My friend needs a ITIN number

He came over 3 years ago

He does not qualify for ssc (B2 visa)

He has a job but haven't report anything

He does not meet any of the exceptions and he has no tax return.

Only ID is passport

How can he get an ITIN?

Evidently, your friend is paid under the table.
He can file tax return and report all the income as self employed income. Attach W7 (ITIN application) with your tax return.