4 ms·

He forgot to mention m.facebook.com . There have been many issues over the years with the mobile site that didn't exist on the main site. Examples: 1) You co

He forgot to mention m.facebook.com . There have been many issues over the years with the mobile site that didn't exist on the main site. Examples: 1) You could invite anyone to a Facebook event via their Facebook ID by simply doing an HTTP post of Facebook ID's to the event invitation script on this domain, but not on the main site. For some reason, on the mobile site they didn't implement the check to see if you were actually friends with the invitee. Since FB sends an email to each invitee, this was an enormous spamming loophole for quite a while. 2) For a long time, there was no frame-breaking script on m.facebook.com. You could clickjack essentially anything on Facebook this way. Years ago I did a proof-of-concept on this where I clickjacked a platform app authorization, which let me receive the name, email, and other profile info of any user that did nothing more than click the X button on an annoying overlay I put on the screen.

_RPM 10y ago
I always was sketched out by those "X"'s on any advertisement.
update 10y ago
> 2) For a long time, there was no frame-breaking script on m.facebook.com. You could clickjack essentially anything on Facebook this way. Years ago I did a proof-of-concept on this where I clickjacked a platform app authorization, which let me receive the name, email, and other profile info of any user that did nothing more than click the X button on an annoying overlay I put on the screen. Do you still have a copy of this? I'd like to see it
- downandout 10y ago
  Today it wouldn't work because they now have frame-breaking on m.Facebook.com. But if you'd like to see the general template you can email me at the email in my HN profile. Basically, you position the iframe element over something that will be clicked (such as an advertisement X button), set its z-index so that it is the topmost element, and set its opacity to 0. You can even test to see when the click has occurred by testing for when a certain element on your page has lost the focus.
  - update 10y ago
    > Today it wouldn't work because they now have frame-breaking Yeah. I just want to see what the original vulnerability looked like. I bug hunt. Thanks for the offer to email you, but, I'm transitioning away from E-Mail for security reasons.

_RPM 10y ago

I always was sketched out by those "X"'s on any advertisement.

update 10y ago

> 2) For a long time, there was no frame-breaking script on m.facebook.com. You could clickjack essentially anything on Facebook this way. Years ago I did a proof-of-concept on this where I clickjacked a platform app authorization, which let me receive the name, email, and other profile info of any user that did nothing more than click the X button on an annoying overlay I put on the screen. Do you still have a copy of this? I'd like to see it

downandout 10y ago
Today it wouldn't work because they now have frame-breaking on m.Facebook.com. But if you'd like to see the general template you can email me at the email in my HN profile. Basically, you position the iframe element over something that will be clicked (such as an advertisement X button), set its z-index so that it is the topmost element, and set its opacity to 0. You can even test to see when the click has occurred by testing for when a certain element on your page has lost the focus.
- update 10y ago
  > Today it wouldn't work because they now have frame-breaking Yeah. I just want to see what the original vulnerability looked like. I bug hunt. Thanks for the offer to email you, but, I'm transitioning away from E-Mail for security reasons.