Jun 16Detecting, Fixing, and Defending Against XXE Attacks in Python and JavaIntroduction: XML External Entity (XXE) attacks pose a significant threat to web applications that process XML inputs. These attacks exploit vulnerabilities in XML parsers, enabling attackers to read local files, perform server-side requests, and execute remote code. In this comprehensive guide, we will explore the detection and mitigation of XXE attacks…Cybersecurity6 min readCybersecurity6 min read
Jun 11How to Detect and Mitigate SSRF Vulnerabilities in the Early Coding Cycle: A Comprehensive GuideIntroduction: Server-Side Request Forgery (SSRF) is a critical web application vulnerability that can lead to unauthorized access, data leakage, and compromise of internal systems. In this article, we will delve into the detection and mitigation of SSRF vulnerabilities during the early coding cycle. …Ssrf4 min readSsrf4 min read
May 20, 2021CSRF from which we can create a support ticket in Victim’s Account (500$)Complete Details === I found a CSRF from which we can create a Support ticket with the exact title “Your payouts have been disabled due to suspected fraud” in the victim’s account which may panic victim, but I wanted to report this issue because I think this may have a…Facebook Bug2 min readFacebook Bug2 min read
May 20, 2021Victim’s Anti CSRF Token could be exposed to Third-party Applications installed on user’s Device (500$)Complete Details === During my investigation, I found that a user’s DTSG token can be exposed to a third-party application because of a broken feature in Facebook’s Creator Studio (Web Version), That broken feature triggers an HTML file download in user’s device, which contains fb_dtsg, hashes, ajaxpipe_token, LoggedIn user details and…Bug Bounty2 min readBug Bounty2 min read
Aug 31, 2020Page shops with a hidden Product in “Featured product section” which could be controlled by attacker (Ex Editor).Product Area Pages Complete Details === Facebook allows businesses to sell products on Facebook using their Facebook page & shop feature. In this report, I will demonstrate how a page could have a featured product from another attacker’s page. While initiating this request a user needs “Full permission — Admin”…Facebook Bug Bounty3 min readFacebook Bug Bounty3 min read
Jun 5, 2020[IDOR] Delete saved credit cards from any Business Manager Account — Facebook Bug BountyBusiness manager is having an option to add and manage credit cards. However, this functionality is limited to authorized “Admins” of that particular Business. In this report, I will demonstrate how it’s possible to delete saved credit cards, without having an admin or any role in that Victim’s Business. Impact === Victim’s…Bug Bounty2 min readBug Bounty2 min read
May 2, 2020Private Dashboards were accessible by other Admins in Analytics DashboardVuln Type Privacy / Authorization Product Area Facebook — Web Complete Details === The analytics tool in Facebook is having an option to create dashboards and the creator can change the privacy of dashboard to “Public” or “Private”. I found that private dashboards can be accessed by other admins of that App…Facebook Bug Bounty2 min readFacebook Bug Bounty2 min read
Oct 12, 2019Whitehat test accounts can act as Hidden Admin with Business manager / Ad Accounts.Again this will be a copy/paste of my whole report nothing fancy gifs and memes in this report 😐 Title Whitehat test accounts can act as Hidden Admin with Business manager / Ad Accounts. Vuln Type Privacy / Authorization Product Area Facebook — Web Description/Impact Description === Hi Facebook Team, …Facebook4 min readFacebook4 min read
Aug 15, 2019ByPassing fix of Domain Blocking feature in Business ManagerA few months back I reported this vulnerability Demoted business admin could apply blocklist to all ad accounts and FB rewarded me 500$ for this Vulnerability. After a little bit of more testing, I noticed I can still apply blocklist with low privileges to all Ad accounts in Business Manager.Bug Bounty1 min readBug Bounty1 min read
Jun 17, 2019Business user Employees could have applied block list to all ad accounts listed in the business manager.Summary: During BountyCon 2019 in Singapore, after getting multiple NA & Informative reports. I was digging Business manager more deeply and I noticed that it was possible to apply block list settings to the all ad accounts in a business manager account by an employee. This writeup contains nothing fancy…Facebook4 min readFacebook4 min read
![[IDOR] Delete saved credit cards from any Business Manager Account.](https://miro.medium.com/v2/resize:fill:224:224/0*zb8zJhvk31L0BmVv.png)
![[IDOR] Delete saved credit cards from any Business Manager Account.](https://miro.medium.com/v2/resize:fill:160:112/0*zb8zJhvk31L0BmVv.png)
![Dominic Ifediri [edi]](https://miro.medium.com/v2/resize:fill:40:40/1*4HUau-kwWeX6p2CuOd8BBg.jpeg){kind=small}