Cracking? Checkers? Combos?

[8]

New to this whole "cracking" scene. Not really sure how everything is supposed to work.

I've done some google/forum searches, not really finding the answers I'm looking for. What's the process?

What are combos? How do "checkers" work? I'd love some insight so I can better contribute and understand.

Thank you.

[28]

Combos or combolists are what a cracker references.
They will usually come in the format of username:password

The cracker reads it and knows that the first part before the colon is the username and the last part is the password. Then it will input it properly in the website. 

Crackers are tools that are used to actually do the bruteforcing. They normally come equipped with the ability to add a proxy list and the ability to add a captcha account just in case a captcha prevents the bot from continuing. Within the code, the cracker is able to load up the URL and input the combolist credentials. Some poorly coded ones have an unseen web browser component in the background that runs it and it finds the HTML element (username textbox, password textbox, etc) by HTML ID's or elements.

Checkers are sometimes built into crackers, sometimes they are not. They basically are used to check the hits that you get from the cracker and tell you more about it.

For example;

A Fitbit cracker will tell you that xxxx@gmail.com:passw0rd123 is a valid account.
A Fitbit checker can tell you that they have a Fitbit Alta synced up to their account and they last used their Fitbit on Dec 12, 2019 5:10pm.

[8]

So where do you get acccess to combos? I've obviously seen the lists on these forums, but how would I go about getting my own? Instead of recycling theirs.

And Crackers are basically the bots that automatically enter passwords to find out what works and what doesnt. Followed by checkers that give you information on that account.

[28]

So where do you get acccess to combos? I've obviously seen the lists on these forums, but how would I go about getting my own? Instead of recycling theirs.

And Crackers are basically the bots that automatically enter passwords to find out what works and what doesnt. Followed by checkers that give you information on that account.

Database dumps, etc. That would go more into web hacking/SQL injections/etc.
I'm not sure if the program is still relevant now, but before many people had used SQL dumper. You would use things called "dorks" (ex:, https://www.exploit-db.com/google-hacking-database)

Those were used to find possible vulnerabilities in the URL's that SQL dumper found. From there you would be able to go through the website and find the database that housed emails and passwords that went together. 

Nowadays, I'm not sure what they use to do this, but that's just what I remember. Of course this program would just generally give you already-known databases since most people found the same things. 

Another option that I know of that I do not recommend, is using a combolist generator. You would only need an email list which can be found publicly on like Pastebin or something too. And then the comoblist generator would generate well-known passwords such as qwerty123, abc123, etc and make it a combo.
Ex:

jim.jones@gmail.com:abc123
jim.jones@gmail.com:qwerty123

and so forth.

[8]

What software would you recommend I use? Any good free ones out there?

[28]

What software would you recommend I use? Any good free ones out there?

For which part? Making combolists or for cracking?
I don't have any recommendations for combolists because I don't know.
For cracking I would recommend getting SentryMBA (or a similar software that lets you crack multiple stores in one) since they have configs, etc you can find online for free or make your own.

[3.921]

So where do you get acccess to combos? I've obviously seen the lists on these forums, but how would I go about getting my own? Instead of recycling theirs.

And Crackers are basically the bots that automatically enter passwords to find out what works and what doesnt. Followed by checkers that give you information on that account.

https://www.youtube.com/watch?v=6mL2kjRdkko this explains credential stuffing.