StellaArtois
BANNED
- Jun 13, 2011
- 104
- 357
Anyone who has a toolbar and noticed it's stopped working, or anyone wanting to write a bot, or software, that makes requests to Facebook will find this interesting.
Recently Facebook added a new parameter to their query strings when making post requests. Such as inviting to events, sharing content etc. At the end of the URL you will notice: &phstamp=00000000000
Some would be fooled into thinking phstamp is some sort of timestamp. It's not. It's a hash that's generated per request to verify the request. I managed to crack it ...
Usage:
- qs = Query string. (Monitor headers with LiveHTTPHeaders to get the query string of a post request on Facebook). Example:
(exclude '&phstamp=165816710081728698224' when passing in the query string).
- dtsg = This if the fb_dtsg value.
And that's how you generate a phstamp hash
Hint ... this relates to the recent spurt of events popping up with millions of invites. Do you're own research on that, I won't be leaking that at this point (don't PM me for the exploit either please).
Recently Facebook added a new parameter to their query strings when making post requests. Such as inviting to events, sharing content etc. At the end of the URL you will notice: &phstamp=00000000000
Some would be fooled into thinking phstamp is some sort of timestamp. It's not. It's a hash that's generated per request to verify the request. I managed to crack it ...
Code:
function generatePhstamp(qs, dtsg) {
var input_len = qs.length;
numeric_csrf_value='';
for(var ii=0;ii<dtsg.length;ii++) {
numeric_csrf_value+=dtsg.charCodeAt(ii);
}
return '1' + numeric_csrf_value + input_len;
}Usage:
- qs = Query string. (Monitor headers with LiveHTTPHeaders to get the query string of a post request on Facebook). Example:
(exclude '&phstamp=165816710081728698224' when passing in the query string).
- dtsg = This if the fb_dtsg value.
And that's how you generate a phstamp hash
Hint ... this relates to the recent spurt of events popping up with millions of invites. Do you're own research on that, I won't be leaking that at this point (don't PM me for the exploit either please).
Last edited:
