# I figured out a way to hack any of Facebook’s 2 billion accounts, and they paid me a $15,000 bounty for it

Missing rate limiting on beta.facebook.com password-reset code endpoint allowed brute-forcing the 6-digit code to reset any user's password and take over the account.

- Payout: $15,000
- Severity: critical
- Program: Meta / Facebook
- Credited: Anand Prakash
- Disclosed: 2018-02-09
- Write-up quality: 6/10
- Original: https://medium.freecodecamp.org/responsible-disclosure-how-i-could-have-hacked-all-facebook-accounts-f47c0252ae4d
- Library page: https://bugbountylibrary.com/r/blog%3Amedium-freecodecamp-org-responsible-disclosure-how-i-could-have-hacked-all-facebook-accounts-f47c0252ae4d
- Tags: domain:web impact:ato kind:bounty platform:blog sev:critical tech:rest technique:legacy-endpoint technique:recon vuln:account-takeover vuln:auth-bypass vuln:business-logic

**Target:** Password reset / account recovery endpoint (POST /recover/as/code/)
**Root cause:** The forgot-password code verification endpoint on beta.facebook.com and mbasic.beta.facebook.com lacked rate limiting, unlike the production www.facebook.com endpoint, allowing unlimited guesses of the 6-digit reset code.
**Steps:**
1. Trigger password reset at `https://www.facebook.com/login/identify?ctx=recover&lwv=110` with victim's phone/email to receive a 6-digit code.
2. Confirm www.facebook.com blocks after 10-12 attempts.
3. Send the same reset request to `beta.facebook.com` / `mbasic.beta.facebook.com` and observe no rate limiting.
4. Brute-force the `n` parameter in `POST /recover/as/code/ HTTP/1.1` to `Host: beta.facebook.com` with body `lsd=AVoywo13&n=XXXXX`.
5. On correct code, set a new password and log in as the victim.
**How found:** Researcher tried brute-forcing the 6-digit reset code on www.facebook.com, got blocked after 10-12 attempts, then tested the same flow on beta.facebook.com and mbasic.beta.facebook.com and found rate limiting absent there.
**Exploitation:** Attacker submits victim's phone/email to the recovery flow, then brute-forces the 6-digit code against the beta host's /recover/as/code/ endpoint (no rate limit), and upon a hit sets a new password, gaining full account access including messages, stored cards, and photos.
**Insight:** When a production endpoint enforces rate limiting, test parallel beta/mbasic/mobile subdomains of the same flow — they often share backend logic but skip the throttle, giving an unthrottled oracle for the same secret.