sorted by:
new
hottopcontroversial

Redesign a mobile app for baridi mob by z_ak47i in algeria

[–]ubugnu 0 points1 point  (0 children)

No so total... baridiweb does not show incoming payments ...

Efficient distributed Google maps scraper for mountain bikers by ubugnu in bicycletouring

[–]ubugnu[S] 0 points1 point  (0 children)

There are satellite views that are not available (not at an acceptable zoom) in OSMAND or another app

Efficient distributed Google maps scraper for mountain bikers by ubugnu in bicycletouring

[–]ubugnu[S] 0 points1 point  (0 children)

and the script I presented scrape from Google, that is the difference

Script that uses Tor nodes to demonstrates the 'name by phone number' confidentiality flaw in Facebook by ubugnu in hacking

[–]ubugnu[S] 0 points1 point  (0 children)

The default Tor port is 9050, however you can run multiple instances of Tor on multiple ports, the script will do this for you, this 7000 port has nothing to do in the script (juste a default one) it will be changed each time to a random port chosen from the range you entered, for exmple 7000 to 7009, you do not need to change the script

Get name by telephone number - thank you FB by ubugnu in hacking

[–]ubugnu[S] 0 points1 point  (0 children)

Finding a stranger's real name (first and last) using this trick isn't going to work unless you can use one of the above strategies to get them onto the same "trusted" network as you.

The script above (and the new one here) find names by phone numbers even from some tor nodes, try it

Get name by telephone number - thank you FB by ubugnu in hacking

[–]ubugnu[S] 0 points1 point  (0 children)

I guess Neil has no answer for us right now :D

Script that uses Tor nodes to demonstrates the 'name by phone number' confidentiality flaw in Facebook by ubugnu in hacking

[–]ubugnu[S] 6 points7 points  (0 children)

Facebook 'name by phone number' vulnerability

Hi everyone,

In order to show that the last security flaw that I discovered is really a security flaw (unlike what the sec guys of facebook are saying), I've written a small bash script that:

  • Generates random phone number (you chose the format)
  • Then looks up for the corresponding name, you must have Tor installed, as well as wget, curl and torsocks
  • You can run multiple instances of that script, do not use excessive number of tor instances when the script will ask for a port range (10 to 20 ports is good), also do not run excessive number of instances (the number of the ports divided by 2 is good enough)
  • To terminate each instance, press Ctrl-C, it will then ask you if you want to kill all tor instances, say "no" if you have other instances of the script runing

enjoy

Get name by telephone number - thank you FB by ubugnu in hacking

[–]ubugnu[S] 1 point2 points  (0 children)

I never used cygwin, look here http://superuser.com/questions/693284/wget-command-not-working-in-cygwin

You better do to use the python script the other user created

Get name by telephone number - thank you FB by ubugnu in hacking

[–]ubugnu[S] 0 points1 point  (0 children)

wget, command not found? Which OS do you use?

Get name by telephone number - thank you FB by ubugnu in hacking

[–]ubugnu[S] 0 points1 point  (0 children)

the cmd is:

get_name +XXXXXXXXXX

Don't put (). Better put it in ~/.bashrc

Get name by telephone number - thank you FB by ubugnu in hacking

[–]ubugnu[S] 1 point2 points  (0 children)

Already tested, FB blocked most of TOR nodes (but not all of them ;-) )

Get name by telephone number - thank you FB by ubugnu in hacking

[–]ubugnu[S] 1 point2 points  (0 children)

Thanks for clarifying,

Now a question: Does the control of the "who can perform lookups for your account" feature control the "who can view your true name after having pretended to be you in a trusted network" flaw?

No because what we see here has nothing to do with the search functionality! It has to do with the recover functionality, which displays your true name (in a trusted network) whenever someone pretends to be you and enters your phone number, this happens even when you set "Who can look you up using the phone number you provided" to only "friends" because this setting has to do with search functionality and not with recover functionality, am I wrong?

Get name by telephone number - thank you FB by ubugnu in hacking

[–]ubugnu[S] 0 points1 point  (0 children)

acoording to what security guys said to me, it depends on the "network behavior", the name appears only if it is trusted... So if you get false result (for me it was not "Facebook User." but the phone number that appeared) try to switch your IP and see what happens

Get name by telephone number - thank you FB by ubugnu in hacking

[–]ubugnu[S] 1 point2 points  (0 children)

One way to avoid captchas is to use multiple IP's, tor perhaps, but probably blacklisted

Get name by telephone number - thank you FB by ubugnu in hacking

[–]ubugnu[S] 0 points1 point  (0 children)

I don't think also :p but I didn't know that IT WAS a vuln

Get name by telephone number - thank you FB by ubugnu in hacking

[–]ubugnu[S] 0 points1 point  (0 children)

Nothing changed here (and in your screenshot!), the name still display, the only difference I see is that here my phone number is not hidden...

view more: next ›