Facebook Account Take Over

Hi all,

Here I’m going to explain about the Facebook bug which leads to Full Account Takeover.

Recently a similar bug was reported by Anand Prakash.

This is a simple vulnerability which compromise anyone’s facebook account easily without any  user interaction, it allowed me to get into any facebook account by changing their password and I  was able to view their messages, stored credit/debit cards, personal photos, etc. facebook took  more than 3 week to make a fix on this bug. And at last facebook decided to provide reward for

this bug.

Description:

When a user requesting password forgot option, he has an option to reset the password with  phone/email address on http://www.facebook.com/login/identify/ctx=recover&lwv=110,  facebook will send 6 digit pin in order to reset the password. www.facebook.com having rate limit I can’t brute the code there it will accept only 10-­12 codes.

Anand recently found beta.facebook.com and mbasic.beta.facebook.com are doesn’t contain rate limiting and facebook released fix, also got bounty too.

I was searching for some active subdomains of facebook and found

https://lookaside.facebook.com is vulnerable and doesn’t having rate limiting on the endpoint of  forgot password. I tried to take over my own account and was successful in setting a new  password.

When I reported the bug to facebook they rejected it by saying that they can’t reproduce the  issue. I provided several poc’s to prove that it is a valid bug.

After weeks of reporting they fixed the bug and provided a nice bounty by considering the impact  of this vulnerability.

POC Video


Facebook Reply with bounty reward :

received_1021837061185340

46 thoughts on “Facebook Account Take Over

  1. Awesome job…really you are a genius…
    Your thinking is of another level…
    Wish you all the success for the future…

  2. I see you don’t monetize your site, there is one cool method to earn extra income,
    it will work with your website perfectly, just search in google
    for; Komiknabi’s advices

  3. Hi there! This post could not be written any better!
    Reading through this post reminds me of my previous room mate!

    He consistently kept talking about this. I ‘ll forward this post to him.
    Fairly certain he will have a good read. Thank you for sharing!

  4. I’m no longer sure where you are getting your information, however great topic. I must spend some time learning more or understanding more. Thank you for magnificent information I was looking for this information for my mission.

  5. It’s appropriate time to make some plans for the future and it’s time to be happy. I have read this post and if I could I want to suggest you few interesting things or advice. Perhaps you could write next articles referring to this article. I want to read even more things about it!

  6. Hello there, just became alert to your blog through Google, and found that it’s truly informative. I am gonna watch out for brussels. I’ll appreciate if you continue this in future. Lots of people will be benefited from your writing. Cheers!

  7. Pingback: Google
  8. Reading your website is pure pleasure for me, it deserves
    to go viral, you need some initial traffic only. If you want to know
    how to get it search for: blackhatworren’s strategies

  9. Have you ever considered about adding a little bit more than just your articles? I mean, what you say is valuable and everything. However just imagine if you added some great pictures or video clips to give your posts more, “pop”! Your content is excellent but with pics and video clips, this blog could certainly be one of the very best in its niche. Good blog!

  10. I love your blog.. very nice colors & theme. Have you create
    this website yourself or would you hire someone to accomplish it to
    suit your needs? Plz reply as I’m seeking to design my very own blog
    and wish to know where u got this from. thanks

  11. Pingback: Google
  12. I?¦ve learn several just right stuff here. Definitely worth bookmarking for revisiting. I wonder how a lot effort you place to make one of these excellent informative website.

  13. This is very interesting, You are a very skilled
    blogger. I have joined your rss feed and look forward to seeking more of your excellent post.
    Also, I’ve shared your web site in my social networks!

  14. Pingback: kala jadu
  15. Pingback: Plastering

Comments are closed.