Exploiting a Cross-site Scripting (XSS) vulnerability on Facebook

The following video shows how an attacker may exploit a cross-site scripting vulnerability on Facebook.com regardless of the HTTPOnly cookie protection used. Of course, this goes way beyond showing an "alert()" popup in Javascript, since the attacker is also able to hijack the victim's Facebook account. We also published an article to explain in more technical detail the works behind abusing such a flaw.

http://www.acunetix.com/websitesecurity/xss-facebook.htm

Facebook rates as the second most popular website on the internet with 400 million active users. When such a website has common web application security flaws, they are going to be abused for one's gain. When we came across an obvious cross-site scripting vulnerability, we decided to show that an attacker could do that.

We worked with Facebook to make sure that this vulnerability is fixed. We would like to thank their security team for quickly fixing it.

For more information visit http://www.acunetix.com

Category:

Science & Technology

Tags:

• xss
• cross-site Scripting
• vulnerability
• facebook
• acunetix
• web security
• exploit

[pspheaven]

VERY nice :) another good way/easy was it to run SET/metasploit clone attack that looks like the facebook login page, they'll think they got signed out and log back in giving you their user/pass

[RapTangerTube]

Nice Coding to iframe hijack