This Hacker Can Hack Any Facebook Account !

Here is a big issue arises on the internet to hack any Facebook account. That is really hard to find a way to hack someone’s Facebook account by which hacker can see all conversations, post anything as well as any payment card details and hacker have the power to do anything with that account.

But recently here is a ‘simple vulnerability’ found on Facebook that will give us the power to access any Facebook account of any user even it could be done without any user interaction. Which you can hack any Facebook account by setting a new password and can see all messages, personal photos as well as his/her details of under credit/debit cards stored etc.

This vulnerability is found by bug hunter Anand Prakash from India who has discovered a Password Reset Vulnerability in Facebook. Facebook acknowledged this issue and fixed it and also rewarded by $15,000 USD considering the impact of this vulnerability.

HOW IT WORKS :

This is a simple but also critical vulnerability that will give an endless opportunities to reset any account’s password.

As you know that whenever we forget our password of our Facebook account then we have the option to reset the password by entering our phone number or email address on Facebook. And then Facebook send a 6 digit code on our phone number or email address by which we can set our new password.

And for ensuring the genuinely of the user, Facebook gave the chance to the account holder for trying a dozen codes before the account confirmation code is blocked due to the blocking process of brute force that has only limited chance to attempts the code.

The Security researcher describes in his blog post that, the Facebook had not implemented the rate-limiting in its process of password reset on the beta sites such as beta.facebook.com & mbasic.beta.facebook.com.

He tried to brute force the 6-digit code on the beta pages of Facebook. There is a window of ‘Forgot Password’ and found that there is no limitation for attempting that number of codes on that beta pages.

POC Video:

Here’s a proof-of-concept(POC) video demonstration by Anand Prakash which shows that how the attack works.

Playvideo

VULNERABLE REQUEST:

POST /recover/as/code/ HTTP/1.1 Host: beta.facebook.com

lsd=AVoywo13&n=XXXXX

Brute forcing the "n" successfully allowed me to set a new password for any Facebook user.

Anand discovered this simple as well as critical vulnerability in February and then he reported it to Facebook on February 22. Then the social network giant immediately fixed this issue and had rewarded him by $15,000 USD for considering the rigorousness and impact of the vulnerability.

Hack Any Facebook Account !

This Hacker Can Hack Any Facebook Account ! Here is a big issue arises on the internet to hack any Facebook account. That is real...

Hack Any Facebook Account !

Tools: Hh_server

The Hack server works behind the scenes to keep your codebase in constant sync for the hh_client typechecker. However, the serverhh_server can also be used for some primary standalone functionality as well.

If you want to see all the options available to hh_server, see the help via hh_server --help.

Check and Exit

If you want to typecheck a file or a directory of files without the overhead of a constant server running combined with hh_client, you can do a quick and dirty check with hh_server.

hh_server --check <path>

Like with running hh_client, you must ensure that the root of your path has an empty .hhconfig file.

Specify a dot . to represent checking the current path.

Automatic Type Annotations

hh_server provides a mode where you can take a Hack file or project of Hack files and automatically add type annotations to those files.

NOTE: This only works on <?hh files.

hh_server --convert <path to files to convert> <path to top level of project>

Many times the two paths are the same. However, this does give you the flexibility of converting only a subset of a project. Normally, the path to the top level of the project has the .hhconfig.

This process annotates with soft type hints via @. This is because the annotation is far from perfect and we would rather have warnings thrown rather than fatal at runtime.

For example, the following unannotated Hack file:

<?hh

function foo($x) {
  if ($x + 3 < 10) {
    return false;
  }
  return true;
}

function bar($y) {
  if ($y) {
    return "Hi";
  }
  return null;
}

might be converted to:

<?hh

function foo($x): @bool {
  if ($x + 3 < 10) {
    return false;
  }
  return true;
}

function bar($y): @?string {
  if ($y) {
    return "Hi";
  }
  return null;
}

Tools: Hh_server

Tools: Hh_server The Hack server works behind the scenes to keep your codebase in constant sync for the hh_client typechecker ....

Tools: Hh_server

With having more than 200 million active users, WhatsApp is really one most amazing and effective cross platform messenger today. In addition to Live Chat, WhatsApp is coming with several mesmerizing features such as sharing multimedia files and other data with which this application is pulling a large number of Smartphone users. In fact, it has more users than Facebook and Twitter, according to a recent survey. Apart from doing some well-known and most sought-after tasks, there are some other tactics you can try in WhatsApp but you may not know.

Untold WhatsApp Tricks

1. Last Seen Timestamp can be hidden: Majority of Smartphone users don’t like to see ‘Last Seen Timestamp’ on their timeline. Though iOS users can hide timestamp on their Apple devices by going through advanced settings, this feature was not available in Android phones till today. Now you can hide these notifications in your Android phone.