Skip to main content

Evil App Steal Facebook Access Token

By


Evil App Steal Facebook Access Token 




Facebook say about this users Responsible for this its not an issue for facebook so After 3 month i am disclose this may be now they make some change but its still work .......  so users not allow any app to access your data on facebook or dont login anywhere using Facebook may be this an Attacker and After steal your Facebook Access Token he Can Hack your facebook Account  Easily.... 


[#] Title           :  Evil App Steal Facebook Access Token 
[#] Status        :  Unfixed
[#] Severity     :  very High
[#] Works on  :  Any browser with any version
[#] Homepage  : www.facebook.com
[#] Author       :  Jitendra Jaiswal
[#] Email          :  jeetjaiswal0@gmail.com

This Vulnerability is exploitable to all users who are use facebook apps and allow access of apps
an attacker can modify all app setting in url

Impact of Vulnerability:

An attackers can store  user access token with 2 month no Expires

also token not expire if user log out from facebook

1. an attacker can see inbox , update status , upload a pic and all hidden info of user profile

2. The user may be redirected to an untrusted page that contains
malware which may then compromise the user's machine.

note : An attcker can eassly create app and make problems to users stolen users access token
facebook  didn't stop that bcz when app developrs send app for review then they know about that


How it work....

say user to its a great app in facebook play and see

If any signed facebook user clicks above  following link
they will be redirected into 0auth dailog pages.

if user new its show app want to access user info as like other app
but apps after that going to facebook app page https://apps.facebook.com/xyz


important part for store ( ** facebook use # for when token goes with site that not store in server function** )

but in my link its goes first to my site then goes to app page in that when its come to site its have token
with #  as we know that # value never store in request_uri or query_string

i am use java script to change # into ? then  its now store in txt file

 with both server function request_uri or query_string


POC VIDEO :

 




Facebook Reply For This 

Jitendra  Jaiswal

Security Researcher/Ethical Hacker

Labels:

Comments

Post a Comment

Popular posts from this blog

HC WeB : A Browser for HACKERS...

By
A Browser for HACKERS... Try for Free... Download HC WeB Setup Gallery: Online Penetration Testing Tools Index Information Gathering Whois DNS Location Info Enumeration and Fingerprint Data Mining Search Engines Editors Online Text Editors Share Text Snippets Network Utilities Ping HTTP HTTPS VNC Remote Desktop SSH DNS Sniffers Misc Forensics Frameworks URL Cloaking E-mail Password Cracking Encoders and Decoders Encoders Decoders Malwares Malware Analysis Identify Malicious Websites Suspected Malicious IPs and URLs Application Auditing SQL Injection Cross Site Scripting File Inclusion Anonymity Proxy Others Hackery Open Penetration Testing Bookmarks Collection Hacker Media Blogs, Forums, Magazines and Videos. Methodologies Penetration testing frameworks, standards and methodologies. OSINT Presentations, People, Organizations and Infrastructure.  Exploits an...
Post a Comment
Read more

Facebook Web Security Bug Bounty: Directory Traversal Vulnerability / RCE In Parse.com

By
http://parse.com   directory traversal vulnerability Little Insight: http://parse.com  was vulnerable to a directory traversal / RCE vulnerability. As a result, it was possible for an attacker to load web server-readable files from the local filesystem. or Run commend on That Well this is my 4th reward form facebook  Directory Traversal or RCE Vulnerability  That  give me 5th position in Facebook white-hat Page Report Date :23  July 2014 Reward For Directory Traversal or RCE Vulnerability :  20000$ How This work......? As we discussed earlier on my old post  Flowdock Directory Traversal Vulnerability exposed files outside of Rails’ view paths. '%5C' turns into '\' after decoding. Using Rack::Protection    it only rejects '/../' segments in the request path.   patch apply for Rack::Protection acording CVE-2014-0130  and  also Reject now '%5C' turns into '\' af...
Post a Comment
Read more

xss in Microsoft mobile domain

By
Cookies xss in Microsoft mobile domain also it have xframe open vulnerability for click jacking Domain: m.microsoft.com Poc url steps for reproduce issue are same in both url so I am send both url and steps by using one of them Poc urls : 1.          http://m.microsoft.com/showcase/en/US/Search.mspx?a=results&mid=3900&phrase=%5burl%3djavascript:alert(document.cookie)%5dClick%20here%20to%20see%20Result%5b/url%5d&Search = 2.        http://m.microsoft.com/showcase/en/US/search?pageindex=sv1:2&phrase=[url%3djavascript:alert%28document.cookie%29]click%20here%20and%20see%20your%20result[/url ] Vulnerable parameter: phrase= Steps for reproduce issue Poc url http://m.microsoft.com/showcase/en/US/search?pageindex=sv1:2&phrase=[url%3djavascript:alert%28document.cookie%29]click%20here%20and%20see%20your%20result[/url ] when users use url .That give a result in Microsoft site lik...
Post a Comment
Read more