Posts

Posted on

Sending ephemeral message – disposable message to any Facebook user

Facebook

Description:

Facebook Messenger Rooms have feature to share room link to other apps when room gets created and it was vulnerable to ephemeral ( disposable ) message, Using 3350161661730468 doc id & “sendMessage” fb api caller sends a room link to other user when we select “Messenger”, Its create an offline thread.,

If we change in “id” value to victim’s user id, “message” value to any text & change “offline_threading_id” to any random number then victim gets a message notification of message and thread popup window open at his end and shows message sent by attacker but if he refresh or goto “Show in Messenger” then message got disappeared.

Continue reading “Sending ephemeral message – disposable message to any Facebook user”
Posted on

Facebook iOS address bar spoofing

Whatsapp Copy 2 e1618729194930

There is an inconsistency in the way Facebook iOS Inbox which uses WebView component renders some web page redirections in a way that allows an attacker to perform address bar spoofing, resulting in an HTTPS URL being displayed with the content from some other web site., To demonstrate I have created javascript that automatically clicks on link for performing redirection to invalid port to make delay in response so browser is displaying content from attackers site without updating back to initiator page from non responsive.

Affected version:

App version: Facebook for iOS 291.0

Continue reading “Facebook iOS address bar spoofing”
Posted on

Facebook Page Admin Disclosure

Page Admin Disclosure when clicking join button in Page inbox of mobile version

Description:
Every facebook group has feature “Share this group” with option like how to share (share on your timeline, page, share in private message.
So using this feature in group while interacting as page if page share this group in private message then group link sent in page admins profile which is intended.
if interacting as page sent share group link using this feature to any page then that link goes to victims page’s inbox.
Now in web platform that shared link displayed as normal, but if we look page inbox in mobile version then we can see that there is “+” plus sign to join group.

Once victim page received link in page inbox sent by group admin and victim page opens inbox in mobile version and click on + plus sign then, group join request sent as page admin without his knowledge., because link received in page inbox.

Continue reading “Facebook Page Admin Disclosure”
Posted on

Bypass Samsung Knox protection to read files stored in a secure folder | Android

20201230 093332

Description: Samsung Knox is a defensive mobile security platform that is built into Samsung devices and enhances security in all directions through a combination of physical means and software systems, providing security protection from the hardware to the application layer.

I used the path and file structure to bypass Samsung Knox protection in an unauthorized manner to read the stored files in the secure folder, and received a Samsung $3750 reward.

Severity: High | SVE-2020-18025
Continue reading “Bypass Samsung Knox protection to read files stored in a secure folder | Android”
Posted on

Xiaomi Android : Harvest private/system files (Updated POC)

Whatsapp Copy 3

Yet another android vulnerability which I found on Xiaomi: giant mobile manufacturer company.

Summary: There inbuilt SMS is an application pre-installed on those devices. The application is built with feature which sync in to cloud using webview through application’s sandbox. 
This application can also be launched from the browser and have its WebView directed to load an arbitrary URL and allow access to local file system, read local resources and access network resources.

Continue reading “Xiaomi Android : Harvest private/system files (Updated POC)”
Posted on

FB & Messenger for iOS : Address Bar spoofing using data uri

fbspoofusingdatauri1 e1618730173670

Summary: Facebook & Messenger for iOS was vulnerable to Address Bar spoofing which was be reproduced by navigating from target domain to attackers domain.

Attackers domain was able to set location to data:text/html,<script>…</script> using location header, so it was executed in context while keeping target domain in url bar.

Continue reading “FB & Messenger for iOS : Address Bar spoofing using data uri”