Facebook Awarded A Penetration Tester $10,000 For Account Takeover Bug

There was a post which i wrote earlier before about Manjesh S a bug hunter finds a way to hack into any Instagram users account through Facebook, A Penetration Tester name Arun Sureshkumar from India also finds an account takeover in one of Facebook Subdomain.

Also Read: A CSRF Bug In Paypal Developer Platform Reported By Homam Alhassan

As you know it's an account takeover which can allows him to view Facebook Users Messages, Stored Credits Card and also their Personal Photos/Notes and so on. Arun said Facebook took more than 3 weeks in other to fix this bug but before it was decline as not valid but by sending them different types of Proof Of Concept then they were able to confirm the bug and reward him for finding the Bug.

Description About The Facebook Bug


Similar to one of the bug found by Anand Prakash a Penetration Tester who was awarded $50,000 by Facebook, The Bug Anand Prakash found was in beta.facebook.coom and mbasic.beta.facebook.com , But Arun said when he tried forgot Password reset link through http://www.facebook.com/login/identify/ctx=recover&lwv=110 as you know 6 Digit Pin will be sent to the user Phone Number/Email address and www.facebook.com has a rate limit of the 6 Digit Pin which is 10-12 Codes as the maximum.

Then what he did was trying to search for active facebook subdomains and he found https://lookaside.facebook.com which doesn't have rate limits, He successfully takeover his own accounts and reported this to Facebook. After about 3 weeks before they were able to reproduce this bug and he was awarded $10,000 for it.

facebook award $10000

Video POC Of Account Takeover By Arun Sureshkumar


No comments

Powered by Blogger.