What The .. Facebook JS SCRIPT EXPLOIT ?

[Crazy]

The scripts being run aren't XSS. I see everyone referring to these JS methods as XSS, but it's best to not call it that because frankly, it's not. Users are running the scripts all within the FB domain, there is no cross-scripting happening. XSS would be running a script within the facebook.com namespace and accessing something on sbx.facebook.com or m.facebook.com, or even shithead.com, all within the script's execution... This isn't happening.

 

[sam.hunt0710]

The scripts being run aren't XSS. I see everyone referring to these JS methods as XSS, but it's best to not call it that because frankly, it's not. Users are running the scripts all within the FB domain, there is no cross-scripting happening. XSS would be running a script within the facebook.com namespace and accessing something on sbx.facebook.com or m.facebook.com, or even shithead.com, all within the script's execution... This isn't happening.

The "==verify my account==" shit that this thread is about was actually an XSS attack. And when I say XSS, yes I mean cross site scripting. It is patched by FB now ofc.

The JS you are talking about or we mostly see around doesn't do any xss though and can't be patched. I have my versions still working.

Hope it clears your confusion.

 

[Crazy]

The "==verify my account==" shit that this thread is about was actually an XSS attack. And when I say XSS, yes I mean cross site scripting. It is patched by FB now ofc.

The JS you are talking about or we mostly see around doesn't do any xss though and can't be patched. I have my versions still working.

Hope it clears your confusion.

Not really bud, I know the exploit. It bypassed their countermeasure for direct linking to/execution of JavaScript code. Within a personal site it's not uncommon for a developer to use [a href="javascript:alert('test');"] ... but it is uncommon for someone to link to such a code snippet on FB. Why EVERY URL submitted to their network wasn't (or isn't) sanitized is beyond me. This method simply avoided the need for the user to copy & paste the code; hence it's high success rate and insane level of virality. But the script itself did no cross-site-scripting. You may be considering the action of getting around FB's countermeasure as XSS, but if anything, at best it's considered an exploit, at worst a bug or overlooked/unpatched issue within their news feed.

XSS is highly advanced shit and requires more than just running basic AJAX. For example, some rely on buffer overflow exploits within the operating system to execute their scripts. Fundamentally it requires breaking the limitations of the scripting language development platform (JS/VBS/etc), browser safety, and OS safety, which is why almost all XSS exploits arrive via 0day groups and the like. To put it simply: true XSS can't be patched by FB tweaking their shitty site, it's addressed by OS & browser patches.

 

[youngguy]

XSS is XSS, bookmarklet is bookmarklet. Please stop talking about something you don't know shit about.

Javascript Codes that ask people to copy and paste in the address bar is 1 kind of bookmarklet, not a XSS.

XSS = CROSS SITE SCRIPTING = http://ha.ckers.org/xss.html

If you come to http://abc.com/?a=john and this site display something like

<div>john</div>

You then try to put

http://abc.com/?a=<script>alert("fuck!")</script>

And you see an alert box says: fuck! then you found a xss bug.

Same with this Facebook bug. They send this instead of an actual action link:

javascript:/* their codes */

This will successfully inject the malicious javascript link into News feed.


And what you tell about inject something to fuck up the operating system, hack / steal data blah blah, it's called SQL Injection.

 

[xwanka]

Not really bud, I know the exploit. It bypassed their countermeasure for direct linking to/execution of JavaScript code. Within a personal site it's not uncommon for a developer to use [a href="javascript:alert('test');"] ... but it is uncommon for someone to link to such a code snippet on FB. Why EVERY URL submitted to their network wasn't (or isn't) sanitized is beyond me. This method simply avoided the need for the user to copy & paste the code; hence it's high success rate and insane level of virality. But the script itself did no cross-site-scripting. You may be considering the action of getting around FB's countermeasure as XSS, but if anything, at best it's considered an exploit, at worst a bug or overlooked/unpatched issue within their news feed.

XSS is highly advanced shit and requires more than just running basic AJAX. For example, some rely on buffer overflow exploits within the operating system to execute their scripts. Fundamentally it requires breaking the limitations of the scripting language development platform (JS/VBS/etc), browser safety, and OS safety, which is why almost all XSS exploits arrive via 0day groups and the like. To put it simply: true XSS can't be patched by FB tweaking their shitty site, it's addressed by OS & browser patches.

Lol dude you failed miserably.
XSS is not "highly advanced shit" and it basically happens when you don't filter input properly and then attacker can insert malicious code --> in this case javascript which MSGed all yours friends.

In most cases XSS is not really a big danger to a website but in this case with social community like FB it was.

Also it has nothing to do with OS and browser patches.And yes it can be fixed by "tweaking their shitty site".Also buffer overflows have nothing to do with XSS and AJAX usage is more than enough to successfuly exploit it.


I cannot beilive someone can write so much misleading information in one post lol...

Dude next time you gonna play smart google it first

 

[Crazy]

@youngguy - Don't know if you were talking to me in that post, if so clarify.

@xwanka - The problem is, people like you fail to read. I said "some" rely on OS-based buffer overflow exploits to handle their XSS. I study shit like this. I can point you to a specific example of a reverse engineering of a Windows patch to isolate a buffer overflow vulnerability that resulted in the ANI exploit/vuln -- which, can be used to deliver XSS.

If you miss key vocabulary in a sentence, you're bound to rant about shit that I *did not* say. Second of all, XSS is more advanced than simply slipping JavaScript into a LINK! Again, that's my opinion. What "youngguy" was talking about in his example of passing the JS to the site as parameter "a" on that site, yes. That would be XSS. On a second look, I see that it does do this. That would be exploiting a site's lack of sanitizing a variable before doing subsequent shit with it.

I guess since you're passing the script to the news feed's display parameters via an unsanitized variable that would qualify. I apologize I should have looked into it more.

 

[youngguy]

What I want to do is proving this a XSS bug Sorry for my last post, I was a bit crazy with this

The scripts being run aren't XSS. I see everyone referring to these JS methods as XSS, but it's best to not call it that because frankly, it's not.

 

[FaceBuilder]

can anyone post me the link or any test page of this?? not right ? lol..

 

[xwanka]

@youngguy - Don't know if you were talking to me in that post, if so clarify.

@xwanka - The problem is, people like you fail to read. I said "some" rely on OS-based buffer overflow exploits to handle their XSS. I study shit like this. I can point you to a specific example of a reverse engineering of a Windows patch to isolate a buffer overflow vulnerability that resulted in the ANI exploit/vuln -- which, can be used to deliver XSS.

If you miss key vocabulary in a sentence, you're bound to rant about shit that I *did not* say. Second of all, XSS is more advanced than simply slipping JavaScript into a LINK! Again, that's my opinion. What "youngguy" was talking about in his example of passing the JS to the site as parameter "a" on that site, yes. That would be XSS. On a second look, I see that it does do this. That would be exploiting a site's lack of sanitizing a variable before doing subsequent shit with it.

I guess since you're passing the script to the news feed's display parameters via an unsanitized variable that would qualify. I apologize I should have looked into it more.

Well dude I am not saying you'r unskilled but you are misleading what XSS is.

XSS is nothing more than failing to filter website inputs so attacker can insert html tags.

They could do basically everything from iframing, including javascript, redirecting, fake message etc.

On closed communities this is not a problem but in FB case it was huge problem because they left vuln on the wrong spot.


About buffer overflows that's completely different thing.
It has nothing to do with website vulns but vulns in code of OS/Browser/App as you already said.Most of times attackers rewrite stack with shellcode which downloads virus/bot to visitor's computer and executes it.


But yes I agree browser exploits COULD BE served with XSS.But it wasn't it this case.


Cheers.