Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Today, I received a mail from fb saying that two of my friends have mentioned me in a comment. When I opened fb to see that comment, it was filled with random names (which obviously were their friends/friend-of-friends) and mine was one of them.

And the topic of the comment was an advertisement proclaiming a hack to reveal any fb user's username and password. It then gave a bunch of instructions asking you to visit the user's page, opening the browser web-console and pasting some code there. It claimed that doing so would reveal the said user's fb username and password (which is obviously absurd).

fb username of this topic poster was Beauty.20000. But whats going on here? Is this an attempt at social engineering (as I suspect) ?

share|improve this question
Its a hack that you do and when you do it it tags all your friends –  Sahil May 26 at 12:36
It's definitely some sort of social-engineering attack, yes. You're doing XSS to yourself... We'd need to see the code to know exactly what it would do, but I can guess that 1) It can likely trivially retrieve your username (not a terribly big deal, on its own), and 2) no, it's unlikely to be able to just grab your password, so long as you don't enter it again. It's possible that the given code has methods to persist over changes in the Facebook JavaScript code, so a simple logout may not be safe (you'd need to clear the browser cache). –  Clockwork-Muse May 26 at 12:41
@Clockwork-Muse - I haven't done any XSS to myself, but looks like two of my friends have. Here is the code link which the poster provided: textuploader.com/rwf2/raw –  Prahlad Yeri May 26 at 12:44
Yeah, somebody's up to something, that's obfuscated. I don't know enough to proceed easily myself, curious if somebody else here will do the honors. –  Clockwork-Muse May 26 at 12:47
forgot 100000821542260 @PrahladYeri : obfuscation helps a lot in SE! But here you are right, if the user does follow the instructions, he is dumb enough to do anything he's told... PS: see the number of followers/likes on the 100000066374374 profile. Haha. There goes the answer i guess. –  Neckxt May 26 at 13:35
show 4 more comments

1 Answer 1

it certainly is. you might want to google "Phishing".

edit: i'm curious, what code did they ask to paste in the web console?

share|improve this answer
Updated the link to code in the comments. –  Prahlad Yeri May 26 at 12:45
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.