5 WAYS TO HACK FACEBOOK

5 WAYS TO HACK FACEBOOK

1. Hack any Facebook account with a mobile SMS

This vulnerability could allow a user to hack FB account easily in a fraction of seconds. All you need is an active mobile number. This flaw existed in confirm mobile number endpoint where users verify their mobile number.

The execution of this vulnerability is very simple. We should send a message in the following format.

FBOOK to 32665 (for the US)

You should receive a shortcode. Then, a request to the FB server with the target user ID, shortcode, and a few other parameters could do the magic.

Sample Request
Post /ajax/settings/mobile/confirm_phone.php
Host: www.facebook.com

profile_id=<target_user_id>&code=<short_code>&other_boring_parameters

That’s it. Sending this request to the Facebook server with any user cookies can hack the target account. Your mobile number will be attached to the target user’s FB account once you get a response from the FB server. Now you can initiate a password reset request using the mobile number and hack into the target account easily.

This vulnerability was found by Jack in 2013. FB security team patched the issue pretty quickly and rewarded him $20,000 USD as a part of their bounty program.

2. Hack any Facebook account using Brute Force Attack

This brute force vulnerability leads to a complete FB account takeover which was found by Anand in 2016. Facebook rewarded him $15,000 as a part of their bug bounty program.

This flaw was found on the reset password endpoint of Facebook. Whenever a user forgets his password, he/she can reset their password using this option by entering his/her phone number or email address.

A 6-digit code will be sent to the user to verify whether the request is made by the concerned person. The user can then reset their password by entering the 6-digit verification code.

One cannot try different combinations of the code more than 10 to 12 attempts since the FB server will block the account for password reset temporarily.

Anand found that mbasic.facebook.com and beta.facebook.com failed to perform the brute force validation thus allowing an attacker to try all the possibilities of the six-digit code.

Sample Request
Post /recover/as/code/
Host: mbasic.facebook.com

n=<6_digit_code>&other_boring_parameters

Trying all the possibilities (brute-forcing) of the six-digit parameter (n=123456) allows an attacker to set a new password for any FB user. This can be achieved by any brute force tool available online.

Facebook fixed this vulnerability by placing limits on the number of attempts one can execute on the reset code endpoint.

3. Hacking any Facebook account using Brute Force Attack – 2

Arun found the same brute force vulnerability in another subdomain (lookaside.facebook.com) of Facebook that had got him a $10,000 reward from Facebook in 2016.

Initially, they rejected the bug by saying that they are unable to reproduce it. The vulnerability was accepted only after a few weeks time and the patch was rolled out as soon as their security team was able to reproduce the issue.

And the sample request looks like this

Post /recover/as/code/
Host: lookaside.facebook.com

n=<6_digit_code>&other_boring_parameters

The attack scenario is exactly the same that we have seen in the previous method and the only difference is the domain name.

4. Hacking any Facebook account using a Cross Site Request Forgery Attack

This method requires the victim to visit a website link (in a browser where the victim should be logged into Facebook) to complete the hacking attack.

For those of you who don’t know about CSRF attacks, read about it here.

The flaw existed in claiming the email address endpoint of Facebook. When a user claims an email address, there was no server-side validation performed of which user is making the request thus it allows an email to be claimed on any FB account.

You need to get the email claim URL before creating a CSRF attack page. For that, try to change your email address to an email address that is already used for a FB account. Then you will be asked to claim the email if that belongs to you.

A popup with a claim button should redirect you to the URL we need once we click on the claim button.

URL should look like

{“fbid”:”&code=<code>

You have got the URL. The last thing we have to do is to create a page to put the URL in an iframe and send it to the victim.

The email address will be attached to the victim’s Facebook account once he/she navigates to the URL. That’s it. You can now hack the victim’s Facebook account through the reset password option.

This CSRF account takeover vulnerability was found by Dan Melamed in 2013 and was patched immediately by the FB security team.

5. Hack any Facebook account using CSRF – 2

This hacking technique is similar to the previous one where the victim needs to visit the attacker’s website for the attack to work.

This vulnerability was found in the contact importer endpoint. When a user approves Facebook to access Microsoft Outlook’s contact book, a request to the FB server is made that in turn adds the email to the respective Facebook account.

One can do this by Finding the contacts option in the attacker’s Facebook account. Then you should find the following request made to FB server (use intercepting proxy like a burp)

https://m.facebook.com/contact-importer/login?auth_token=

The same GET request can be used to perform the CSRF attack. All you have to do is to embed the URL in an iframe on the attack page and share the link with the victim.

A victim’s account can be hacked as soon as the victim visits the attack page.

This bug was found by Josip in 2013 and patched by the FB security team.

5 WAYS TO HACK FACEBOOK

That’s all on 5 WAYS TO HACK FACEBOOK

WE ARE HERE FOR SERIOUS BUSINESS, WE DO NOT TOLERATE TIME WASTERS
AND BEGGARS TRYING TO BEG OR SCAM US OF OUR PRODUCTS. 
Payment is Upfront, Our services are not free

Contact us for support. We sell fresh ATM Hacking, Paypal/Cashapp accounts & Transfers, Dumps with Pin, Western Union Transfers, ATM Skimmers, Bank logins, and lots more.

We have other services like bank transfers to any bank account. We have helped change the lives of people from different continents in South America and across Europe. We can Card anytime for you and ship for half the price, Carding iPhone, Botnet setup service, Carding Classes where you will learn everything that will help you make money

Get Sameday Money Transfer Service From Our Professional Hackers