Even if a password is guessed correctly, 2FA requires a second code from the user's phone — impossible for a brute force script to bypass.
Searching for these tools often leads to: brute force attack on facebook account install
Facebook requires strong passwords, making the possible combination space astronomically large. A modern 10-character password with mixed cases, numbers, and symbols would take billions of years to brute force. Even if a password is guessed correctly, 2FA