Bug in Facebook OAuth. Convert facebook test account to real account in instagram/ oculus

-
Facebook Provide you the ability to create test accounts for white hat testing. You can create it by visiting the url facebook.com/whitehat/accounts.

Facebook wants you to test for security issues using test accounts only and if you're unable to reproduce an issue with a test account, then it is okay to use a real account you own or you have to get permission from the account owner. Adding Facebook implemented certain limitations for the test accounts.

I stuck with the last one. Can't convert to a real user account. Ok let's try it.

I tried for about a day in different ways like using the fake email at account recovery system and so on but failed.

I was like


And then I thought that I might find a way abusing facebook oauth system with test accounts. Navigated to few sites which allows login with facebook.

But when I tried login with facebook, It shows an error. Oops!! again screwed.

Then I decided to stop there and went to bed because it was 3 AM at night. In the next day, I woke up at 12 (regular time), I thought that I already wasted a day for this PoS, now give it a last shot.

I chose Instagram (Facebook's acquisition) and tried to create an account via my linked facebook account. And Boom!!! Done. Completed successfully.

I completed the steps and tried to visit some profiles. Yes I can view other accounts, follow them and do everything. I created a real account in instagram using facebook test account.

I was like

Tried with other facebook acquisition and found the same issue in oculus. But there's no way to interact with other users. And rest of the sites are safe from this.

Since the issue is in different endpoints, Created two reports one for instagram and the other one for oculus.

Impact on Oculus : NIL.

Impact on Instagram : Low Impact. Facebook allows creation of any number of test accounts. So People can increase their followers on instagram by- fooling the system. Once authenticated, the account data will be stored on instagram's db and hence it won't affect even if we delete the test account on facebook.

But facebook replied that


Here's the PoC video (for Instagram)


Liked this post? Buy me a coffeeBuy me a coffee

Comments

Post a Comment

Popular posts from this blog

Taking over Facebook Page Tabs

-
Image
In this post, I'm describing how I was able to take over 4 tabs on Facebook's own Pages. 1. Facebook India Ambassadors I was browsing Facebook as usual and not in a mood to test anything. I then visited Facebook India's page to check is there any update from Facebook India and that's when I noticed a page tab Facebook India Ambassadors . I clicked on it to see Facebook India's Brand Ambassadors and the tab showed a heroku error page. I was surprised to see that there. It looked interesting to me so I decided to dig further. I found out that it loads a third party website in an iframe in main section. The url was  http://immense-atoll-4159.herokuapp.com/  and I visited the url directly to verify that the subdomain doesn't exist. Heroku shows a does not exist error page if the subdomain doesn't exist. So I logged into my Heroku account and created a new project and give immense-atoll-4159  as project id. Then I created a simple NodeJS Script for...
Read more

Send request to Martians. Earthlings are already your friends.

-
Image
Hello everyone, I'm back with another write up. This time it's a Google bug. YouTube is Google's video sharing site and a great place to explore. As a bug hunter, you can spend hours or days or even weeks in YouTube without hesitation. I always used YouTube to play some music when I worked as a developer last year. When I started bug hunting, I tried YouTube multiple times and can't find any. Then I started hunting on another google services. After hunting for more than 2 hours, I found a bug on one of Google's acquisition. According to  Google , a video PoC is required only if it is contributing something that the text can't. But I'm a great fan of videos and my first bug to google (duplicate) contained a 15min video 😎. I recorded a video of that bug I found and visited YouTube to upload it. when I clicked upload button, I noticed something strange aside it, something new. It looked like a message button. But then, the upload page has loaded ...
Read more

Hands On training | Google XSS Game

-
Image
Hello everyone, In a previous post, I talked about XSS aka Cross Site Scripting. Hope you all got a basic knowledge now. In this post, I am giving you more information on XSS with a hands on training on the Google XSS Game. You can find a video on how to solve this at the bottom of the page. At first, Google XSS Game is a training platform provided by google to practice XSS. It consist of 6 levels and in each level, you have to execute a JavaScript alert in order to advance to next level. In each level, you'll be provided with different problems and you've to execute the alert using different techniques in each level. This will help you to understand various methods than can be used to execute XSS in a web page. There are hundreds of such websites available which allow you to practice various types of vulnerabilities. So let's get started. Navigate to  https://xss-game.appspot.com . This is where the Google XSS Game is available. You'll see a page lik...
Read more