185 - Facebook Account Takeovers and a vBulletin RCE [Bug Bounty Podcast]

Is it possible to escalate a self-XSS into an account takeover? Perhaps, we take a look at some potential options by abusing single-sign on. Then we take a look at a few Facebook/Meta authentication issues, and a deserialization trick to increase the usable classes in PHP.

Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/185.html

[00:00:00] Introduction
[00:00:21] Single-Sign On Gadgets: Escalate (Self-)XSS to Account Takeover
[00:11:11] Account takeover of Facebook/Oculus accounts due to First-Party access_token stealing
[00:14:00] …

abusing account accounts account takeover authentication bounty bug bug bounty deserialization facebook gadgets introduction meta options party php podcast rce sign single stealing takeover takeovers vbulletin xss