Other nomination

Exploiting Facebook Application XSS Holes to Make API Requests

theharmonyguy

Closing report of the Month of Facebook Bugs, which found XSS in over 9,700 Facebook applications. Because an application's page carries its session secret, an XSS there becomes an API request forgery: a double-injection trick loads the direct FBML page in an fb:iframe so a nested iframe leaks the secret via the referrer, enabling profile theft and viral posting.

Record

Researcher

theharmonyguy

In the archive

• Nominated for the 2009 Top 10 Web Hacking Techniques

Related sources

• Companion source: trigger
• Companion source: payload

Tags

• xss
• csrf
• clickjacking
• iframe
• measurement-study
• info-leak
• case-study
• javascript
• owasp-a01-2021
• owasp-a03-2021
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of theharmonyguy, first published at the original source. Preserved copies are kept so the citation survives its host.