Evil App Steal Facebook Access Token

Facebook say about this users Responsible for this its not an issue for facebook so After 3 month i am disclose this may be now they make some change but its still work ....... so users not allow any app to access your data on facebook or dont login anywhere using Facebook may be this an Attacker and After steal your Facebook Access Token he Can Hack your facebook Account Easily....

[#] Title : Evil App Steal Facebook Access Token
[#] Status : Unfixed
[#] Severity : very High
[#] Works on : Any browser with any version
[#] Homepage : www.facebook.com
[#] Author : Jitendra Jaiswal
[#] Email : jeetjaiswal0@gmail.com

This Vulnerability is exploitable to all users who are use facebook apps and allow access of apps
an attacker can modify all app setting in url

Impact of Vulnerability:

An attackers can store user access token with 2 month no Expires

also token not expire if user log out from facebook

1. an attacker can see inbox , update status , upload a pic and all hidden info of user profile

2. The user may be redirected to an untrusted page that contains
malware which may then compromise the user's machine.

note : An attcker can eassly create app and make problems to users stolen users access token
facebook didn't stop that bcz when app developrs send app for review then they know about that

How it work....

say user to its a great app in facebook play and see

If any signed facebook user clicks above following link
they will be redirected into 0auth dailog pages.

if user new its show app want to access user info as like other app
but apps after that going to facebook app page https://apps.facebook.com/xyz

important part for store ( ** facebook use # for when token goes with site that not store in server function** )

but in my link its goes first to my site then goes to app page in that when its come to site its have token
with # as we know that # value never store in request_uri or query_string

i am use java script to change # into ? then its now store in txt file

with both server function request_uri or query_string

POC VIDEO :

Facebook Reply For This

Jitendra Jaiswal

Security Researcher/Ethical Hacker

Comments

Click-jacking or UI Redressing

Hi! Just want to share my finding, I have found Click-jacking or UI Redressing Vulnerability in on Google Map , enjoy ;-) This bug was reported to Google Security Team, fixed immediately. About Title: ClickJacking or UI Redressing on Google Map Business Risk: Normal Discovery Date: October 8, 2013 Author: Jitendra Jaiswal (me) Poc Details Impact On victim : 1. attacker change victim profile pic by useing his webcam and upload 2. update status acording to attacker Best, Jeet Jaiswal

Microsoft remotely deleted Tor-based 'Sefnit Botnet' from more than 2 Million Systems

In October 2013, Microsoft adopted a silent, offensive method to tackle infection due to a Tor-based botnet malware called ' Sefnit '. In an effort to takedown of the Sefnit botnet to protect windows users, Microsoft r emotely removes the older versions of installed Tor Browser software and infection from 2 Million systems, even without the knowledge of the system's owner. Last year in August, after Snowden revelations about the National Security Agency's ( NSA ) Spying programs, the Internet users were under fear of being spied. During the same time Tor Project leaders noticed almost 600% increase in the number of users over the anonymizing networks of Tor i.e. More than 600,000 users join Tor within few weeks. In September, researchers identified the major reason of increased Tor users i.e. A Tor-based botnet called ' Sefnit malware ', which was infecting millions of computers for click fraud and bitcoin ...

Use WhatsApp without using your Mobile Number

Use WhatsApp without using your Mobile Number Well today I will be showing you another easy trick that I think many people would be in search for. Well I will be showing you how you can easily install and use WhatsApp without actually entering your mobile number. Yes we won't be doing any mischievous activity but we are going to use some another number from the app that will activate your account and you can easily chat without actually disclosing your number. You need to install WhatsApp , well either you can do a fresh install or if you are already having WhatsApp installed then you need to remove your number or choose the change number option. (well if you install it indirectly then make sure unknown sources is option is ticked) Now your WhatsApp is installed we need to install another application called Text+ to get the verification number. Well you can also try using the Online SMS Verification sites that's provide free number's ...

Hacking Concepts

Search This Blog