get authorization code for facebook hacking

Download File https://t.co/jSrK94GzCl


About 2 weeks ago my account was hacked by someone, and they started using it to sell things and have made me the admin of sketchy pages. They changed the email and phone number associated with my account, and enabled two factor authentication under their phone number. I have been able to change the email back to mine, and have changed my password, but to fully access my account I need to enter a code from the Code Generator. The only way to access this code is either from in the account already, or from a third party app- which he hooked up to his phone number. There is literally no way for me to get this code, and I have no idea what to do. I have tried to contact Facebook 3 times through submitting forms and I have had no response. I am so frustrated with their lack of customer support. Any advice on how to get past the code generator or how to actually talk to someone live at facebook?


Something I can't wrap my head around.As I understand the authorization code flow is supposed to be more secured than the implicit flow, because the tokens are not directly sent to the client from the authorization server, but rather retrieved by your backend.So the flow is basically:


In this flow all the tutorials describe the authorization code as useless to the hacker, why is that? Can't a hacker use Postman or some other client and access your (public) API directly, make it go through step 3 and thus retrieve the tokens just the same?


Authorization Code aka auth code is used publicly so that the client can establish a secure back channel between him and the authorization server so that he can exchange it with the access token without the use of a browser.





Check to see if an RP will let a user redeem the same authorization code multiple times. Each code should only be good for a single OAuth session, reusing a code that has already been redeemed should result in an error.


This attack rarely works, but may be worth doing with more obscure IDPs. The initial request from an RP to an IDP in Step 2. has an optional parameter response_type. This attack attempts to convert the authorization code grant to an implicit grant, which skips the stage involving an authorization Code and immediately returns an Access Token.


But Whitton found that Facebook's authorization code could be tweaked to work with other users accounts as well. This means a hacker could just change the password and gain complete control over the account, Whitton explained in a blog post.


You can also access the above recovery route through any browser, on desktop or mobile. Go to m.facebook.com and log into your account using your mobile number, email, or username and password. When prompted for the login code, click 
Having trouble? > I don't have my phone > Continue
.


Heather Campbell's Facebook account was taken over by a hacker on Sunday, calling herself Lily Collins. She was not able to access her account, so she decided to check her email. Her email shows the hacker requested an authorization code, changed the password, and even tried to upload an identification photo.


The client MUST NOT use the authorization code more than once. If an authorization code is used more than once, the authorization server MUST deny the request and SHOULD revoke (when possible) all tokens previously issued based on that authorization code.


If the resource owner denies the access request or if therequest fails for reasons other than a missing or invalid redirection URI, the authorization server informs the client by adding the following parameters to the query component of the redirection URI using the "application/x-www-form- urlencoded" format


A CSRF attack against the client's redirection URI allows an attacker to inject their own authorization code or access token, which can result in the client using

Get Authorization Code For Facebook Hacking

LifiYcopu