I Hacked into Facebook's Legal Department Admin Panel

You brilliant guys need to find a way to extract more than $7500 for solutions to problems that less than what, 2%?, of the worlds population can solve.<p>If I were your tech agent I&#x27;d demand Facebook pay out $75,000 minimum for this specific problem.

First pentester I found with 12k followers on Instagram: <a href="https:&#x2F;&#x2F;www.instagram.com&#x2F;al_shwele&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.instagram.com&#x2F;al_shwele&#x2F;</a> but 8 on GitHub: <a href="https:&#x2F;&#x2F;github.com&#x2F;Alaa-abdulridha" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;Alaa-abdulridha</a><p>Instagram keeps surprising me...

I&#x27;ve always wondered, aren&#x27;t these types of bug investigations illegal? Aren&#x27;t the investigators concerned about criminal prosecution? Not being snarky; I&#x27;m asking sincerely.

I find the paragraph where the author described the exploit hard to read.<p>Basically, he triggered the &quot;Password Reset&quot; process and then guessed the reset token?

Url changed from <a href="https:&#x2F;&#x2F;alaa0x2.medium.com&#x2F;how-i-hacked-facebook-part-one-282bbb125a5d" rel="nofollow">https:&#x2F;&#x2F;alaa0x2.medium.com&#x2F;how-i-hacked-facebook-part-one-28...</a>, which points to this.

$7500 seems low for this bug. If I were Facebook i would raise it. Why?<p>Cost&#x2F;benefit analysis tells me I could probably get a lot more for this bug going to some more nefarious actors.<p>$7500 is a drop in the ocean for a company like FB who has a reputation to keep intact.

How on Earth did this endpoint pass code review at Facebook?<p>The person who wrote it probably was working under the assumption that the calling user was logged in, but still....

Judging my the response letter it seems they think he only managed to reset a password... not <i>setting</i> the password. Will be interesting to read the follow up.

What is this fuzzing tool you use to get the endpoints?

I&#x27;m a little bit disappointed, because from the title I expected a little bit of deep dive into the content of the admin panel.<p>Something like an insight into what kind of secret power or privacy abuse was available to the legal department without the users really realizing.

It&#x27;s kinda cool that because this webapp is evidently so little used in public, if you just do a Web search for &quot;facebook tapprd&quot; you&#x27;re pretty much just gonna find bug bounty writeups ( e.g. <a href="https:&#x2F;&#x2F;medium.com&#x2F;@amineaboud&#x2F;story-of-a-weird-vulnerability-i-found-on-facebook-fc0875eb5125" rel="nofollow">https:&#x2F;&#x2F;medium.com&#x2F;@amineaboud&#x2F;story-of-a-weird-vulnerabilit...</a> ).

Awesome post. Shameless plug on a similar exploit I found using the browser developer tools on a large scale application <a href="https:&#x2F;&#x2F;github.com&#x2F;rukshn&#x2F;rukshn.github.io&#x2F;blob&#x2F;master&#x2F;archives&#x2F;easter&#x2F;egg.md" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;rukshn&#x2F;rukshn.github.io&#x2F;blob&#x2F;master&#x2F;archi...</a>

So in this case he actually changed someone&#x27;s password - don&#x27;t they have a policy saying that you have to only do this kind of stuff with your own account or in a sandbox? Or is this exempt because such a thing is not possible since it&#x27;s internal?

The way the admin panel screenshot is censored is not good as per this post: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=25326450" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=25326450</a><p>All those names could be recovered in theory.

$7500? Why are these bug bounties so piddling?<p>How much would an exploit like this be worth on the black market? What&#x27;s the potential loss &#x2F; liability on Facebook&#x27;s side? Hundreds of thousands? Millions?

Proofreading services.

Facebook had better up that payout on the other two vulnerabilities he found.

Interesting, but missing words and strange&#x2F;missing punctuation make this a bit hard to read.

With that kind of skill you should just be working website and buying PlayStations, shoes and other high demand goods in bulk. You can make moths than 7k per week

How is this possible?<p>Even in my 1 weekend web apps I ensure password reset tokens are secured against their user and token type, but Facebook, a $720,000,000,000 company, can&#x27;t do it for their ADMIN site?

well, I wasn&#x27;t gonna to comment about this subject, but here we go: I find this value ($7,500.00) kind of low for a discovery like this.<p>The other day, someone shared a link to an app [1] that estimastes how much a only fan user makes. I got tell, it got to me. I was never money orientated and I don&#x27;t plan to become; but seeing how much someone makes by being naked in front of a web cam vs a software engineer salary is kinda sad.<p>some of the only fans users makes in a month what a plain SE would make in a year. besides the fact that there are some serious wrong thing with the world, I thought this kind of skill would be more rewarded. Giving the fact that you could exploit this vulnerability to make a lot more money (or am I mistaken?).<p>1 - <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=25393191" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=25393191</a>