CrazyDavinci's Blog | Social Networking, Programming, Security , Web Development

---

For those who want to add an html iframe layout to their page, overlayed, covering the whole page, you can use this simple script. You can have a defaced-like page using your own site as the content of the page. Whenever you are able to insert an xss on certain site, you can also use this to deface the page using your own html page. I’m using html frameset to change the document content.

Below is the sample of this kind of javascript trick :
http://www.friendster.com/viewphotos.php?uid=108625641&a=351925224
Notice that on the xssed page above i’m using html frameset tag with frame src to blog crazydavinci.net. You can try to view the source after the page fully loaded.

Here is the javascript source code : Read more…

---

Creating Facebook Like Box for your Page/Group is realy easy as facebook already provides the generator for us. On Facebook Like Box Generator, we only have to input certain information of our facebook page, then it will generate us the code. Unfortunately, we cant add external css using this plugin, instead, i prefer to use the old fanbox widget to make the logo looks animated. I dont know how long this trick would last as i think this trick should not be allowed by facebook.

first, you have to create a file on your host, contains this css code :
Read more…

---

Recently in the year of 2010, the previous trick of view friendster private photos is not available anymore as friendster has added authoritation code as a parameter on their request page. Now we need a little more complicated way to get access to friendster private photos.

We have to make the target see a page with hidden iframe containing our evil script to make it works. Actually, it’s merely an automated form to get invited by target to see their private photos. When the target see the page, they wont realize that they actually have invited us to see their private photos. OK, lets start, kindly follow this step by step tutorial :
1. Go to target profile
2. Copy paste this javascript to the address bar :
Read more…

---

The word private here means that facebook photos/album belong to those profile that are not listed on our friendslist but the privacy setting is set to everyone and the photos tab is hidden. Using this trick below we can reveal the album links. OK, lets try it using my profile as an example :

- Login your facebook account
- Go to this profile
(make sure it’s not on your friendlist)
  as you can see there’s no photos tab available to click
- Put this code on the addressbar, then press enter :
Read more…