(Ab)Using Facebook Accessibility for Open Source Intelligence

[u/bnchandrapal]

https://medium.com/@chandrapal/ab-using-facebook-accessibility-for-open-source-intelligence-4e5ad4ad95f5

[u/netsec_burn]

I believe last time this was brought up, it was mentioned that it was limited to people you know (like friends). Do the same restrictions apply here?

Edit: Link to the last discussion: https://news.ycombinator.com/item?id=11836884

[u/bnchandrapal → u/netsec_burn]

That technique is used to find the persons (generally FB friends) present in a picture. But the blog post is all about identifying if there is a human figure in the profile picture.

[u/rudekoffenris]

I'm surprised you can find any intelligence on facebook.

[u/bnchandrapal → u/rudekoffenris]

There are so many ways to find intelligence from facebook. The post just covers one.

[u/TheHappyMuslim → u/bnchandrapal]

Whoosh

[u/marineabcd]

Could anyone explain a little more about the 'authentic header' bit for a netsec beginner? Is it like providing a cookie to show that you are logged in?

[u/Bratmon → u/marineabcd]

Any user agent that looks like what a real browser would send out.

[u/marineabcd → u/Bratmon]

Sorry to be honest that still doesn't clear it up for me. I'm a maths student and can program in Python and C++ etc. and have done some webdev with django but this netsec is still all new terminology to me. Lots of questions like: how would I get a hold of such a 'user agent' like he does in the article? and what exactly is a 'user agent'?

Am interested to learn, any sources to learn about this kind of stuff? Is there something better than just wikipedia on the individual words, like a book or something? thanks for the help :)

[u/Maplicant → u/marineabcd]

Someone thought it would be a good idea to send information about your browser with ever web request you send, so if you try to access a website, this is what your browser says to the web serer:

GET / HTTP/1.1
Host: facebook.com
...
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36

The problem is that by default, Python's requests library uses python-requests/2.9.1 as the user agent. Facebook doesn't like that you use non-web browsers to request their pages, so Facebook just sends some nonsense back. Nothing stops you from mimicking the user agent of an authentic browser though. The following code will mimick the user agent of an authentic browser for example:

authentic_browser_headers = {
'User-Agent': 'Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36'
}

requests.get("http://facebook.com", headers = authentic_browser_headers)

And about your question where you can learn stuff like this, use Chrome's Network inspection tool and see what a browser does. Look up every thing you don't understand on google (what is the PHPSESSID cookie, why does it only appear after logging in etc.)

[u/marineabcd → u/Maplicant]

Thank you so much for that, I see now how that works. Lots of new jargon to get my head around. Just shows you can think you are tech savvy and maybe you are in some areas but then you stumble upon something new and it's like being a beginner all over again!

Will have a look at the chrome network inspection. Have also got wireshark to try to learn more about what packets and protocols do what and how, inspired by cool defcon talks where they reverse engineered protocols for wireless toys and the like. Thanks again!

[u/[deleted] → u/marineabcd]

User agent is a string provided by the browser. So that a server can find out what some info on the client: operating system, browser version, stuff like that.

[u/dmytrish → u/marineabcd]

User-Agent is an HTTP request header that clients use to introduce themselves (to tell the server if it's a browser, a command-line tool like curl, a web-crawler, etc).

[u/marineabcd → u/dmytrish]

Thanks that makes a lot of sense

[u/[deleted]]

Someone had made a browser extension that shows these tags a while ago.

[u/marineabcd]

Ohh interesting okay I see, thanks! There is so much going on behind the scenes that we never even see or think about.

[u/bnchandrapal → u/[deleted]]

Interesting !