InternetMarketingWare

One of the most frequently asked queries on the Internet is "How to Hack Facebook?" Although many of us want to hack someone's Facebook profile however, it's not an easy job for those who are new to the field.

There are many websites that offer tools and methods for hacking Facebook however, many are fraudulent. Please beware of hacking tools The majority of these tools are actually able to steal your Facebook account instead of the user they are targeting.

If someone is able to hack facebook account this indicates that they have an account takeover security flaw that affects FB. The vulnerability can be sold illegally to the black market for millions of dollars. If they disclose the vulnerability via the bug bounty program, they could be immediately famous and receive hundreds of dollars in reward.

What do they gain by posting their methods online for free? What do they get for developing a software or tool free of charge?

So the free hacking tools you find on the Internet are entirely fake. Do not waste your time searching for such hack tools.

If all Facebook Account Hacking methods need technical know-how, then how come a large number of people have their accounts compromised?

There are several methods, such as Phishing that can be done easily using the resources available on the Internet. You can find out more information about such Facebook hacking methods.

A burglar might not use your door to gain access to your home. The same way hackers might not require your password every moment to access your Facebook account. Actually, most of the times, a password will not be required for hackers to gain access to your Facebook account.

Hackers don't use tricks to make it look easy. Hackers accomplish this in a way that is difficult. They do their best to find a Facebook security vulnerability. Hacking an account isn't difficult once they have a vulnerability.

We are going to cover some Facebook hacking methods discovered by the bug bounty program that may have allowed anyone to hack into any FB account WITHOUT PASSWORD. The methods described were rescinded by the Facebook team. However, you'll be able to be able to understand how hackers could hack an account without knowing the actual password. If you would like to learn more about the process go to the link for each of the methods.

You can hack any Facebook account by sending an SMS message sent from a mobile phone

This vulnerability allows an attacker to easily hack facebook within several seconds. It is all you need is an active mobile number. This vulnerability was found in the endpoint for confirm mobile numbers that allows users to confirm their mobile number. Execution of this vulnerability is very simple. It is recommended to send a message in the following format.

Brute Force Attack: Hack any Facebook account

The issue was discovered at the reset password endpoint on Facebook. This option allows users to reset their password by entering their phone number or email address.

A six-digit code will be given to the user to verify that the request was made by the concerned person. After receiving the verification code, the user can reset their password.

It is not possible to try multiple combinations of this code over a period of more than 10-12 attempts because the FB server will temporarily block the account.

Hacking any Facebook account using Brute Force Attack

Initially, they rejected the issue by saying they were unable to replicate the issue. After a couple of weeks, the vulnerability was accepted and the patch was made available when the security team was able to reproduce it.

Hacking any Facebook account using an unauthorized Cross Site Request Forgery Attack

In order to complete the hacking attack for the attack to be successful, the victim must click a link on a website (in a browser that allows them to log into Facebook).

This issue was discovered in the Facebook email address endpoint. A user can claim an email address simply by claiming it. However, no server-side validation was performed to determine who is making the request. This allows any FB account to claim an email.

You must obtain the email claim URL before making the CSRF attack page. To achieve this, you must change your email address so that it is not already connected to an FB account. If the email belongs to you, you will be asked to verify your identity.

Hack any Facebook account with CSRF

This hacking technique is similar to the previous one, where the victim has to visit the website of the attacker for the attack to work.

The vulnerability was found in the endpoint for importers of contacts. If a user allows Facebook to access Microsoft Outlook's contact book, an email request to FB server is made that in turn adds the email address to the user's Facebook account.

You can accomplish this by using the Find contacts option on the attacker's Facebook account. You should then look for the following request sent to the Facebook server (use intercepting proxy like burp)

Hack any Facebook user's photo/video Albums

This vulnerability was found by me in 2015 that allowed me to take down all albums on facebook account. Albums that contain thousands of photos and videos can be wiped immediately without having to contact its owner.

Graph API is the main method of communication between the server and native/third party apps. Albums node at Graph API endpoint was susceptible to unsecure object references, so it allowed me issue any album ID of the user to allow deletion.