Claiming any email id in Facebook Business Manager

-
In this post, I am going to share with you how I was able to claim any email address in facebook business manager including admin@facebook.com. Weird.. isn't it? Yes. But according to facebook team, this is an intentional behavior. Again Weird... Lol!!!
Ok let's come to the point. It happened about 6 months ago. While I was testing for bugs in facebook. I decided to take Facebook Business Manager as that day's target. 

 If you don't know what Facebook Business Manager is, "Facebook Business Manager is a service offered by facebook 

Comments

  1. mattspencerblogMarch 16, 2023 at 5:24 AM

    Thanks for sharing the best information and suggestions, I love your content, and they are very nice and very useful to us. If you are looking for the best facebook business manager, then visit Aweosmesuite Inc. I appreciate the work you have put into this.

    ReplyDelete
  2. awesomesuiteMarch 19, 2023 at 11:02 PM

    This blog is really helpful to deliver updated affairs over internet which is really appraisable.
    mou contract

    ReplyDelete

Post a Comment

Popular posts from this blog

Send request to Martians. Earthlings are already your friends.

-
Image
Hello everyone, I'm back with another write up. This time it's a Google bug. YouTube is Google's video sharing site and a great place to explore. As a bug hunter, you can spend hours or days or even weeks in YouTube without hesitation. I always used YouTube to play some music when I worked as a developer last year. When I started bug hunting, I tried YouTube multiple times and can't find any. Then I started hunting on another google services. After hunting for more than 2 hours, I found a bug on one of Google's acquisition. According to  Google , a video PoC is required only if it is contributing something that the text can't. But I'm a great fan of videos and my first bug to google (duplicate) contained a 15min video 😎. I recorded a video of that bug I found and visited YouTube to upload it. when I clicked upload button, I noticed something strange aside it, something new. It looked like a message button. But then, the upload page has loaded
Read more

How I could've accessed personal details of tens of thousands of people

-
Image
This is a security issue I found in one of the company that work in different fields. They make different type of electronic equipments as well as offers the public an easy way to enroll and avail benefits of different Govt Schemes. Let's say the company name is XYZ and the domain is xyz.com. They provide people a way to enroll to various govt services with their service centres, like a govt agency and public can register/ apply for any kind of govt services, schemes, etc. They're also an authorized service provider of a Govt Scheme by a state govt. I was checking the functionalities in their website and noticed a login url under  /admin . I visited /admin/login.php  and saw a Login page. I tried 5-10 different user:pass combinations and none of them worked. I then decided to try sqli in the login form. Like most of the PHP sites created by noooobs, this site is also vulnerable to sqli in login form. I got access to the admin panel, I saw scanned copies of ID c
Read more

Awww!!! It's *Public* Service Commission.....

-
Image
In this post, I'd like to talk about multiple issues I found on a website owned by Kerala Public Service Commission . The issues here are otp bypass to achieve IDOR. For those who don't know what's IDOR, quoting from OWASP " Insecure Direct Object References occur when an application provides direct access to objects based on user-supplied input. As a result of this vulnerability attackers can bypass authorization and access resources in the system directly ". The site url is `https://mailer.psc.kerala.gov.in/KPSCAptitudeTest/home`, which is a temporary site they've opened for the Aptitude Exam for engineering students. How the site works Students can register for the aptitude exam by providing following details :  College ID card number,  Mobile Number, Email, Name, Address, College Name, Desired Center Name and the photographs of themself, signature and id card. Question : This is for engineering students. What I'm doing there?
Read more