Shubham Bhamare

Jan 30

[WRITE-UP] Missing rate-limiting. How I was able to add any unowned phone number to my Facebook account? (Bounty: 5000 USD)

Hi guys, I’m Shubham Bhamare again. In this write-up, I’m going to tell you how I was able to add any unowned phone number to my Facebook account without the victim’s knowledge. It was a very easy finding. Without wasting time, let’s start! 👉 === Reproduction steps: Step 1: Using…

Facebook

4 min read

[WRITE-UP] Missing rate-limiting. How I was able to add any unowned phone number to my FB account?

Aug 31, 2021

[WRITE-UP] Bypassing 2-Factor Authentication for Facebook Business Manager (Bounty: 1000 USD)

Hi guys, it’s Shubham Bhamare again. In this write-up, I’m going to tell you how I bypassed 2-Factor Authentication for Facebook Business Manager using a very simple trick. Due to this issue, an attacker was able to make changes in victim’s Facebook Business Manager account. …

Facebook

2 min read

Jan 14, 2021

[WRITE-UP] Irremovable Facebook group album photos and entire album under certain circumstances (Bounty: 1000 USD)

Hi guys, it's Shubham Bhamare again. In this write-up, I'm going to tell you about one of my very simple Facebook bug which was found accidentally as I wasn't in the mood of testing at that time and was just browsing our business group on Facebook. Due to this issue…

Bug Bounty

4 min read

Irremovable Facebook group album photos and entire album under certain circumstances (Bounty: 1000…

Dec 28, 2020

[WRITE-UP] Facebook page admin disclosure by "Create doc" button (Bounty: 5000 USD)

Hi guys, it's Shubham Bhamare again. In this write-up, I'm going to tell you about my 2nd valid bug that I found on Facebook. This issue could've accidentally revealed the identity of the Facebook page admin by the "Create doc" button. This is one of the very special findings for…

Bug Bounty

3 min read

Facebook page admin disclosure by "Create doc" button (Bounty: 5000 USD)

Dec 25, 2020

[WRITE-UP] Facebook page admin disclosure by "Message Seller" button (Bounty: 1500 USD)

Hi guys, I’m Shubham Bhamare from Maharashtra, India. As I promised in my previous write-up, here’s my first Facebook bug bounty write-up. Finally! 😂 I know it’s too late to publish this write-up as this bug was found and rewarded in 2018. I’m extremely sorry for that. …

Bug Bounty

3 min read

Facebook page admin disclosure by "Message Seller" button (Bounty: 1500 USD)

Dec 25, 2020

[WRITE-UP] My first bug bounty write-up about my first valid finding | A very simple ATO bug in a target who wasn’t running any bug bounty program (Bounty: 40K INR)

Hi guys, I’m Shubham Bhamare from Maharashtra, India. It’s my first bug bounty write-up about my first valid bug which could have allowed a malicious user to take over any account on that target site. So let's start! 👉 === Target: As I can’t disclose the name of the company…

Bug Bounty

3 min read