I checked your video and found out, that this mailinglist is also vulnerable. Check this out:
http://www.google.de/ [10] If a user clicks on this link, he will be brought to the malicious site. Am 2013-07-11 13:18, schrieb CANSIN YILDIRIM: > ------------------------------------------------------------------------ > #Title: Facebook Url Redirection Vulnerability > #Discovery Date: 10/July/2013 > #Author: Cansın Yıldırım > #Twitter: @YildirimCansin > #Website: www.cansinyildirim.com [3] > ------------------------------------------------------------------------ > > Introduction: > > The vulnerability reported on 10th July however Facebook Security Team > replied that it is an expected behavior. That is why I don't see any reason > not to publish the vulnerability. More detailed background information can be > found on their website: > http://www.facebook.com/notes/facebook-security/link-shim-protecting-the-people-who-use-facebook-from-malicious-urls/10150492832835766 > [4] > > Description: > > By obtaining user-specific hash value, an attacker redirect the user to a > malicious website without asking for verification. The hash value can be > found from the link that the user send to his/her wall. After clicking on > user's link,by setting BurpSuite Proxy, the attacker intercept the parameters > in the methods. > > Example url: > http://www.facebook.com/l.php?u=http%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DSvWjWEyTLkg&h=3AQGbk0Cf&s=1 > [5] > > However we don't need s parameter, for the attacker most important part of > the url is the h parameter. > > Example h parameter = h=3AQGbk0Cf > > Now it is time to change the u parameter to a malicious site and send it to > user with the same h parameter > > Example malicious url: > http://www.facebook.com/l.php?u=cansinyildirim.com&h=3AQGbk0Cf [6] > > Example malicious encoded url: > http://www.facebook.com/l.php?u=%63%61%6e%73%69%6e%79%69%6c%64%69%72%69%6d%2e%63%6f%6d&h=3AQGbk0Cf > [7] > > After the victim clicks on the link, Facebook redirects the victim to a page > specified by the attacker. > > Important note: I tried while the attacker and the victim are friends. > > Proof of Concept: > > http://vimeo.com/70087250 [8] > > http://www.cansinyildirim.com/facebook-url-redirection-vulnerability-2013/ [9] > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html [1] > Hosted and sponsored by Secunia - http://secunia.com/ [2] Links: ------ [1] http://lists.grok.org.uk/full-disclosure-charter.html [2] http://secunia.com/ [3] http://www.cansinyildirim.com [4] http://www.facebook.com/notes/facebook-security/link-shim-protecting-the-people-who-use-facebook-from-malicious-urls/10150492832835766 [5] http://www.facebook.com/l.php?u=http%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DSvWjWEyTLkg&h=3AQGbk0Cf&s=1 [6] http://www.facebook.com/l.php?u=cansinyildirim.com&h=3AQGbk0Cf [7] http://www.facebook.com/l.php?u=%63%61%6e%73%69%6e%79%69%6c%64%69%72%69%6d%2e%63%6f%6d&h=3AQGbk0Cf [8] http://vimeo.com/70087250 [9] http://www.cansinyildirim.com/facebook-url-redirection-vulnerability-2013/ [10] http://www.google.de/
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
