Share to Keep This Service Running

Hello from Kunal Vohra to all the App readers. Its been so nice for me to see you here.

I launched this app "H2K: The Hackers Street" just 2 months back and got a tremendous response from the audience around the globe. I expect a small contribution from all of you that give this app rating 5 out of 5 . It can be done by the most easiest way i.e. in left side bar at the bpttom there is option of review us just tap on it and support us.

So that in the search of play store this app would come on top searches. This is the small effort of yours can give someone valuable information daily. We are working hard to keep this service running and wants to keep on serving you.

You can directly Review from here

Review here 

"Your small effort is our acceptance"

Regards

Kunal Vohra

Director @ H2K

FREECHARGE : Bugs Found

Its midnight and your missing someone.. You make a call and the balance turns out to be nil…If it was years ago you would suffer and go to sleep but damn its 2014!! And we have freecharge.. Want recharge , top ups , special recharge , packs ->  not to forget bonanza coupons, movie tickets and what not !!  We got a one stop Stage Freecharge . We find it perfect. But do you know it has a bug ?? An issue we don’t know about, is it charging you or the company ?

Who knows.. Well we know who do .. Actually even you know who do... KUNAL VOHRA… Your admin your friend or your own mastermind solving your  issues by taking his time out..

It wasn’t long when Kunal found the bug and mailed it to the team and was responded in a lightning speed.. The issue is being taken care of and will be fixed soon ..

Curious what was it all about …?

Don’t worry you’re our dearest followers and you’ll be the first to know.. But not now.. When the bug will be resolved.. :P. Below we are sharing the mail which we received as confirmation.

FreeCharge e-mail ID has been removed

For now you can congratulate and thank Kunal for fixing the holes of the system.. Just go to the feedback section of your app and say what you feel . I’m sure you are liking our efforts to make your cyber secure ..

Don’t tell me you still don’t have our app… ?? Come on guys get it soon.. You don’t know what you’re missing .. We are providing you the safest and smartest of all.. an intelligent app for intelligent people enhancing their intelligence..

Coz learning don’t have a full stop ..

M attaching a link to the app, Your admin’s email as well as his facebook profile.. Feel free to contact us..

 "Saumya ",  Author @H2K

( findsaumyahere@gmail.com)

!! Connect with Admin !!

BBM: 7F72A48D

 Kunal Vohra ( vohra.kunal003@gmail.com)
Download Our Official Android App 

"The Hackers Street"

For Daily Updates 

How to find the primary email address of any Facebook user. Privacy bug squashed

By "Kunal Vohra", Director@H2K

When you sign-up for a social network you expect it to keep its privacy promises. For instance, if you tell the social network not to reveal your email address to any other members, you expect it to remain private.
But a security researcher has detailed how he found a way to find out *any* Facebook user’s primary email address, regardless of their privacy settings, by exploiting a weakness on the social network.

Security researcher Stephen Sclafani described how he stumbled across the privacy hole while ambling through some old mailing lists.

One of the messages he came across contained a Facebook invitation reminder email, seemingly sent by accident when the user made the mistake of following Facebook’s advice to invite their entire contacts list to the social network:

What is interesting is the clickable URL at the bottom of the invite message?

When Sclafani clicked on the link, he was taken to a Facebook sign up page already filled in with the mailing list’s address and the name of the person who used the link to sign up for an account:

Sclafani took a closer look at the link, and discovered something interesting:

The link contained two parameters: “re” and “mid”:

http://www.facebook.com/r.php?​re=245bf2da75118af20d917bdd34babddb​&mid=59b63aG5af3107aba69G0G46

Changing the re parameter did nothing; however, changing parts of the mid parameter resulted in other addresses being displayed. Taking a closer at the parameter, its value was actually a string of values with “G” acting as a delimiter:

59b63a G 5af3107aba69 G 0 G 46

Only the second value was important. The value was an ID associated with the address that the invitation was sent to in hex. A Facebook user’s numerical ID could be put as this value and their primary email address would be displayed. A user’s numerical ID is considered public information and can be obtained from the source of their profile or through the Graph API.

In other words, if you replaced that part of the “mid” parameter with the hex value of a different Facebook users’ numerical profile ID, you would be shown their primary email address.

Facebook profile IDs aren’t secret. You can get them easily via sites like Find My Facebook ID or from Facebook’s own profile directory.

Facebook Directory

Indeed, it’s possible to imagine how someone interested in grabbing the email address of *every* *single* Facebook user could write a script to trawl the profile directory, turn each ID into hex, and then use the modified URL to ultimately scoop up each address.

It’s easy to imagine how a database of such email addresses could be abused.

Fortunately, Stephen Sclafani has some ethics. And rather than try to make a big splash by publishing details of Facebook’s embarrassing flaw, he chose to disclose it responsibly to the social network. Sclafani says that Facebook fixed the flaw within 24 hours, and rewarded him $3,500 for his efforts under their Bug Bounty program.

Facebook certainly appear to be grateful that he acted in the way he did, telling me: 

"We appreciate the security researcher's effort to report this issue to our White Hat Program. We worked with the researcher to evaluate the scope of the issue and fix this bug quickly. We have no evidence that it was exploited maliciously."

"We have provided a bounty to the researcher to thank him for his contribution to Facebook security."

Well done to Sclafani for finding the flaw and acting responsibly. And – although it would have been better if the privacy loophole hadn’t been there in the first place – well done to Facebook for fixing it so quickly after being informed.

Still Having Problem..!!! Connect with Admin 

Kunal Vohra Download Our Official Android App & Get Free Internet

"The Hackers Street"

For Daily Updates 

Hacking Facebook Account with just a text message

Admin "Kunal Vohra"

Can you ever imagine that a single text message is enough to hack any Facebook account without user interaction or without using any other malicious stuff like Trojans, phishing, keylogger etc. ?

Today we are going to explain you that how a UK based Security Researcher, "fin1te" is able to hack any Facebook account within a minute by doing one SMS.

Because 90% of us are Facebook user too, so we know that there is an option of linking your mobile number with your account, which allows you to receive Facebook account updates via SMS directly to your mobile and also you can login into your account using that linked number rather than your email address or username.

According to hacker, the loophole was in phone number linking process, or in technical terms, at file /ajax/settings/mobile/confirm_phone.php

This particular webpage works in background when user submit his phone number and verification code, sent by Facebook to mobile. That submission form having two main parameters, one for verification code, and second is profile_id, which is the account to link the number to.

As attacker, follow these steps to execute hack: 

1. Change value of profile_id to the Victim's profile_id value by tampering the parameters.
2. Send the letter F to 32665, which is Facebook’s SMS shortcode in the UK. You will receive an 8 character verification code back.
   
3. Enter that code in the box or as confirmation_code parameter value and Submit the form.

Facebook will accept that confirmation code and attacker's mobile number will be linked to victim's Facebook profile.

In next step hacker just need to go to Forgot password option and initiate the password reset request against of victim's account.

Attacker now can get password recovery code to his own mobile number which is linked to victim's account using above steps. Enter the code and Reset the password!

Facebook no longer accepting the profile_id parameter from the user end after receiving the bug report from the hacker.

In return, Facebook paying $20,000 to fin1te as Bug Bounty.

Still Having Problem..!!! Connect with Admin Kunal Vohra Download Our Official Android App  "The Hackers Street" For Daily Updates