Re: [Full-disclosure] Facebook Url Redirection Vuln.

[Alex <fd@xxxxxxxx>]

I checked your video and found out, that this mailinglist is also
vulnerable. Check this out: 

http://www.google.de/ [10] 

If a user clicks on this link, he will be brought to the malicious site.


Am 2013-07-11 13:18, schrieb CANSIN YILDIRIM: 

> ------------------------------------------------------------------------
> #Title: Facebook Url Redirection Vulnerability
> #Discovery Date: 10/July/2013
> #Author: Cansın Yıldırım
> #Twitter: @YildirimCansin
> #Website: www.cansinyildirim.com [3]
> ------------------------------------------------------------------------
> 
> Introduction:
> 
> The vulnerability reported on 10th July however Facebook Security Team 
> replied that it is an expected behavior. That is why I don't see any reason 
> not to publish the vulnerability. More detailed background information can be 
> found on their website: 
> http://www.facebook.com/notes/facebook-security/link-shim-protecting-the-people-who-use-facebook-from-malicious-urls/10150492832835766
>  [4]
> 
> Description:
> 
> By obtaining user-specific hash value, an attacker redirect the user to a 
> malicious website without asking for verification. The hash value can be 
> found from the link that the user send to his/her wall. After clicking on 
> user's link,by setting BurpSuite Proxy, the attacker intercept the parameters 
> in the methods.
> 
> Example url: 
> http://www.facebook.com/l.php?u=http%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DSvWjWEyTLkg&h=3AQGbk0Cf&s=1
>  [5]
> 
> However we don't need s parameter, for the attacker most important part of 
> the url is the h parameter.
> 
> Example h parameter = h=3AQGbk0Cf
> 
> Now it is time to change the u parameter to a malicious site and send it to 
> user with the same h parameter
> 
> Example malicious url: 
> http://www.facebook.com/l.php?u=cansinyildirim.com&h=3AQGbk0Cf [6]
> 
> Example malicious encoded url: 
> http://www.facebook.com/l.php?u=%63%61%6e%73%69%6e%79%69%6c%64%69%72%69%6d%2e%63%6f%6d&h=3AQGbk0Cf
>  [7]
> 
> After the victim clicks on the link, Facebook redirects the victim to a page 
> specified by the attacker.
> 
> Important note: I tried while the attacker and the victim are friends. 
> 
> Proof of Concept:
> 
> http://vimeo.com/70087250 [8]
> 
> http://www.cansinyildirim.com/facebook-url-redirection-vulnerability-2013/ [9]
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html [1]
> Hosted and sponsored by Secunia - http://secunia.com/ [2]



Links:
------
[1] http://lists.grok.org.uk/full-disclosure-charter.html
[2] http://secunia.com/
[3] http://www.cansinyildirim.com
[4]
http://www.facebook.com/notes/facebook-security/link-shim-protecting-the-people-who-use-facebook-from-malicious-urls/10150492832835766
[5]
http://www.facebook.com/l.php?u=http%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DSvWjWEyTLkg&h=3AQGbk0Cf&s=1
[6] http://www.facebook.com/l.php?u=cansinyildirim.com&h=3AQGbk0Cf
[7]
http://www.facebook.com/l.php?u=%63%61%6e%73%69%6e%79%69%6c%64%69%72%69%6d%2e%63%6f%6d&h=3AQGbk0Cf
[8] http://vimeo.com/70087250
[9]
http://www.cansinyildirim.com/facebook-url-redirection-vulnerability-2013/
[10] http://www.google.de/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/