 |
| gurukrit singh facebook hack |
News Compressed : A Indian white hacker from califronia Gurukrit Singh revealed shows how easily he could’ve exploited Facebook’s password reset mechanism to hack numerous Facebook accounts. He do this by requesting 2 million valid facebook users password reset at short period by using their ID.
What he did
He said:
To send emails, you first need to get access to 2 million Facebook usernames. Web scraping time! Point 1: Facebook IDs are generally 15 digits long, so I started with 100,000,000,000,000 and started making queries to Facebook Graph API to check which IDs were valid. I was also able to get profile picture and full name on the user’s account with ease since it seems there is no rate-limiting on public data (I just did it for fun). But wait! Facebook Graph API only lets authorized apps to fetch a user’s username, doesn’t it? Yes it does. Yes it does.
All you have to do after making sure the ID is valid is visit the following link: www.facebook.com/[ID HERE] and the url automatically redirects and changes the ID to the user’s username. So I compiled all this data into a nice JSON, which I guess doesn’t hurt to publish since it’s all public anyway. Note: Some of the profile picture urls in the JSON are invalid. Link to the 2 million usernames: https://drive.google.com/open?id=0B8yZwAxAk9KZTjhvbTdYZVNoY2s
In order to avoid getting your IP blocked from repeatedly sending requests to send password reset emails, you need rotating IPs. This means that every email request will be sent from a batch of thousands of IP addresses to simulate a normal global network flow. There are several services online that offer this feature. In my case, all network traffic went through a proxy server that listened for HTTP requests and arbitrarily assigned an IP address to each request.
You need to simulate user behavior when requesting a passcode. So we will use PhantomJS (Headless browser) and write a multithreaded script in Java that requests a passcode to every user from our JSON file. I also scraped all User Agent strings for a Chrome browser from http://www.useragentstring.com/pages/useragentstring.php?name=Chrome to assign to my PhantomJS instance
Got a free trial of Google Compute Engine and hosted my scripts on a virtual machine. I set up 8 VMs (12 cores/20 GB RAM each) over different regions and instantiated 180 PhantomJS instances per VM for full CPU utilization. Then I let all my scripts do their thang4
Easier Part: Brute Force Guessed Passcode Against 2 million IDs.
I then guessed a 6 digit passcode 338625 using the aforementioned rule and brute forced all users at the following url by adding the ID to the key ‘u’ and my passcode to the key ‘n’: www.beta.facebook.com/recover/password?u=…&n…
For More go to hackernoon.com
Important: Please note that this article is only for educational purposes.