Re: [Full-disclosure] Facebook Url Redirection Vuln.

[Juan Carlos sec <winsec@xxxxxxxx>]

WTF??? !!!

From: Alex 
Sent: Thursday, July 11, 2013 4:33 PM
To: full-disclosure@xxxxxxxxxxxxxxxxx 
Subject: Re: [Full-disclosure] Facebook Url Redirection Vuln.

I checked your video and found out, that this mailinglist is also vulnerable. 
Check this out:

http://www.google.de/

If a user clicks on this link, he will be brought to the malicious site.



Am 2013-07-11 13:18, schrieb CANSIN YILDIRIM:

  ------------------------------------------------------------------------
  #Title: Facebook Url Redirection Vulnerability
  #Discovery Date: 10/July/2013
  #Author: Cansın Yıldırım
  #Twitter: @YildirimCansin
  #Website: www.cansinyildirim.com
  ------------------------------------------------------------------------

  Introduction:

  The vulnerability reported on 10th July however Facebook Security Team 
replied that it is an expected behavior. That is why I don't see any reason not 
to publish the vulnerability. More detailed background information can be found 
on their website: 
http://www.facebook.com/notes/facebook-security/link-shim-protecting-the-people-who-use-facebook-from-malicious-urls/10150492832835766

  Description:

  By obtaining user-specific hash value, an attacker redirect the user to a 
malicious website without asking for verification. The hash value can be found 
from the link that the user send to his/her wall. After clicking on user's 
link,by setting BurpSuite Proxy, the attacker intercept the parameters in the 
methods.

  Example url: 
http://www.facebook.com/l.php?u=http%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DSvWjWEyTLkg&h=3AQGbk0Cf&s=1

  However we don't need s parameter, for the attacker most important part of 
the url is the h parameter.

  Example h parameter = h=3AQGbk0Cf

  Now it is time to change the u parameter to a malicious site and send it to 
user with the same h parameter

  Example malicious url: 
http://www.facebook.com/l.php?u=cansinyildirim.com&h=3AQGbk0Cf

  Example malicious encoded url: 
http://www.facebook.com/l.php?u=%63%61%6e%73%69%6e%79%69%6c%64%69%72%69%6d%2e%63%6f%6d&h=3AQGbk0Cf

  After the victim clicks on the link, Facebook redirects the victim to a page 
specified by the attacker.

  Important note: I tried while the attacker and the victim are friends. 


  Proof of Concept:

  http://vimeo.com/70087250

  http://www.cansinyildirim.com/facebook-url-redirection-vulnerability-2013/


   




_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/




--------------------------------------------------------------------------------
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/