Exploiting a Cross-site Scripting (XSS) vulnerability on Facebook

The following video shows how an attacker may exploit a cross-site scripting vulnerability on Facebook.com regardless of the HTTPOnly cookie protection used. Of course, this goes way beyond showing an "alert()" popup in Javascript, since the attacker is also able to hijack the victim's Facebook account. We also published an article to explain in more technical detail the works behind abusing such a flaw.

http://www.acunetix.com/websitesecuri...

Facebook rates as the second most popular website on the internet with 400 million active users. When such a website has common web application security flaws, they are going to be abused for one's gain. When we came across an obvious cross-site scripting vulnerability, we decided to show that an attacker could do that.

We worked with Facebook to make sure that this vulnerability is fixed. We would like to thank their security team for quickly fixing it.

For more information visit http://www.acunetix.com

• Catégorie

  • Science et technologie

• Licence

  • Licence YouTube standard