That's been on tracksomebody.com forever. See http://tracksomebody.com/?p=173
William Reyor @wreyor > On Apr 3, 2014, at 12:07 PM, illwill <illw...@illmob.org> wrote: > > did you know the second section of the filename is the users actual > facebook user id? > 6549_*16544614736*_444444875_n.jpg > https://www.facebook.com/profile.php?id=*16544614736 > > * > -illwill > illw...@illmob.org > http://illmob.org > >> On 4/1/2014 5:59 AM, Bipin Gautam wrote: >> Hi List, >> >> I felt like writing / pointing this minor issue, as it as its "Facebook" ... >> >> This issue is due to the way facebook pictures are stored in CDN >> without authentication mechanism, during accessing it. (which would be >> way technically complicated to implement it) >> >> Also, it is a Facebook feature that... if you have full path of an >> image, you can pass it to anyone over the internet which they can >> access it directly (and the facebook user should not have unrealistic >> expectation to privacy. Hence, if someone can access an image they can >> save/email it to others, anyway.) >> >> >> POC: >> >> ( Please TEST it in a real profile, real world example and it should >> work. I obviously changed the URL, POC below, to gibberish >> "6549_16544614736_444444875_n.jpg" ) >> >> STEPS: >> >> You could try this by : >> >> - changing your own facebook profile picture viewable to "only me", >> then bookmark your own Facebook profile and logout and clear cache. >> >> - or then try different browser with your own profile from bookmark, >> without logging in to facebook! >> >> - or pass your FB profile to a friend, with the following instruction. >> >> ___ >> >> - then, in your browser, "Right click the Facebook profile image" that >> you want to access in full resolution (that have ACL as access to >> "only me" or "friends" ) > click "Copy image location" > paste it in >> notepad >> >> sample url you will get (this link below is broken) >> >> :[1] >> https://fbcdn-profile-a.akamaihd.net/hprofile-ak-frc3/t1.0-1/c0.18.160.160/p160x160/6549_16544614736_444444875_n.jpg >> >> >> to remove from [1]: "/c0.18.160.160/p160x160" (part; in other cases, >> the url structure may be different, you just have to find and remove >> this middle part...) >> >> final modified url from above, which you can access the profile >> picture in full resolution via your browser : >> >> https://fbcdn-profile-a.akamaihd.net/hprofile-ak-frc3/t1.0-1/6549_16544614736_444444875_n.jpg >> >> >> Respectfully, >> -bipin >> >> >> _______________________________________________ >> Sent through the Full Disclosure mailing list >> http://nmap.org/mailman/listinfo/fulldisclosure >> Web Archives & RSS: http://seclists.org/fulldisclosure/ > > > _______________________________________________ > Sent through the Full Disclosure mailing list > http://nmap.org/mailman/listinfo/fulldisclosure > Web Archives & RSS: http://seclists.org/fulldisclosure/ _______________________________________________ Sent through the Full Disclosure mailing list http://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
