[Method] Exploiting The Facebook Referrer Mechanism For Your Needs

[mrblackjack]

Ok, the referrer is pretty important data in the IM world - especially when promoting aff products or just applying some nasty blackhat techniques.
In this short tutorial I'll show you how you can exploit the Facebook Referrer mechanism so that u can drive traffic to whatever sites / products urls you wish using a "Facebook Referrer" thus making all your traffic "legit".

Mods, I think you should move it to VIP so it wont get patched very fast by FB.

1. After you click on a url that is placed in Facebook, the url looks something like this:

https://www.facebook.com/l.php?[COLOR=#ff0000][B]u=[/B][/COLOR]http%3A%2F%2Ftest.com&[COLOR=#ff0000][B]h=[/B][/COLOR]BAQGNjWYdAQFwke7miQOHRy0VEJAObRA-7U3jmzs7Ry3lIg&enc=AZMTie6VVgCYbMTC524rLAODuF4JIN6seVoAtw-EL351_0cdlh2NKbsM6lzYDRdwRN-7XbUqOhcEV38e57sUnSeW&s=1

take a look at the image, if you click on the link, you will be redirected to the destination url by The Facebook Redirect Mechanism (pattern is displayed in the code above)


Now, pay attention to the bold-red parameters.
the first parameter "u=" is the url Facebook send the visitor to
the second parameter "h=" is a security token.

Now, all you have to do is click on a link that has been shared or published in Facebook, copy the redirect url (before being redirected), replace the "u=http://...." to your own custom url, let's say an affiliate offer, and use the full Facebook url as a destination url for your banners/ links / images etc.

Thus, whenever a user will click this url, he will be redirected to your offer, and the referrer will be of "Facebook". Actually, the referrer will be: "facebook.com/l.php".

Pay Attention: the token contains data of your geo location. Therefore, if you are located in Canada for ex. and clicked on a Facebook url, apparently only Canada visitors to the re-structured url will be redirected to your final destination url, the others will get a security alert.

here are further urls that I re-structured (to my own custom urls), that work here from Israel. let me know if each works for you:

https://www.facebook.com/l.php?u=http%3A%2F%2Fblack-jack.co.il&h=BAQGNjWYdAQFwke7miQOHRy0VEJAObRA-7U3jmzs7Ry3lIg&enc=AZMTie6VVgCYbMTC524rLAODuF4JIN6seVoAtw-EL351_0cdlh2NKbsM6lzYDRdwRN-7XbUqOhcEV38e57sUnSeW&s=1




https://www.facebook.com/l.php?u=http%3A%2F%2Fgoogle.com&h=BAQGNjWYdAQFwke7miQOHRy0VEJAObRA-7U3jmzs7Ry3lIg&enc=AZMTie6VVgCYbMTC524rLAODuF4JIN6seVoAtw-EL351_0cdlh2NKbsM6lzYDRdwRN-7XbUqOhcEV38e57sUnSeW&s=1




https://www.facebook.com/l.php?u=http%3A%2F%2Fyahoo.com&h=BAQGNjWYdAQFwke7miQOHRy0VEJAObRA-7U3jmzs7Ry3lIg&enc=AZMTie6VVgCYbMTC524rLAODuF4JIN6seVoAtw-EL351_0cdlh2NKbsM6lzYDRdwRN-7XbUqOhcEV38e57sUnSeW&s=1


https://www.facebook.com/l.php?u=http%3A%2F%2Fcnn.com&h=BAQGNjWYdAQFwke7miQOHRy0VEJAObRA-7U3jmzs7Ry3lIg&enc=AZMTie6VVgCYbMTC524rLAODuF4JIN6seVoAtw-EL351_0cdlh2NKbsM6lzYDRdwRN-7XbUqOhcEV38e57sUnSeW&s=1

 

[pasenseoso]

hi sir.. I am getting this :

For the safety and privacy of your Facebook account, remember to never enter your password unless you're on the real Facebook web site. Also be sure to only download software from sites you trust.

 

[Raffy]

Great share, thanks. "You must spread some Reputation around before giving it to mrblackjack again"

 

[mrblackjack]

forgot to mention that the traffic to the facebook url has to match the country where the url has been set in the first place. That is, if u create a custome fb url from the u.s. for ex, only traffic from u.s. will go through; otherwise, you'll get the following message

hi sir.. I am getting this :

For the safety and privacy of your Facebook account, remember to never enter your password unless you're on the real Facebook web site. Also be sure to only download software from sites you trust.

 

[RisingMoon]

MrBlackJack, are you near Tel Aviv?

 

[osmokes]

I get what you're doing but how can this lead to anything? how would you get people to share the link when it redirects to something else. Can you give examples of possible use?

 

[ComputerEngineer]

I get what you're doing but how can this lead to anything? how would you get people to share the link when it redirects to something else. Can you give examples of possible use?

exactly

i don't see any useful usage of this

 

[TheVigilante]

exactly

i don't see any useful usage of this

dont understand why people come whining when something is shared for free

 

[SMMCity]

Thanks for sharing this!

 

[Salto]

If you dont see the use of this, leave the thread!

Thanks for the share

 

[TheVigilante]

Thanks for sharing this!

isnt there a thanks button for this already

 

[SMMCity]

isnt there a thanks button for this already

Yeah I was waiting for someone to say that, my thanks ran out yesterday. I didn't know this but their is a limit to how many thanks you can give.

 

[imperial444]

there you go. Nice cloaking technique. Thanks

 

[commenting shop]

Thanks mate for such a Wonderful Share

 

[frankweerasinghe]

method not working

 

[dinkish]

Hotmail wasn't new at the time, but there still was a very similar attack to get access.

Tokens are based on sessions (after login essentially). They're serialized, but you still perhaps be able to to hijack url's It's still time dependent at the very least if this is a valid exploit. Which would be pretty fucking stupid let alone irresponsible.

 

[chaytu]

The facebook redirecting mechanism doesn't work! The destination url directly appears on the address bar after i click on any link. guess fb figured this out and updated their algorithm. Anyways nice share OP

 

[MysticMerchant]

A 6 month old technique that no longer works, Imagine that....