Trick:: Create Facebook Ghost Account/Page

This Trick Patched, Doesnt Work Any More 

To create a hidden / ghost facebook account or page you should understand the trick and how it works .

Facebook based on objects, every object have a number called ID, there is no tow objects with the same ID . 

however, to make it more easy for browsing facebook, they created usernames, also usernames cant be duplicated between accounts . 

What is the different between usernames and IDs ?

ID is numbers generated automatically when you create a facebook object , while a username is characters with numbers that you choose by your own for your created object . 

Though, while every username comes after the slash "/" for example :

my official page is : http://facebook.com/khalil.shr   with an ID : 582109601810429 .

so my official page username is : khalil.shr  . and while there is facebook pages like : facebook.com/help for the facebook help center, means that we cant create an object with the username "help" because its already registered, but if we find a trick to make it , our page or account will redirect users to help center instead of the page or account time line . 

Few tests i fount that we can create an account or a page with a redirect to a reserved facebook page which is : https://www.facebook.com/selfxss

so when users clicked your page/account , they will be redirect to facebook SelfXSS  awarening page . 

Steps to create a ghost/hidden account / page 

- Create a new account or page  . 

- Choose a username with a duplicated of "selfxss" . 

Example : 

Account : 
https://www.facebook.com/selfxss.selfxss    
check validation https://graph.facebook.com/selfxss.selfxss 

Page:
https://www.facebook.com/selfxss.selfxss.selfxss   
check validation https://graph.facebook.com/selfxss.selfxss.selfxss   

 

As you see the first time i used "selfxss.selfxss" as a username , then i used " selfxss.selfxss.selfxss" as another username, and both will redirect you to the facebook SelfXSS  awarening page . 

The most inportant for this trick is to create a username that starts of (selfxss) ,

examples: (selfxss.1 - selfxss.2 - selfxss.khalil .. etc) 

 

soon as this article will spread on , facebook will patch it for sure . 

Have Fun 

Leave a comment