White Hackers

TL;DR  Every website with "Connect Facebook account and log in with it" is vulnerable to account hijacking. Every website relying on signed_request (for example official JS SDK) is vulnerable to account takeover, as soon as an attacker finds a 302 redirect to other domain. I don't think these will be fixed, as I've heard from the Facebook team that it will break compatibility. I really wish they would fix it though as you can see below, I feel these are serious issues. I understand the business reasons why they might choose so, but from my perspective when you have to choose between security and compatibility, the former is the right bet. Let me quickly describe what these bugs are and how you can protect your websites. CSRF on facebook.com login to hijack your identity. It's higher level  Most-Common-OAuth-Vulnerability  (we attached Attacker's Social Account to Victim's Client Account) but here even Clients using "st...

Hi, I would like to share one of Critical Bug in facebook which leads to delete any photo from facebook without user interaction. At first,Facebook Team Could not able to recognize this bug.So I have sent them Video Proof of Concept & I have clearly Explained this bug with the help of demo accounts.So Facebook team has recognized my bug after sending Video POC.Interesting Part is,In that Video I have Exploited  Mark Zuckerberg's  Photo from his Photo Album & I did not remove his photo.Now it has been fixed fully & Facebook has rewarded me  12,500$(US Dollars)  for finding this Critical Bug.In 2013,This is second time I am going to receive bounty from facebook.Already Facebook has approved my 3 Open Redirectors which is eligible to get bounty of  1500$ .   Dismissal Response:   Bug Approval:   Bounty Details:   Before going into Bug Explanation, Just think a second about this ??? How do you feel if anybody removed your phot...

just to clarify there is no need for any installed apps on the victim's account, Even if the victim has never allowed any application in his Facebook account I could still get full permission on his account via Facebook Messenger app_id (This bug works on any browser), Also, It's important to mention that there is a special regex protection in Facebook Messenger app_id (app_id=220764691281998), I was able to bypass it.   Bug 1: Reported this bug at 6/03/2013, Facebook Security Team Fixed it immediately , Also reported more OAuth bugs at 26/02/2013, Facebook Security Team Fixed it very quickly Regarding Facebook OAuth Double URL Encoding (Firefox), Reported at 6/02/2013, Fixed it very quickly Details: So after the first OAuth Vulnerability discovery  http://www.nirgoldshlager.com/ 2013/02/how-i-hacked-facebook- oauth-to-get-full.html Facebook Security was trying to protect OAuth Token Hijacking attacks by using  Regex Protecti...