Locked Using Facebook Notes to DDoS any website

[sQuo]

This is the hidden content, please

• Sign In
• or
• Sign Up

 

Facebook Notes allows users to include tags. Whenever a tag is used, Facebook crawls the image from the external server and caches it. Facebook will only cache the image once however using random get parameters the cache can be by-passed and the feature can be abused to cause a huge HTTP GET flood.

 

Steps to re-create the bug as reported to Facebook Bug Bounty on March 03, 2014.

Step 1. Create a list of unique img tags as one tag is crawled only once

 

This is the hidden content, please

• Sign In
• or
• Sign Up

 

Step 2. Use m.facebook.com to create the notes. It silently truncates the notes to a fixed length.

Step 3. Create several notes from the same user or different user. Each note is now responsible for 1000+ http request.

Step 4. View all the notes at the same time. The target server is observed to have massive http get flood. Thousands of get request are sent to a single server in a couple of seconds. Total number of facebook servers accessing in parallel is 100+.

 

 

Initial Response: Bug was denied as they misinterpreted the bug would only cause a 404 request and is not capable of causing high impact.

 

 

This is the hidden content, please

• Sign In
• or
• Sign Up

and source

[nikes]

Re: Using Facebook Notes to DDoS any website

 

How to fast create list with unique tags?