This post will demonstrate a simple bug which will lead to a full takeover of any Facebook account, with no user interaction. Enjoy.

Facebook gives you the option of linking your mobile number with your account. This allows you to receive updates via SMS, and also means you can login using the number rather than your email address.

The flaw lies in the /ajax/settings/mobile/confirm_phone.php end-point. This takes various parameters, but the two main are code, which is the verification code received via your mobile, andprofile_id, which is the account to link the number to.

ĐỌC TIẾP »

HIJACKING A FACEBOOK ACCOUNT WITH SMS

Uploaded by: MIN Software

Views:

Category: Exploit, FaceBook, Hijacking, IT News

Share

Tweet