Security Audit

Our Web Application Pentest ( WAP) attempts to address the Owasp top 10 & SANS top 20 web application vulnerabilities and other exploitable loopholes of your web application . Along with it our WAP team also test web applications for Business logic flaws that can directly or indirectly effect the functioning of application.

Trainings

We are here to help you solve your biggest query- where and how to start? CDI has brought various courses in Ethical Hacking in Chandigarh where all you technology lovers will be given the much needed push to move forward and create a niche for yourself in the field. From Beginner to Expert level we have many kinds of training patterns.

India Nigeria Partner With Us Latest Events Articles
91-771045-0011
Call Us : +91-771045-0011
91-771045-0011

Hack Facebook account with REST API; Ethical hacking done through mobile App

 Posted By: Ljsingh / Jul 10, 2014 / 

Hack Facebook account with third party token Hack Facebook account A critical vulnerability is found in REST API which allows you to hack Facebook account and exploit it. Stephan Sclafani a famous security researcher has found this bug and reported it to Facebook. The bug allows you to make calls, access private messages, view email address, update the status, post link to anyone's timeline. You can create photo albums, upload any photo, share it with different groups people and much more.

Hack Facebook account with REST API

An interesting research was made by Stephan on the famous social networking website Facebook. He made a proper penetration testing of the website with the help of Burp tool. Stephan wrote his full research on his website.

Also SEE: Hack Facebook account in 5 seconds, a big vulnerability found

Facebook REST API research

Stephan explored Facebook website with Burp tool to understand how Facebook is structured. When he was browsing through Facebook mobile site touch.facebook.com, he found something like this: Hack facebook account Hack facebook account The above request was about bookmarking the website. It was interesting to see that the request was making an API call instead of sending it to a dedicated endpoint. Also the request was being sent to nonstandard API endpoint instead of graph.facebook.com. Stephan reasearched more and found that the endpoint was Facebook's deprecated REST API. After this the researcher collected the documentation of Facebook REST API from a wayback machine. Also SEE: Facebook uses its users news feed in a secret experiment. REST API conists of methods which can be called by both desktop applications and web applications. Whenever an application wants to make a call, it makes a GET or POST request to the REST API end point like this hack facebook account 2 hack facebook account 2 This request contains users API key, session key and signature as a parameter. The signature is nothing but the applications secret data coded in MD5 format. Web application sends requests with their application secret login with API key at the time of signing in. From this you can get user ID and session id. The main question is still left that where to use this user key and API key.

How to hack Facebook account with User ID?

On a deep research, it was found that the endpoint was https://touch.facebook.com/api/ now this is a proxy. Stephan made a publishing call and updated the status on the account that he was logged in. Thus he was able to hack facebook account.

Must read

ethical hacking training in chandigarh Certified Ethical hacking Training Hack facebook account in just 5 minutes Hack facebook account in just 5 minutes

See more of Cyber Intelligence by logging in.
Connect with cyber security experts,Discover job opportunities,Online Training, Information Security Advisory and lot more.