S01E01H02 - Password Cracking
Elliot wants to know everything about his therapist. So he cracks her accounts, not by exploiting a complex vulnerability but by profiling her. He pulls up Krista’s Facebook, scrapes personal details, and feeds them into a tool called elpscrk. The name is probably short for “Elliot’s Password Crack”, his own take on profiled password cracking, in the same vein as John the Ripper, the classic password cracker that’s been around since 1996.
elpscrk generates password candidates from what Elliot already knows about Krista: her favourite singer (Bob Dylan), her birth year (1972), common patterns, common separators. It cracks her password in seconds: Dylan_2791.
Favourite artist. Birth year reversed. Underscore in the middle!
TL;DR
| 🎬 Reel or Real? | ✅ real technique, fictional tool. elpscrk doesn’t exist, but CUPP and similar profilers do exactly this |
The Tool: elpscrk
elpscrk isn’t real. The creators wrote a fictional tool for the scene, a responsible choice that avoids handing viewers a ready-made tool to misuse. A custom script that takes personal details about a target and generates likely passwords from them.
After the show aired, someone built a working version: elpscrk on GitHub. It does exactly what the show depicts: takes names, dates, pet names, favourite bands, and spits out password combinations.
But elpscrk wasn’t the first. Tools that do this have been around for years:
- CUPP (Common User Passwords Profiler). The most well-known. Feed it personal details, it generates a targeted wordlist. Available in the Kali repositories (
apt install cupp). - Mentalist: GUI-based wordlist generator with rule chaining
This approach is called profiled dictionary attack: instead of trying every possible combination, you generate candidates based on what you know about the person.
Why It Works
People are predictable. Same patterns, over and over:
- Name + numbers:
krista1972,dylan123 - Favourite thing + year:
Dylan_2791,Beatles2001 - Pet name + birthday:
flipper0315 - Simple substitutions:
P@ssw0rd,Kr1st@
A profiled wordlist of a few thousand candidates built from someone’s social media can crack a personal account faster than a brute-force attack running millions of random combinations. It’s not about computing power. It’s about knowing your target.
Elliot didn’t need a supercomputer. He needed Krista’s Facebook.
What the Show Gets Right
Pretty much everything. The sequence is textbook:
- Reconnaissance: scrape the target’s public profiles for personal details
- Wordlist generation: feed those details into a profiler to generate candidates
- Credential testing: run the wordlist against the target’s login
The Verizon DBIR has for years ranked stolen credentials among the top ways attackers get in.
In the show, it takes seconds, which suits the pace of a pilot. In practice, how long it takes depends on where the guessing happens. A live login page pushes back. NIST SP 800-63B-4 requires services to disable a password after no more than 100 failed attempts in a row, and many add growing delays well before that point. An online attack only works if the right guess is near the top of the list, and that’s exactly what profiling is for. Against a stolen password hash there’s no lockout, and a single GPU running hashcat gets through a few thousand candidates almost instantly.
Even then, the password is only half of the login. If Krista had multi-factor authentication turned on, Elliot would also need her phone or security key.
Closing
Krista’s password was Dylan_2791. She probably thought it was secure. It has a mix of letters, numbers, an underscore, and it’s not a dictionary word. But it’s built from two pieces of information she shared publicly. That’s all Elliot needed.
elpscrk was made up for the show, but the method is real. If your password is built from things people can find out about you, someone with a profiler can guess it.
Next: S01E01H03 - DDoS