phwd
Instagram account takeover via React debug.keystore
HackerOne takes $25,000 from Belarusian hacker in response to sanctions
Essentially it's social engineering via a face scan app.
You can see an example of a possible scammer here https://www.instagram.com/sashana_walter/
"My friend is into crypto sh$t and he messaged me saying to check out his story (already weird but whatever) and he posted that this lady turned his $500 into $8500. It was a legit video of him speaking, walking down the street. Anyway I messaged the chick and she told me to download this app and I signed up and it made me scan my ID and my face which I thought was wack again but trusted my buddy… So i end up sending this chick $200 in bitcoin like a f%c^in idiot, but then shes trying to say I need to send another $300 to be able to actually ‘process’ and I was like uhhhh nope? Now ‘she’ is trying to get me to do some two factor authentication confirmation code shit to ‘get my payout’. What I think is going on is they got into my friends account and made a deepfake from the face scan and started DMing other people. "
Facebook SSRF
Coding Exercises Exposed at Facebookrecruiting.com
Bulletin.com Email Address Leak
Facebook’s /intern/testdata tool: default password n0t3st
Download Facebook internal mobile builds
The actual schema graphql?q=schema() (not the generated one) is in fact confidential. They definitely do not want their real schema public.
Leaked Credentials gives access to internalfb.com
Instagram Terms of Use (2018 vs. 2020)
Facebook Remote Code Execution via CDN ($80k Bounty)
Facebook DOM Based XSS Using PostMessage
$25K Instagram Almost XSS Filter Link
I Hacked Facebook Again Unauthenticated RCE on MobileIron MDM
graph-facebook-com/app/activities is an endpoint used by 3rd party developers working with Facebook SDKs to send app analytic data for insights.
https://developers.facebook.com/docs/marketing-api/app-event... http://www.facebook.com/analytics https://business.facebook.com/events_manager/app/events
This is what a URL can look like.
graph-facebook-com/1106907002683888/activities?method=POST&event=MOBILE_APP_INSTALL&anon_id=1&advertiser_tracking_enabled=1&application_tracking_enabled=1&custom_events=[{%22_eventName%22:%22fb_mobile_purchase%22,}]
If you click the above you'll litter my analytics feed for my app 1106907002683888 with junk data.
Just in case, someone was looking for the specific call talked about because I couldn't find it linked in Vice's article.
Subscribe to typing notifications for any Instagram user
HTTP Request Smuggling: How Did Tons of People Like Me on Tinder?
Why Do Many Russians Prefer VK to Facebook?
Hack any Instagram account ($30k Bug bounty)
There are other platforms out there (liveleak and worldstarhiphop for example) that it only takes a minute or less to reach extreme content. If Facebook really desired what the OP suggested, assumed by Roger McNamee to push ad revenue by engagement then that’s exactly the first video one would see when logging in Facebook. The first video I see is always some shallow inspirational video by an “influencer” or a Buzz feed video on cooking.
Dang, I’d rather at least the original title be used so that anyone reading the article can reach their own conclusion and then bring whatever fire and brimstone need be.
Denial of service in Facebook Fizz due to integer overflow (CVE-2019-3560)
Changing email address on Twitter for Android unsets “Protect your Tweets”
Facebook Business Takeover ($27,500 bounty)
View Facebook friends for any user
https://twitter.com/phwd/status/1045674238751969280 https://www.facebook.com/robots.tx/posts/1198980273583188