How I hacked unverified Facebook accounts(hak-it.blogspot.com)
hak-it.blogspot.com
How I hacked unverified Facebook accounts
http://hak-it.blogspot.com/2014/05/how-i-hacked-your-unverified-facebook.html
9 comments
I love seeing posts like this that go into the blackhat but executed properly sort of things. The fact you exposed it, went through the bounty program, and shared the knowledge is great. It just continues to give insight into other firms as to how they can prevent such burning issues. Great post, thanks :)
Thanks for the appreciation mate!
Could you elaborate on the countermeasures taken? The takeaway seems to be: 1. rate limit the "verify you email" requests, and 2. have enough entropy for the activation codes.
Another possibility is also not to log the user in after successful activation (i.e., mark the email as active, but don't give access to the account), but I've never seen anyone behaving like this.
Moreover, sensitive operations, like changing settings or deleting the account, should be password-protected (so that, even if logged in, the attacker couldn't damage too much).
Anything else that I'm missing?
Another possibility is also not to log the user in after successful activation (i.e., mark the email as active, but don't give access to the account), but I've never seen anyone behaving like this.
Moreover, sensitive operations, like changing settings or deleting the account, should be password-protected (so that, even if logged in, the attacker couldn't damage too much).
Anything else that I'm missing?
Kindly refer to the comments in the post itself.
I really don't get this... Maybe I'm just not clever enough, but this is referring to verification of the email address, right?
I wonder how many users don't ever verify their email address though... Couldn't facebook instead just make you verify it? i.e. not allow / limit use of service until you've verified your email address?
I wonder how many users don't ever verify their email address though... Couldn't facebook instead just make you verify it? i.e. not allow / limit use of service until you've verified your email address?
Attempted to comment but it just clears the form without doing anything it seems (perhaps stuck in mod queue? If so, it's invisible).
What I wanted to ask is what info Facebook wants from you before paying out, besides your Paypal email address of course.
What I wanted to ask is what info Facebook wants from you before paying out, besides your Paypal email address of course.
You need to fill fw8ben form. (Your name, permanent address, etc. is in the form)
don't know but it must be bad coz everyone wants money these days
Is "wanting money" bad? Or the write up is bad? OR the humanity is bad? Please make yourself clearer!
you can replace your python code with:
$ seq -w -s "\n" 99999 > outfile.txt