# Download Facebook internal mobile builds

Misconfigured m.facebook.com/mobile_builds endpoint allowed enumerating build_number to download internal Facebook, Instagram, Workplace, Portal and Oculus mobile builds.

- Payout: $6,000
- Severity: medium
- Program: Meta / Facebook
- Credited: Philippe Harewood
- Disclosed: 2021-03-31
- Write-up quality: 6/10
- Original: https://philippeharewood.com/download-facebook-internal-mobile-builds/
- Library page: https://bugbountylibrary.com/r/blog%3Aphilippeharewood-com-download-facebook-internal-mobile-builds
- Tags: domain:mobile domain:web impact:data-leak impact:internal-access kind:bounty platform:blog sev:medium technique:recon vuln:access-control vuln:info-disclosure vuln:misconfiguration

**Target:** m.facebook.com/mobile_builds endpoint
**Root cause:** The mobile_builds utility endpoint lacked proper access control, allowing unauthenticated requests with arbitrary build_number parameters to retrieve internal build artifacts.
**Steps:**
1. Send `GET https://m.facebook.com/mobile_builds/?build_number=<N>&no_fw=1` with header `cookie: sb=; datr=; fr=; dpr=2` and `--content-disposition`
2. Iterate build_number over a range (e.g. `for i in {183448000..183448100}`) with wget
3. Download returned IPAs, APKs, internal Windows and Oculus packages
4. Inspect internal apps for auth tokens to interngraph.intern.facebook.com
**How found:** Researcher identified the m.facebook.com/mobile_builds utility endpoint and noticed a misconfiguration allowing URL variation with a build_number parameter to fetch arbitrary builds.
**Exploitation:** Unauthenticated attacker enumerates build_number values against the mobile_builds endpoint to download local, profile, in-house and development builds for Facebook, Instagram, Workplace, Portal and Oculus, including builds back to 2019 and as recent as March 2021; some internal apps contained auth tokens for interngraph.intern.facebook.com.
**Escalation:** Internal apps in the dump contained auth tokens for Facebook's interngraph.intern.facebook.com endpoint, potentially enabling further internal access.
**Insight:** Utility/download endpoints on mobile subdomains (mobile_builds, package servers) often skip auth; try enumerating numeric build_number parameters with stripped cookies to pull internal artifacts.