Facebook many vulnerabilities found by @AnonymousOwn3r

https://twitter.com/AnonymousOwn3r



http://www.facebook.com

2720/2724 100%
Cross-site Request Forgery

Cross-site Request Forgery (CSRF) is a type of attack whereby unauthorized commands are transmitted from a user that the application trusts. Unlike Cross-site Scripting (XSS), which exploits the trust a user has for a particular site, CSRF exploits the trust that a site has in a user's browser.

solution: Url and Forms that perform important operations must be protected by random tokens (hidden nonce values). These tokens must be checked for validity at the server before the request is processed.

url: http://www.facebook.com/

form: <form method="POST" action="http://www.facebook.com/" enctype="application/x-www-form-urlencoded" autocomplete="on"> ... </form>

url: http://www.facebook.com/find-friends?ref=pf

form: <form method="POST" action="https://www.facebook.com/find-friends/index.php" enctype="application/x-www-form-urlencoded" autocomplete="on"> ... </form>

url: http://www.facebook.com/facebook

form: <form method="POST" action="http://www.facebook.com/ajax/ufi/modify.php" enctype="application/x-www-form-urlencoded" autocomplete="on"> ... </form>

url: http://www.facebook.com/pages/create.php?ref_type=sitefooter

form: <form method="POST" action="http://www.facebook.com/ajax/pages/create/CreatePageCheck.php" enctype="application/x-www-form-urlencoded" autocomplete="on"> ... </form>

url: http://www.facebook.com/help/adpolicy

form: <form method="POST" action="http://www.facebook.com/support/ajax/feedback.php" enctype="application/x-www-form-urlencoded" autocomplete="on"> ... </form>

url: http://www.facebook.com/r.php?possible_fb_user=1&is_enabled=1&next=https%253A%252F%252Fwww.facebook.com%252Fphoto.php%253Fv%253D3802752155040&locale=en_US

form: <form method="POST" action="http://www.facebook.com/r.php?possible_fb_user=1&is_enabled=1&next=https%253A%252F%252Fwww.facebook.com%252Fphoto.php%253Fv%253D3802752155040&locale=en_US" enctype="application/x-www-form-urlencoded" autoc...
Autocomplete Enabled

Autocomplete should be disabled (autocomplete="off"), especially in forms which process sensitive data, such as forms with password fields, since an attacker, if able to access the browser cache, could easily obtain the cached information in cleartext.

solution: Disable the autocomplete feature (autocomplete="off") on forms which may hold sensitive data.

url: http://www.facebook.com/

form: <form method="POST" action="http://www.facebook.com/" enctype="application/x-www-form-urlencoded" autocomplete="on"> ... </form>

url: http://www.facebook.com/r.php?possible_fb_user=1&is_enabled=1&next=https%253A%252F%252Fwww.facebook.com%252Fphoto.php%253Fv%253D3802752155040&locale=en_US

form: <form method="POST" action="http://www.facebook.com/r.php?possible_fb_user=1&is_enabled=1&next=https%253A%252F%252Fwww.facebook.com%252Fphoto.php%253Fv%253D3802752155040&locale=en_US" enctype="application/x-www-form-urlencoded" autoc...
Path Disclosure

Various system paths were disclosed within the application client source code or other files. This information could be used by attackers to make an educated guess about the application environment and any inherited weaknesses that may come with it.

solution: It is recommended to re-examine the system path disclosures and remove their reference from the application's source code.

path: e:\u003C ...

request:

GET http://www.facebook.com/jackie HTTP/1.1


path: d:\u003C ...

request:

GET http://www.facebook.com/jackie HTTP/1.1


IP Disclosure

The server or application disclosed internal network information. This information could be used by attackers to make an educated guess about the internal or external network topology. Leaked IP addresses could be used as a stepping-stone to more complex attacks.

solution: Ensure that sensitive information such as internal or external IP addresses is safely guarded. Unless there is a good, prevent the disclosure of network information.

ip: 10.3.181.34

request:

GET http://www.facebook.com/careers/?ref=pf HTTP/1.1


Facebook many vulnerabilities found by @AnonymousOwn3r

https://twitter.com/AnonymousOwn3r