Make money online finding bugs on websites - Part 2 - Facebook Special

Most of the people think that in order to find bugs on websites like Facebook an Twitter and then get paid through their reward programs, one needs to have a lot of technical knowledge. This is required only for people who plan to do this regularly or full time. If you are just little vigilant while using Facebook features, you may get lucky. Here are some easy bugs paid by Facebook bug bounty program in past.

1) Bug showing the admin usernames for a Facebook page.

Facebook used to send messages on user email for liking a page if the user interacted on it. One of the security researcher got such invitation mail from Facebook. He just clicked on the "show original" option and got the details like names of admins of that page.

Reward: $2500

POC: https://www.seekurity.com/blog/gene...cebook-pages-admins-disclosure-vulnerability/

2) Finding the friends of any Facebook user (bypassing his privacy settings)

A security researcher was checking his posts on Facebook when he saw a new feature called year overview. He started digging more about different options there and found an IDOR bug

https://m.facebook.com/username/year/2014/profile_lists/?factoid_type=friends_made

Just replace the username with any Facebook user name and you will see his friends made in that year even if he has hided in privacy settings.

Reward: $5500

POC: https://josipfranjkovic.blogspot.in/2015/07/the-easiest-bug-bounties-i-have-ever-won.html

Point of this thread is that you can also find out some bugs and make decent cash if you pay a little attention. Especially, whenever a new feature is launched, you should test it for bugs.

All the best. Any questions, let me know.

Well, i also found a bug with the facebook ads platform and i got rewarded with 3x $5 coupons.

drilonnn said:

Well, i also found a bug with the facebook ads platform and i got rewarded with 3x $5 coupons.

Click to expand...

That is quite low. Minimum reward in their program is $500. Which link you used for reporting this and when did you report ?

Their business support live chat. Well it was nothing that could hurt them. It was a bug that when you changed an objective in power editor, the adset would immediately spend the daily budget.

drilonnn said:

Their business support live chat. Well it was nothing that could hurt them. It was a bug that when you changed an objective in power editor, the adset would immediately spend the daily budget.

Click to expand...

Next time use the official bug bounty submission link. You never know. There had been cases where original report was rejected but they found another bug during investigation and paid for it to that researcher.

following this thread.... I want to learn more

I disagree, you absolutely need to have basic understanding of how web applications works, so you know what are you looking for.

Especially for sites like Facebook.com, these sites are under daily radars of top notch white hat hackers, chance of a newbie catching a bug is near 0.

Your best choice is to learn basics - SQL injections, XSS, CSRF, Shell uploads and Race conditions.

These days, it's hard to find bugs on sites with public reward program, such as Hackerone or Bugcrowd, however if you can be a little creative and find a good "niche", then you can be really profitable. (skill in first place)

By niche i mean field of apps with sensitive data.

tadeator said:

I disagree, you absolutely need to have basic understanding of how web applications works, so you know what are you looking for.

Especially for sites like Facebook.com, these sites are under daily radars of top notch white hat hackers, chance of a newbie catching a bug is near 0.

Your best choice is to learn basics - SQL injections, XSS, CSRF, Shell uploads and Race conditions.

These days, it's hard to find bugs on sites with public reward program, such as Hackerone or Bugcrowd, however if you can be a little creative and find a good "niche", then you can be really profitable. (skill in first place)

By niche i mean field of apps with sensitive data.

Click to expand...

Most of the bugs on Facebook are found by experienced researchers only these days. This is because the low hanging fruits had already been reported. Regarding, Hackerone and Bugcrowd, I have got rewarded on both platforms and I do not consider myself an expert at all. Just by observing features carefully, I was able to find those bugs.

Update: Facebook is running a promotion for security researchers this month. Find details here:

https://www.facebook.com/whitehat/promotion/