Collected research
Bruteforcing/Abusing search functions with no-rate checks to collect data
Me and Facebook (A C4utionary Tale)
A Facebook privacy setting left phone numbers searchable by default, and the mobile endpoint m.facebook.com/search applied no rate limit. The author generated number ranges in a spreadsheet and ran a macro that harvested name-to-number pairs for four days without being blocked, then published the mail thread in which Facebook dismissed the report.
Record
- Document
- Me and Facebook (A C4utionary Tale)
- Researcher
- suriya
- Published by
- Suriya's Blog
- Date
- Topic
- Other
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of suriya, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .