The easiest bug bounties I have won

Post by bentcorner » Mon, Jul 13, 2015, 4:15 PM UTC

joosters wrote: post #5

Doesn't this show just how crappy the backend permissions must be in Facebook's code? Every new page needs to get the permissions checks exactly right, otherwise... Disaster. As an analogy, It's like the most stupidly-designed UNIX system, where each user program that opens a file runs as root and must remember to do a permissions check when opening a file, rather than centralising the permissions system in the kerne…

Post by danieljchen » Mon, Jul 13, 2015, 4:59 PM UTC

dublinben wrote: post #14

kccqzy wrote: post #3

It is quite saddening that there is a recent trend of hiding the complete URL from the user when the URL itself conveys much information. When the URL is hidden the user is not given the incentive to look at the URL, let alone modify it. This kind of bug should have been discovered much sooner when the user is given the opportunity to directly look at the URL and experiment with it.

>experiment with it Be careful with simple "experimentation" like this. You can fall afoul of the CFAA for exactly this.

Post by aristus » Mon, Jul 13, 2015, 5:18 PM UTC

joosters wrote: post #5

Doesn't this show just how crappy the backend permissions must be in Facebook's code? Every new page needs to get the permissions checks exactly right, otherwise... Disaster. As an analogy, It's like the most stupidly-designed UNIX system, where each user program that opens a file runs as root and must remember to do a permissions check when opening a file, rather than centralising the permissions system in the kerne…

Post by aristus » Mon, Jul 13, 2015, 6:02 PM UTC

amputect wrote: post #26

aristus wrote: post #25

Earlier quoted context omitted.

Facebook's permissions model is very complex. Just imagine a case where Fanny comments on Alice's photo which is shared to a custom friends list, which contains Bert (Alice's friend), who Fanny put on her block list... and that's a simple example. It has been proposed a number of times to put it all behind an API. I do not know if this has been finished yet. I remember an epic diff comment thread which only ended aft…

> I remember an epic diff comment thread which only ended after the author defended her solution with a mathematical proof of correctness. Can you share anything more about this anecdote? I feel like there's a really interesting story there.

Post by SamHoustonCM » Mon, Jul 13, 2015, 9:55 PM UTC

Retr0spectrum wrote: post #12

I've been wanting to start doing bug bounties for a while now, but I have only been able to find serious bugs in sites without bug bounty schemes. I was starting to think that it would be impossible to get any bug bounties because of the number of people searching, but this post gives me some confidence.