Facebook Pictures

Discuss the many weaknesses of browser security and ways to mitigate the threat

Facebook Pictures

Post by limdis on Thu Nov 15, 2012 2:50 pm
([msg=70901]see Facebook Pictures[/msg])

Alright, so here is a little trick I picked up on the other day whilst bored. Most likely won't last too long but hey share the knowledge right!

Facebook image link:
Code: Select all
http://sphotos-b.xx.fbcdn.net/hphotos-prn1/24529_403577343734_4007343_n.jpg


View one of your images with Facebook's image viewer:
I changed this to keep you guys from finding this account, it wont work ;)
Code: Select all
http://www.facebook.com/photo.php?fbid=000000000000000&set=a.111111111111111.22222.333333333333333&type=1&theater


Now replace the zeros in your viewer with this portion:
/hphotos-prn1/24529_403577343734_4007343_n.jpg

If the picture/profile is not private you will now be viewing the image on the actual Facebook profile. Success.



Script kiddie tutorial of the day brought to you by limdis
"The quieter you become, the more you are able to hear..."
"Drink all the booze, hack all the things."
User avatar
limdis
Moderator
Moderator
 
Posts: 1310
Joined: Mon Jun 28, 2010 5:45 pm
Blog: View Blog (0)


Re: Facebook Pictures

Post by not_essence2 on Thu Nov 15, 2012 4:29 pm
([msg=70909]see Re: Facebook Pictures[/msg])

Nice little trick. Skiddies :)
But sadly, we can't use it like Directory Traversal.
not_essence2
Poster
Poster
 
Posts: 189
Joined: Fri Sep 14, 2012 6:09 pm
Blog: View Blog (0)


Re: Facebook Pictures

Post by mShred on Fri Nov 16, 2012 11:29 pm
([msg=70995]see Re: Facebook Pictures[/msg])

Sunnava bitch. I knew there had to be a way to do this. I don't know why I never fuckin looked into it though. The fbid is too obvious. Either way, good find.
Image

For those about to rock.
User avatar
mShred
Administrator
Administrator
 
Posts: 1687
Joined: Tue Jun 22, 2010 4:22 pm
Blog: View Blog (2)


Re: Facebook Pictures

Post by limdis on Sat Nov 17, 2012 10:13 am
([msg=71009]see Re: Facebook Pictures[/msg])

Fbid is pointless now really. But if curious, that's the 3's in the viewer and the 1's is the album id. Just throw that into the url. For example with the example:

http://www.facebook.com/468608253734 --> Album
http://www.facebook.com/7177913734 --> fbid

Some more fun:
http://www.facebook.com/profile.php?=281341509
"The quieter you become, the more you are able to hear..."
"Drink all the booze, hack all the things."
User avatar
limdis
Moderator
Moderator
 
Posts: 1310
Joined: Mon Jun 28, 2010 5:45 pm
Blog: View Blog (0)



Return to Web

Who is online

Users browsing this forum: No registered users and 0 guests