison with other projects and methods to unlock a locked Android phone\n\n### What makes this project unique? \n\nI've been asked what makes this project unique when there are other open-source Android PIN cracking projects.\n\nAndroid-PIN-Bruteforce is unique because it cracks the PIN on Android phones from a NetHunter phone and it doesn't need the locked phone to be pre-hacked.\n\nIt works:\n- Without having to buy special hardware, such as a Rubber Ducky, Celebrite, or XPIN Clip.\n- Without ADB or root access (the phone doesn't have to be pre-hacked).\n\n| Project                                               | ADB/USB Debugging  | Requires root | Requires $ hardware | Commercial  |\n------------------------------------------------------- | ------------------ | ------------- | ------------------- | ----------- | \n| ⭐ Android-PIN-Bruteforce                             | No                 | No            | Nethunter phone     | No          | \n| github.com/PentesterES/AndroidPINCrack                | Yes                | Yes           | No                  | No          |\n| github.com/ByteRockstar1996/Cracking-Android-Pin-Lock | Yes                | Yes           | No                  | No          |\n| github.com/sch3m4/androidpatternlock                  | Yes                | Yes           | No                  | No          |\n| github.com/georgenicolaou/androidlockcracker          | Yes                | Yes           | No                  | No          |\n| github.com/MGF15/P-Decode                             | Yes                | Yes           | No                  | No          |\n| github.com/BitesFor/ABL                               | Yes                | Yes           | No                  | No          |\n| github.com/wuseman/WBRUTER                            | Yes                | No            | No                  | No          |\n| github.com/Gh005t/Android-BruteForce                  | Yes                | No            | No                  | No          |\n| github.com/mandatoryprogrammer/droidbrute             | No                 | No            | Rubber Ducky $      | No          |\n| github.com/hak5darren/USB-Rubber-Ducky                | No                 | No            | Rubber Ducky $      | Yes         |\n| github.com/bbrother/stm32f4androidbruteforce          | No                 | No            | STM32F4 dev board $ | No          |\n| hdb-team.com/product/hdbox/                           | No                 | No            | HDBOX  $$           | Yes         |\n| xpinclip.com                                          | No                 | No            | XPINClip  $$        | Yes         |\n| cellebrite.com/en/ufed/                               | No                 | No            | Cellebrite UFED $$$ | Yes         |\n\nSome of these projects/products are really awesome but they achieve a different goal to Android-PIN-Bruteforce.\n\nIf a project requires a gestures.key or password.key, I've listed it as requiring root.\nIf a project requires a custom bootloader, I've listed that as requiring both ADB and root.\nIf you would like your project listed in this table then please open a new issue.\nThere are links to each of these projects in the 📚 Related Projects \u0026 Futher Reading section.\n\n### 😭 Regular phone users\n\n- Try the top 20 PINs from the [DataGenetics PIN analysis](https://datagenetics.com/blog/september32012/index.html) that apparently unlocks 26.83% of phones.\n- Use an SMS lock-screen bypass app (requires app install before phone is locked)\n- Use Samsung Find My Mobile (requires you set it up before phone is locked)\n- Crash the Lock Screen UI (Android 5.0 and 5.1)\n- Use the Google Forgot pattern, Forgot PIN, or Forgot password (Android 4.4 KitKat and earlier)\n- Factory Reset (you lose all your data 😭)\n\n### 🤖 Users who have already replaced their Android ROM\n\nIf the phone has already been rooted, has USB debugging enabled, or has adb enabled.\n\n- Flash the `Pattern Password Disable` ZIP using a custom recovery (Requires TWRP, CMW, Xrec, etc.)\n- Delete `/data/system/gesture.key` or `password.key` (requires root and adb on locked device)\n- Crack `/data/system/gesture.key` and `password.key` (requires root and adb on locked device)\n- Update sqlite3 database `settings.db` (requires root and adb on locked device)\n\n### 🔬 Forensic Investigators\n\nThese methods can be expensive and are usually only used by specialised phone forensic investigators.\n\nIn order of difficulty and expense:\n\n- Taking advantage of USB debugging being enabled (Oxygen Forensic Suite)\n- Bruteforce with keyboard emulation (⭐ Android-PIN-Bruteforce, RubberDucky attack, XPIN Clip, HBbox)\n- JTAG (Interface with TAPs (Test Access Ports) on the device board)\n- In-System Programming (ISP) (Involves directly connecting to pins on flash memory chips on the device board)\n- Chip Off (Desolder and remove flash memory chips from the device)\n- Clock Glitching / Voltage Fault Injection (Hardware CPU timing attacks to bypass PIN restrictions)\n- Bootloader exploits (Zero-day exploits that attack the bootloader. GrayKey from Grayshift and Cellebrite)\n\nJTAG, ISP, and Chip Off techniques are less useful now because most devices are encrypted.\nI don't know of any practical attacks on phone PINs that use clock glitching, if you know of a product that uses this technique please let me know so I can include it.\n\n### 🕵 Security Professionals and Technical Phone Users\n\nUse the USB HID Keyboard Bruteforce with some dedicated hardware.\n\n- A RubberDucky and Darren Kitchen's Hak5 brute-force script\n- Write a script for a USB Teensy\n- Buy expensive forensic hardware\n- Or you can use Android-PIN-Bruteforce with your NetHunter phone!\n\nAttempts to use an otherwise awesome project Duck Hunter, to emulate a RubberDucky payload for Android PIN cracking did not work. It crashed the phone probably because of the payload length.\n\n## 📚 Related Projects \u0026 Futher Reading\n\n### USB HID Hardware without NetHunter\n\nhak5 12x17: Hack Any 4-digit Android PIN in 16 hours with a USB Rubber Ducky \nhttps://archive.org/details/hak5_12x17\n\nHak5: USB Rubber Ducky\nhttps://shop.hak5.org/products/usb-rubber-ducky-deluxe\n\nUSB-Rubber-Ducky Payloads\nhttps://github.com/hak5darren/USB-Rubber-Ducky/wiki/Payloads\n\nTeensy\nhttps://www.pjrc.com/teensy/\n\nBrute Forcing An Android Phone with a STM32F4Discovery Development Board\nhttps://github.com/bbrother/stm32f4androidbruteforce\nhttps://hackaday.com/2013/11/10/brute-forcing-an-android-phone/\n\nAutomated brute force attack against the Mac EFI PIN (Using a Teensy)\nhttps://orvtech.com/atacar-efi-pin-macbook-pro-en.html\nhttps://hackaday.io/project/2196-efi-bruteforcer\n\nDroidbrute: An Android PIN cracking USB rubber ducky payload made efficient with a statistically generated wordlist.\nhttps://github.com/mandatoryprogrammer/droidbrute\n\nDiscussion forum about the hak5 episode, and Android Brute Force 4-digit pin\nhttps://forums.hak5.org/topic/28165-payload-android-brute-force-4-digit-pin/\n\n### NetHunter HID keyboard attacks\n\nNetHunter HID Keyboard Attacks\nhttps://www.kali.org/docs/nethunter/nethunter-hid-attacks/\n\n### Linux Kernel HID support\n\nHuman Interface Devices (HID)\nhttps://www.kernel.org/doc/html/latest/hid/index.html#\n\nLinux USB HID gadget driver and hid-keyboard program\nhttps://www.kernel.org/doc/html/latest/usb/gadget_hid.html\nhttps://github.com/aagallag/hid_gadget_test\n\nThe usb-devices script\nhttps://github.com/gregkh/usbutils/blob/master/usb-devices\n\n### Cracking Android PIN and Pattern files\n\nAndroidPINCrack - bruteforce the Android Passcode given the hash and salt (requires root on the phone)\nhttps://github.com/PentesterES/AndroidPINCrack\n\nAndroid Pattern Lock Cracker - bruteforce the Android Pattern given an SHA1 hash (requires root on the phone)\nhttps://github.com/sch3m4/androidpatternlock\n\n### General Recovery Methods\n\n[Android][Guide]Hacking And Bypassing Android Password/Pattern/Face/PI\nhttps://forum.xda-developers.com/showthread.php?t=2620456\n\nAndroid BruteForce using ADB \u0026 Shell Scripting\nhttps://github.com/Gh005t/Android-BruteForce\n\n### Forensic Methods and Hardware\n\nPATCtech Digital Forensics: Getting Past the Android Passcode\nhttp://patc.com/online/a/Portals/965/Android%20Passcode.pdf\n\nXPIN Clip\nhttps://xpinclip.com/\n\nHDBox from HDB Team\nhttps://hdb-team.com/product/hdbox/\n\nCellebrite UFED\nhttps://www.cellebrite.com/en/ufed/\n\nGrayKey from Grayshift\nhttps://www.grayshift.com/graykey/\n\n### PIN Analysis\n\nElectromechanical PIN Cracking with Robotic Reconfigurable Button Basher (and C3BO)\nhttps://www.defcon.org/html/defcon-21/dc-21-speakers.html#Engler\n\nDataGenetics PIN analysis https://datagenetics.com/blog/september32012/index.html\n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Furbanadventurer%2FAndroid-PIN-Bruteforce","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Furbanadventurer%2FAndroid-PIN-Bruteforce","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Furbanadventurer%2FAndroid-PIN-Bruteforce/lists"}