Collected research
Story of a weird vulnerability I found on Facebook
A Facebook legal subdomain answered 403 for a directory until many simultaneous requests were sent, at which point it served a full directory listing holding internal XLSX files. Flooding a protected path with concurrent requests can race a server into releasing content its access check should have blocked.
Record
- Researcher
- Amine Aboud
- Published by
- Medium
- Date
- Topic
- Other
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Amine Aboud, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .