Read on Twitter
[ #bugbountytips ]
An ATO case which only works if your target doesn't verify your email immediately:
1.Sign up using the victim's (FB)Email address and Username.
2.Then use FB Oauth with the same details to sign up.
3. You might get logged in to the same account.
Sev- P2/P3
An ATO case which only works if your target doesn't verify your email immediately:
1.Sign up using the victim's (FB)Email address and Username.
2.Then use FB Oauth with the same details to sign up.
3. You might get logged in to the same account.
Sev- P2/P3
Explanation-After signing up with the victim's FB email and username set a random password for that account.
Then use FB OAuth with the same email and username but the password must be the FB password. The user already exists with these details so you may get logged in as victim.
Then use FB OAuth with the same email and username but the password must be the FB password. The user already exists with these details so you may get logged in as victim.
We don't need to have the victim's FB account. We just need their FB email and username. Use these both to create an acc and set a password. If the victim uses FB OAuth with these details, the victim may get logged in to the same account created by us, hence we share an account.
