CrazyDavinci's Blog | Social Networking, Programming, Security , Web Development

---

Through this post, i’d like to say sorry to anyone who are victims of the autopost spamming code on facebook. It wasnt fully me who did all the spamming activities. But i accept that i’m also guilty of it, i’m part of it and i feel so sorry. I’ve been doing this since around march 20-21. I was using http://bit.ly/hRqjAW to shorten the url at that time, until it’s blocked for suspicious activity. Now, they will give a warning message before people can see the real url. Last time i used http://y.ahoo.it/gajeBA but i have already removed the autopost code inside.

Let me tell you the chronology how the code could spread everywhere like now. It was first used by be me only for promoting this blog, getting more traffics, just for fun indeed. You can see this image, it shows how the alexa rank increased rapidly in 1-2 days
Read more…

---

tweak your facebook profile, javascript and css code for facebook, facebook javascript collection, CSS Injection, Facebook Welcome Alert, Blinking Facebook Logo, Add MP3 Background Music to Facebook, Change Facebook Profile Picture With GIF Animated Picture, Floating Visitor Picture On The Right Side, Facebook Visitor Log, facebook javascript codesHere are some simple javascript codes you can use to tweak your facebook profile. They are actually the codes from my /facebook/fb_layout.js . Please note that to use these codes you have to insert an XSS first to your profile, kindly read an article on this blog about Facebook XSS onClick via iPhone. You can host your own external javascript file, so you can freely add more modification to your profile.

Here are list of the javascript codes inside the fb_layout.js file :
Read more…

---

What has happened out there really pushes me to share this out. I call this an Autopost Spamming using Facebook Mobile XSS. I dont care anymore if this one will be filtered, the faster they fix it, the better. People dont seem to care how hard i tried to hide this code from facebook team. frankly, i also use this to post spam with link to this blog, but it only affects indonesian ip + with a custom interval. So people outside indonesia wont be able to see this. Too bad it’s now spread like a worm everywhere wide open without any source code protection.

Nevermind, it’s no use to complain about what has happened anyway. Let’s talk about this in details. This is about how to make an autopost status update to people’s facebook profile. This method uses XSS vulnerability of prompt_feed.php from m.facebook.com. When people see our page with this evil code, they will automatically post a status update with any message we want.

Below is the iframe HTML source code :
Read more…

---

This is for fun only, as many people asked me about how to tweak a facebook profile with javascript, here i’m gonna share some javascript tricks to make your page looks a little bit more attractive. Below is a sample javascript for Blinking Facebook Logo. Please note that you need an XSS activated on your profile to load this javascript, you can find it on this blog, about Facebook XSS onClick via iPhone

Here is the code :
Read more…