# Hijacking a Facebook Account with SMS

Facebook's confirm_phone.php trusted a client-supplied profile_id, letting an attacker link their own verified phone to any victim's account and reset the password via SMS.

- Payout: $20,000
- Severity: critical
- Program: Meta / Facebook
- Credited: Jack Whitton
- Disclosed: 2013-06-26
- Write-up quality: 8/10
- Original: https://whitton.io/articles/hijacking-a-facebook-account-with-sms/
- Library page: https://bugbountylibrary.com/r/blog%3Awhitton-io-articles-hijacking-a-facebook-account-with-sms
- Tags: domain:web impact:ato kind:bounty platform:blog sev:critical tech:rest technique:chained vuln:access-control vuln:account-takeover vuln:idor

**Target:** /ajax/settings/mobile/confirm_phone.php AJAX endpoint
**Root cause:** The endpoint accepted a client-controlled profile_id and linked the verified phone number to that profile without checking the caller owned it.
**Steps:**
1. Send `F` to Facebook UK shortcode `32665` from your own phone; receive an 8-char verification code.
2. Open the activation box and submit the code in `fbMobileConfirmationForm`.
3. Intercept the request to `/ajax/settings/mobile/confirm_phone.php` and change `profile_id` from your ID to the victim's ID; keep your own `__user` value.
4. Submit; server returns 200 and links your phone to the victim's account (reauth with your own password if prompted).
5. Trigger a password reset on the victim account; the reset code arrives via SMS to your phone.
6. Enter the reset code, set a new password, and log in as the victim.
**How found:** Noticed the confirm_phone.php request carried both a code and a profile_id, and that changing profile_id to another account did not raise an error, indicating missing ownership check.
**Exploitation:** Attacker needs only their own phone and a Facebook account. They verify their own number, then swap profile_id to the victim's ID in the confirm request, binding the attacker's phone to the victim. A subsequent password reset delivers the code to the attacker's phone, completing takeover with no victim interaction.
**Escalation:** Phone binding converts a settings IDOR into full account takeover by chaining into the SMS-based password reset flow.
**Insight:** On phone/email verification endpoints, test whether the account identifier in the request is bound to the session; if the server only validates the code, you can attach your verified contact to a victim and pivot through the recovery flow.