Most "proper" papers on this topic also focus on how Facebook mitigates these software-driven attacks: Maharashtra Cyber
When paired with "rules" (e.g., capitalize the first letter, add numbers 1-100 at the end), a dictionary attack can crack up to 60-70% of all user passwords within minutes. facebook dictionary attack software