+- Hack Forums (https://hackforums.net)
+-- Forum: General Topics (https://hackforums.net/forumdisplay.php?fid=7)
+--- Forum: World (https://hackforums.net/forumdisplay.php?fid=445)
+---- Forum: The Lounge (https://hackforums.net/forumdisplay.php?fid=25)
+---- Thread: Facebook bug I found. (/showthread.php?tid=6038413)
Pages: Pages
1
2
Facebook bug I found. - Mr. Robot - Jan 5, 2020
If you go to Facebook of this person - and click about.... Instead of showing you their about, it will take you to your own about section on Facebook.
https://www.facebook.com/karthic007
The reason for this is the break in the URL for the ID.
Not sure how I can replicate it yet but I think I know a way.
It's because of the custom URL + it still thinking the ID is a number set.
RE: Facebook bug I found. - Mix - Jan 5, 2020
Oh god you are at it again with these custom URLS.
Honestly, I kinda understand it but why does it still think its an ID when it clearly is a user account.
RE: Facebook bug I found. - MavenGradle - Jan 5, 2020
Definitely a strange one. These don't have the issue however:
https://www.facebook.com/karthic007/about
https://www.facebook.com/profile.php?id=100006337560157&sk=about
The difference being that the ID is not included in the link of 'about' if you follow your URL, hence it redirects you to your own profile. You won't be able to get anything out of this, except getting redirected to your own profile, I'm afraid. But you can definitely report this so they fix the URL schemes.
RE: Facebook bug I found. - Mr. Robot - Jan 5, 2020
(Jan 5, 2020 05:35 PM)MavenGradle Wrote: Definitely a strange one. These don't have the issue however:
https://www.facebook.com/karthic007/about
https://www.facebook.com/profile.php?id=100006337560157&sk=about
The difference being that the ID is not included in the link, hence it redirects you to your own profile. You won't be able to get anything out of this, except getting redirected to your own profile, I'm afraid. But you can definitely report this so they fix the URL schemes.
I'd prefer to identify how to replicate it with my own profile lmaoo
RE: Facebook bug I found. - ETH - Jan 5, 2020
Maybe he made his profile as public or some other thing to get popularity
IDK because never used FB
checked famous cricketer profile
https://www.facebook.com/rahuldravid/
no issues
RE: Facebook bug I found. - MavenGradle - Jan 5, 2020
(Jan 5, 2020 05:36 PM)Mr. Robot Wrote: I'd prefer to identify how to replicate it with my own profile lmaoo
It's not the number that's causing it. Let's take James Bond for example:
https://www.facebook.com/007
(Strangely enough https://m.facebook.com/007 doesn't work which appears to be another bug altogether)
It's also not the inclusion of alphabetical characters:
https://www.facebook.com/alpa0
Nor the inability to add them as friends. Even the profile ID is correctly entered as an attribute (data-gt) in the HTML of the link, the only thing that's broken is the HREF attribute for some reason. Looking more into it.
Mobile version doesn't suffer from the problem:
https://m.facebook.com/karthic007
RE: Facebook bug I found. - Mr. Robot - Jan 5, 2020
(Jan 5, 2020 05:41 PM)MavenGradle Wrote: It's not the number that's causing it. Let's take James Bond for example:
https://www.facebook.com/007
(Strangely enough https://m.facebook.com/007 doesn't work which appears to be another bug altogether)
It's also not the inclusion of alphabetical characters:
https://www.facebook.com/alpa0
Nor the inability to add them as friends. Even the profile ID is correctly entered as an attribute (data-gt) in the HTML of the link, the only thing that's broken is the HREF attribute for some reason. Looking more into it.
Mobile version doesn't suffer from the problem:
https://m.facebook.com/karthic007
It's just kinda cool overall.
RE: Facebook bug I found. - gday mate - Jan 5, 2020
I think Karthic is just a hacker
RE: Facebook bug I found. - Mr. Robot - Jan 6, 2020
(Jan 5, 2020 08:31 PM)gday mate Wrote: I think Karthic is just a hacker
Oh definitely.
RE: Facebook bug I found. - Zero - Jan 6, 2020
(Jan 5, 2020 05:41 PM)MavenGradle Wrote: It's not the number that's causing it. Let's take James Bond for example:
https://www.facebook.com/007
(Strangely enough https://m.facebook.com/007 doesn't work which appears to be another bug altogether)
It's also not the inclusion of alphabetical characters:
https://www.facebook.com/alpa0
Nor the inability to add them as friends. Even the profile ID is correctly entered as an attribute (data-gt) in the HTML of the link, the only thing that's broken is the HREF attribute for some reason. Looking more into it.
Mobile version doesn't suffer from the problem:
https://m.facebook.com/karthic007
His link looks strange.
(Using one of the prfiles above)
Normal about link:
Code
https://www.facebook.com/alpa0/about?lst=100001341757053%3A100001446993791%3A1578302381His about link:
Code
https://www.facebook.com/profile.php?lst=100001341757053%3A100006337560157%3A1578302148&sk=aboutWhen I switch his ID with someone else's with the same link template it also directs me to my own profile, now the question is why does his link look like that?
RE: Facebook bug I found. - SIM-2362662 - Jan 6, 2020
From what I can see, FB has two ways of generating URL for the about page.
https://www.facebook.com/PROFILENAME/about?lst=RANDOMNRS
https://www.facebook.com/profile.php?id=PROFILEID&lst=RANDOMNRS&sk=about
In the first URL, the important information is the profile name and it appears inside the URL itself.
In the secound URL, FB is calling a PHP file called Profile.php which is using the Profile ID (received as a GET parameter) to generate the about page.
For the second type of URL I was able to find a single FB profile. https://www.facebook.com/profile.php?id=100045231173567
Idk if there are other link formats for the about page. I couldnt find any other
Now in the case of karthic007, facebook thinks that for some reason he should use the second type of URL but it fails to add the ID parameter
EDIT: if you acces his profile using a URL simmilar to the one used by Mark, the problem disappears https://www.facebook.com/profile.php?id=100006337560157
RE: Facebook bug I found. - rsx - Jan 6, 2020
Mark Zitsnturds should just hire you for Facebook security.
RE: Facebook bug I found. - Zero - Jan 6, 2020
(Jan 6, 2020 03:06 AM)♣ SoFt ♣ Wrote: From what I can see, FB has two ways of generating URL for the about page.
https://www.facebook.com/PROFILENAME/about?lst=RANDOMNRS
https://www.facebook.com/profile.php?id=PROFILEID&lst=RANDOMNRS&sk=about
In the first URL, the important information is the profile name and it appears inside the URL itself.
In the secound URL, FB is calling a PHP file called Profile.php which is using the Profile ID (received as a GET parameter) to generate the about page.
For the second type of URL I was able to find a single FB profile. https://www.facebook.com/profile.php?id=100045231173567
Idk if there are other link formats for the about page. I couldnt find any other
Now in the case of karthic007, facebook thinks that for some reason he should use the second type of URL but it fails to add the ID parameter
EDIT: if you acces his profile using a URL simmilar to the one used by Mark, the problem disappears https://www.facebook.com/profile.php?id=100006337560157
So when you reach his profile using his custom user /karthic007/ it's bugged but when you reach his profile using his ID it works correctly.
Just tried on my profile. When I'm at my profile page and I click my name it takes me to my profile again using my user (and not my ID)
When you reach his page from /karthic007/ and click his name it corrects you to his profile but with the ID link.
My guess is that he once had custom user name link and he disabled it (if that's an option) and facebook remembers it but doesn't work correctly.
Someone please test this.
Edit:
You can't delete username once set.
Once username is set it's the default for your profile. Idk why his default is still his ID while username fucks everything up.
Please help
RE: Facebook bug I found. - Ramsey - Jan 6, 2020
Very interesting man, nice catch
RE: Facebook bug I found. - MavenGradle - Jan 6, 2020
(Jan 6, 2020 03:06 AM)♣ SoFt ♣ Wrote: From what I can see, FB has two ways of generating URL for the about page.
https://www.facebook.com/PROFILENAME/about?lst=RANDOMNRS
https://www.facebook.com/profile.php?id=PROFILEID&lst=RANDOMNRS&sk=about
In the first URL, the important information is the profile name and it appears inside the URL itself.
In the secound URL, FB is calling a PHP file called Profile.php which is using the Profile ID (received as a GET parameter) to generate the about page.
For the second type of URL I was able to find a single FB profile. https://www.facebook.com/profile.php?id=100045231173567
Idk if there are other link formats for the about page. I couldnt find any other
Now in the case of karthic007, facebook thinks that for some reason he should use the second type of URL but it fails to add the ID parameter
EDIT: if you acces his profile using a URL simmilar to the one used by Mark, the problem disappears https://www.facebook.com/profile.php?id=100006337560157
That is all correct and already mentioned in a comment above.
(Jan 6, 2020 03:31 AM)Zero Wrote: So when you reach his profile using his custom user /karthic007/ it's bugged but when you reach his profile using his ID it works correctly.
Just tried on my profile. When I'm at my profile page and I click my name it takes me to my profile again using my user (and not my ID)
When you reach his page from /karthic007/ and click his name it corrects you to his profile but with the ID link.
My guess is that he once had custom user name link and he disabled it (if that's an option) and facebook remembers it but doesn't work correctly.
Someone please test this.
Edit:
You can't delete username once set.
Once username is set it's the default for your profile. Idk why his default is still his ID while username fucks everything up.
Please help
In order to change your profile URL you can do so in your settings:
https://www.facebook.com/settings?tab=account§ion=username
Please be aware that an older username will no longer be available.
Don't worry, you can change this multiple times (but not to a previous username, once you change it, the previous username is inaccessible to everyone).