Collected research
Stealing Messenger.com Login Nonces
messenger.com signs in a logged-in Facebook user through an iframe endpoint that redirects a one-time login nonce to a redirect_uri. Pointing that parameter at a beta subdomain and exploiting a fragment that survives the 302 leaked the nonce to an attacker page; the nonce minted a messenger.com session whose cookies also worked on facebook.com, so the whole account fell.
Record
- Published by
- stephensclafani.com
- Topic
- Other
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of stephensclafani.com, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .