A couple weeks ago I had my last day on Facebook’s Product Security team. A bittersweet moment, but one which marks a “new chapter” in my life… I’ve spent just over 4 years working on “the other side” of bug bounties, but it’s also been 4 years since I last blogged, so I wanted to share some of my learnings as to how it was going from hacking on programs to being a security engineer. I also wanted…
This is pretty similar to Wes’s awesome OAuth CSRF in Live , except it’s in the main Microsoft authentication system rather than the OAuth approval prompt. Microsoft, being a huge company, have various services spread across multiple domains ( *.outlook.com , *.live.com , and so on). To handle authentication across these services, requests are made to login.live.com , login.microsoftonline.com ,…
Now that the Uber bug bounty programme has launched publicly, I can publish some of my favourite submissions, which I’ve been itching to do over the past year. This is part one of maybe two or three posts. On Uber’s Partners portal , where Drivers can login and update their details, I found a very simple, classic XSS: changing the value of one of the profile fields to…
Content uploaded to Facebook is stored on their CDN , which is served via various domains (most of which are sub-domains of either akamaihd.net or fbcdn.net ). The captioning feature of Videos also stores the .srt files on the CDN, and I noticed that right-angle brackets were un-encoded. https://fbcdn-dragon-a.akamaihd.net/hphotos-ak-xaf1/….srt I was trying to think of ways to get the file…
I originally wasn’t going to publish this, but @phwd wanted to hear about some of my recent bugs so this post is dedicated to him. This issue was also found by @mazen160 , who blogged about it back in June. When Messenger.com launched back in April, I quickly had a look for any low-hanging fruit. One of the first things to do is check end-points for Cross-Site Request Forgery issues. This is…
I haven’t blogged for quite some time, so I thought it was worth re-launching with an interesting, albeit simple, high-impact bug. Periscope is an iOS/Android app, owned by Twitter, used for live streaming. To manage the millions of users, a web-based administation panel is used, accessible at admin.periscope.tv . When you browse to the site, all requests are redirected to /auth?redirect=/ (since…
Occasionally I’ll get an email from someone interested in getting involved in bug bounties. Whilst some people are quite protective about giving out information - nervous that having more people participating leaves less bugs, I believe that the more people involved the better. Getting paid for issues and gaining credibility is great, but the end goal should be to improve web security as a whole.…
It’s been a week since I launched the SafeCurl “Capture the Bitcoins” contest, which has been a fun, but humbling event. Whilst I work as Security Engineer, and submitted my first bug bounty entry two years ago, I come from a development background. I’ve been writing PHP coming up to nine years now, though nothing much in production for the past year and a half. I wanted to take a break from…
Server-Side Request Forgery attacks involve getting a target server to perform requests on our behalf. Rather than covering some great material already published, this post will be to introduce a new PHP package designed to help prevent these sort of attacks. Protections To protect our scripts from being abused in this way, we simply validate any URL or file path being passed to functions which…
I recently found an XSS on the mobile version of Flickr ( http://m.flickr.com ). Due to the way the bug is triggered, I thought it deserved a write-up. Whilst browsing the site, you’ll notice that pages are loaded via AJAX with the path stored in the URL fragment (not as common these days now that pushState is available). When the page is loaded, a function, q() (seen below), is called which will…
tl;dr : ISPs, please reduce your cookie scope. Everyone now knows that hosting user generated content on a sub-domain is bad. Attacks have been demonstrated on sites such as GitHub , and it’s why Google uses googleusercontent.com. But what if you’re an ISP. You might not host any user-content, however, you probably assign customers an IP which has Reverse DNS set. You’ll probably see hostnames…
Back in April I found three CSRF issues on Instagram, stemming from their Android/iOS App API (which is slightly different from their public API - it’s hosted on their main domain and doesn’t need an access token). These issues were present in the following end-points: accounts/remove_profile_pic - This is used to remove the profile picture from an account accounts/set_private - This is used to…
I’ve found a few bugs on various Facebook satellite/marketing domains (ones which are part of the Facebook brand, but not necessarily hosted/developed by them, and not under the *.facebook.com domain). Most of them aren’t that serious. This one isn’t an exception, and I wouldn’t normally blog about it, but it’s an interesting use case as to why content types are important. The bug is an XSS…
This is a quick post about a simple bug I found on Friendship Pages on Facebook. (Note: Not nearly as cool as a full account takeover , however!) Friendship Pages show you how two users on Facebook are connected, with posts and photos they’re both tagged in, events they’ve both attended and common friends. On these pages, you’re given the option to upload a cover photo (like you would on your…
This post will demonstrate a simple bug which will lead to a full takeover of any Facebook account, with no user interaction . Facebook gives you the option of linking your mobile number with your account. This allows you to receive updates via SMS, and also means you can login using the number rather than your email address. The flaw lies in the /ajax/settings/mobile/confirm_phone.php end-point.…
When you create a shop on Etsy , you can upload an image to be used as a banner. The upload form in the administration section stops you changing the shop to one you don’t control, as expected. There is, however, an AJAX end-point which can also be used to upload these images. This doesn’t check you’re the owner on upload. We can easily upload any image we want onto any shop we want. This could be…
After the wave of OAuth bugs reported recently, It’s my turn to present a just as serious (but slightly less complicated) issue. On the Facebook App Center, we have links to numerous different apps. Some have a “Go to App” button, for apps embedded within Facebook, and others have a “Visit Website” button, for sites which connect with Facebook. The “Visit Website” button submits a POST request to…
Back in October, I found a couple of issues in Etsy , which when combined could be used in a click-jacking attack. Incorrect Error Handling Pretty much all forms on Etsy have a token attached to prevent CSRF attacks. Failing to provide, or providing an incorrect token will result in the form not being processed, and an error page will be displayed. If we submit a POST to the search page, the…
On eBay, the My World section allows users and businesses to construct a profile, with shipping information, returns policies, and also blocks of arbitrary text specified by the user. All of the input boxes have a note below saying that you can’t add HTML, so I was interested to see how it checks/prevents you from entering any. I tried adding in some tags, <a>, <span>, <script>, however they’re…
Everyone knows by now that you should use unique, random passwords for each of your online accounts, to prevent the probability that it’ll be cracked in the event that hashes are leaked, and to limit the damage caused if your plain text password is discovered. I, like many people, use a password manager to store each of these, and on a login form I’ll copy and paste the password into the field.…