Sharing Is Caring 😄

Search This Blog

intercom cors

on May 22, 2018

Get link
Facebook
X
Pinterest
Email
Other Apps

CORS POC Exploit

Extract SID

Get link
Facebook
X
Pinterest
Email
Other Apps

Comments

Facebook Bug Bounty:Getting other users IP Address.

Hey guys, This is my another finding on facebook that got fixed within 7days of initial report. I came across the bug when I requested a Copy Of my Facebook Data(DYI). Extracted Copy of My Facebook Data.Then I navigated to photo section and found out that it was showing UPLOAD IP ADDRESS.So,where's the bug? Actually the bug was in "SHARED ALBUM". When a user upload photo in the shared album the UPLOAD IP ADDRESS is disclosed along with the photo. So,How did I turned this bug to get other users IP address?Well it's too easy! :) Steps to reproduce: 1:Create a Shared Photo Album. 2:Add the victim. 3:Let the victim upload a photo in Shared Photo Album. 4;Once the victim uploaded photo in Shared Photo Album request for A Copy Of Your Facebook Data. 5:Once your Copy of Facebook Data is prepared Download it and Extract and Navigate to your Shared Photo Album . Now you'll see victim's IP Address along with his uploaded photo. :) This bug also co...

Facebook Bug Bounty:Toggling comment option of a post in a linked group as an analyst.

Page admins can link group on their page. In which Page admin gets Admin privilege, editor and moderator gets moderator privilege. And two other roles(Advertiser and Analyst) are read-only. But they were not validated properly. Having analyst role on a page it was possible to turn on/off commenting of a post in the linked group. The graphql request while turning off comment of a post was: https://graph.facebook.com/v2.12/graphql?variables={"0":{"client_mutation_id":"","PAGE ID":"","feedback_id":"<base64 encoded post ID>"}}&doc_id=1543355012409944&access_token=<PAGE ACCESS TOKEN> Response: { "data": { "feedback_disable_commenting": { "feedback": { "id": "ZmVlZGJhY2s6OTQ3NzA0ODEyMDY2MjUz", "legacy_api_post_id": "821695251333877_947704812066253", "can_viewer_comme...

Google Bug Bounty:Commenting on any user's behalf.

Hey peeps, Hope you all are doing well :) Today I'll be sharing one of my finding in Google Plus.As you guys already understood that this issue is about user impersonation vulnerability.Using this issue an attacker could've commented on any user's behalf.The attacker only needs is victims e-mail address.And I think when it comes about Google you don't have to worry about getting victim's e-mail address.There must be a way around for this.Or you can just enumerate e-mail addresses ^_^ .Whatever, First thing first actually I got the initial idea from this One by Zahid Ali .So, a grand thanks goes to Zahid :) Proof Of Concept: Well it's too easy. All you've to do is send a mail from victims e-mail(mail will be posted as a comment).Google Mail is vulnerable to e-mail spoofing so this made the attack easy.But How to spoof e-mail addresses? Well, There are plenty of e-mail spoofing website you'll find. However, I used smt2go to reproduce...

Powered by Blogger

intercom cors

CORS POC Exploit

Extract SID

Comments

Post a Comment