Facebook OAuth Vulnerability

If anyone can Remember the last OAuth Flaw in Facebook that allows attacker to hijack any account without victim's interaction with any Facebook Application, was reported by white hat Hacker 'Nir Goldshlager'. After that Facebook security team fixed that issue using some minor changes. Now Yesterday Goldshlager once again pwn Facebook OAuth mechanism by bypassing all those minor changes done by Facebook Team. He explains the complete Saga of hunting Facebook bug in a blog post. So please must see.

What is OAuth Vulnerability?

Well OAuth URL contains two parameters i.e. redirect_uri & next, and using Regex Protection (%23xxx!,%23/xxx,/) Facebook team tried to secure that after last patch.

Actually He uses facebook.com/l.php file (used by Facebook to redirect users to external links) to redirect victims to his malicious Facebook application and then to his own server for storing token values, where tokens are the alternate access to any Facebook account without password.

But a warning message while redirecting ruin the show ! No worries, he found that 5 bytes of data in redirection URL is able to bypass this warning message.

Example:  https://www.facebook.com/l/goldy;touch.facebook.com/apps/sdfsdsdsgs (where 'goldy' is the 5 byte of data used).

Now at the last step, He Redirect the victim to external websites located in files.nirgoldshlager.com (attacker server) via malicious Facebook app created by him and victim's access_token will be logged there also. So here we have the final POC that can hack any Facebook account by exploiting another Facebook OAuth bug and many more.

For Browsers:
https://www.facebook.com/connect/uiserver.php?app_id=220764691281998&next=https://facebook.facebook.com/%23/x/%23/l/ggggg%3btouch.facebook.com/apps/sdfsdsdsgs%23&display=page&fbconnect=1&method=permissions.request&response_type=token

Latest News: This bug was also reported to Facebook Security Team last week by Nir Goldshlager and has fixed now. Thanks!

Know What is Doxing and How to do it?

Well Doxing is an art of retrieving and hacking other people’s information such as names, addresses, phone numbers and credit card details etc. It may be targeted toward a specific person or an organization also. in layman’s terms, Doxing is the process of searching around on the Internet for someone’s personal details and that’s it!

…………The term “Doxing” derives from “document tracing” which means to gather documents on a particular person or company to learn more about them. According to me, Doxing is more like social engineering – gathering information on someone using publicly available sources.

If you seriously want to do Doxing, I think Social networking website is the best, safe and fastest way to find the user details as many users provide their information there. After finding some details such as date of births, mobile No, birth place, school and college name, you can apply social engineering tricks to break the password. Keep Note- Most of the people use their mobile numbers and date of births as a Password.

The another way to find the user details is Google, Yes you can also find some personal details on Google by searching the emails/names on Google etc.

All Done! Have a Nice Day and don’t forgot to share this information.

How To Bypass Sharecash Survey 2013

Hi Friends after a long time I am posting again on Bypassing Sharecash Survey in 2013. Last month Lots of People sending emails to me regarding this issue, that’s why today I'm going to tell you one more trick for completing or unlocking sharecash.org Surveys very fastly and easily. Here I am using Hotspot Shield trick. So lets know and try this method below. Enjoy!

Unlock sharecash.org survey : Bypass ShareCash Surveys

1. Sharecash gives surveys that require phone verification if you are not from the USA. We will need a VPN to change our IP to get a US IP easily. We will be using a free VPN called Hotspot Shield. Note - If you are from the US, skip this step.

2. Now download Hotspot Shield at here. Make sure to click the box that says "Fix Page Not Found Errors" as this error may come up a lot.

3. Hence install it and run Hotspot Shield to press the connect button.

4. Here Wait for it to say "State: Connected". After it has been connected, go to any site and this should appear.

5. Then enter sharecash link in your browser like Chrome, FireFox etc and choose a survey. The easiest way to unlock it is when they show food related surveys like "which on is better coke or pepsi" or something like that.

6. After clicking it, go to the site fakenamegenerator and click on "Generate" button (make sure you've selected USA as your country").

7. Now go back to the Survey you chose, and fill-up the information that you've generated on Step 5 After that click on "Submit" button.

8. All Done! Just go back to the download page and let it Refresh more than 2 times and the survey will unlock. If it doesn't, just try one more time.

That’s it! Peace and Blessings…Comments are Welcomed below.

What is the difference between WEP and WAP Encryption?

In this world, some people (usually hackers) are still confused between WEP and WAP type of Encryption that's why today I am going to write an detailed post on it later below. WEP stands for Wired Equivalent Privacy and WAP stands for Wireless Application Protocol mainly. Both are the security encryption used by the browsers. So lets differentiate them below.

How to Bypass Safety Mode in YouTube to See Videos?

Are you Getting problems in watching YouTube Videos that requires Safety Mode feature, If You then you are the right place as Today I am going to tell you How to Bypass Safety Mode in YouTube to See as many videos you want without signing in to your Gmail account and confirming age etc. In this, we are not going to off/Disable Safety Mode, hence it’s just a trick to overcome it. Please have a look below and Share.

How to Monitor a Computer With a Keylogger?

If you're familiar with keyloggers you'll know that the term comes from a time when logging keystrokes was the only function that was necessary. Keyloggers were first developed in the days of Microsoft DOS, but as computers have improved and evolved, the keylogger software has had to improve and evolve with them. As more and more features were added to the development of these types of programs the term keylogger was replaced with the more descriptive name, Computer Monitoring Software.

Top 20 Methods on How to Hack Facebook Password in 2013

Hey Friends How are you? I hope all you are fine and today I am going to tell you How to Hack a Facebook account password in 2013. Facebook as you all knows one of the best social networking site ever and a favorite place of hackers now a days. According to me, Hacking Facebook is not so hard but logical. In this post, I have mentioned my best 20 ways on How to hack Facebook account very easily. So please have a look and Enjoy…

Malware is Everywhere- Security Awareness Infographic

Malware is all around the whole and now a days spreading very fastly. Its a series problem for organizations and individuals alike. I have already discussed What is a Malware and its types, simple tips to avoid it and DNS changer Malware and now its time for a Infographic picture just below. Just Have a look, enjoy and feel free to share it!!!

Download Windows 8 Pro 9200 Activator 2013

Are you in search for Windows 8 Pro build 9200 Activator, then you are at the right place. Rumors are going on about Latest Windows 8 technology and looks. All people wants to upgrade their PC with Windows 8 but the problem is that How to get it free. Therefore today I am here to give you an activator named as KMS Activator. This will automatically activates your windows by taking some time and works in background. Note- Please keep off your antivirus while installing it and run as administrator. So lets get it now and Enjoy!!!

Also see- Windows 7 Activator Free Download- 100% Working

Latest Tata Docomo 3G Hack 2013 with 2G Data plan into 3G

Back again with Latest Tata Docomo 3g Hack 2013 with 1 MBPS high speed downloading!!! This mentioned trick worked on the basis of converting your 2G data into 3G data plan. Works for both Dongle and Mobile SIM. Before using it, please note that this trick/hack only works in some states as given below. Have a look.