tagged

---

This is merely an old trick, I’m sure most of you have already known about this one. Do you remember the post before this about Custom Tag on Facebook Comment? Using that one, we can tag anyone using any word as the anchor text, not using facebook username like the default one, even without using any Facebook application. Since Facebook has patched the method about two days ago, now we must use apps to do the same trick.

Unfortunately, when you are using this trick, the post you have created wont show on the person being tagged. but, you can still tag anyone even when they’re not one of your friends. Interesting, isn’t it? OK, to make this easier to understand kindly try it by clicking the “Test” link below : Read more…

---

Here we will discuss about Facebook XSS again, the last XSS method using iPhone prompt_feed.php has been filtered, they have patched the system, but not all the hole, they still left us chance to put another XSS onClick using the same app.

You can still insert the XSS via iPhone app, via Android, via BlackBerry, via Facebook Exporter for iPhoto, via Facebook Toolbar for Firefox or via Windows Phone and perhaps some other apps. The instruction is similar to the previous method on iPhone XSS, but with a little change. Kindly follow these instruction to get your own facebook layout : Read more…

---

Searching for XSS hole on social networking websites is really fun indeed. It feels like you have your own satisfaction whenever you find it by yourself. the XSS vulnerability on Tagged, Multiply, Friendster or even Facebook have been posted here before and some has not been patched.. lolz..

About a month a go, when i was too busy with my daily activites on the real life, i didnt realize that one of our mods on Forum Balikita named H4x0r-x0x found one again on twitter, i’m amazed, good job dude. If i’m not mistaken the vulnerability left on twitter oauth application module, especially on application name

Read more…

---

Status : Active

Tagged is the 3rd largest social network in the US, and has over 80 million members worldwide. Lately i have also found a hole to insert XSS vector on their profile page. You can see it live on this page

Screenshot:

Read more…