Facebook Url Redirection Vuln.
-----------------------------------------------------
#Title: Facebook Url Redirection Vulnerability
#Discovery Date: 10/July/2013
#Author: Cans=C4=B1n Y=C4=B1ld=C4=B1r=C4=B1m
#Twitter: @YildirimCansin
#Website: www.cansinyildirim.com
-----------------------------------------------------
Introduction:
The vulnerability reported on 10th July however Facebook Security Team
replied that it is an expected behaviour. That is why I don't see any
reason not to publish the vulnerability. More detailed background
information can be found on their website:
http://www.facebook.com/notes/facebook-security/link-shim-protecting-the-pe=
ople-who-use-facebook-from-malicious-urls/10150492832835766
Decription:
By obtaining user-specific hash value, an attacker redirect the user
to a malicious website without asking for verification. The hash value
can be found from the link that the user send to his/her wall. After
clicking on user's link,by setting BurpSuite Proxy, the attacker
intercept the parameters in the methods.
Example url: http://www.facebook.com/l.php?u=3Dhttp%3A%2F%2Fwww.youtube.com=
%2Fwatch%3Fv%3DSvWjWEyTLkg&h=3D3AQGbk0Cf&s=3D1
However we don't need s parameter, for the attacker most important
part of the url is the h paramater.
Example h paramater =3D h=3D3AQGbk0Cf
Now it is time to change the u paramater to a malicious site and send
it to user with the same h paramater
Example malicious url:
http://www.facebook.com/l.php?u=3Dcansinyildirim.com&h=3D3AQGbk0Cf
Example malicious encoded url:
http://www.facebook.com/l.php?u=3D%63%61%6e%73%69%6e%79%69%6c%64%69%72%69%6=
d%2e%63%6f%6d&h=3D3AQGbk0Cf
After the victim clicks on the link, Facebook redirects the victim to
a page specified by the attacker.
Important note: I tried while the attacker and the victim were friends.
Proof of Concept:
http://vimeo.com/70087250
http://www.cansinyildirim.com/facebook-url-redirection-vulnerability-2013/
討論串 (同標題文章)