« What I did was execute OS level commands on one of Facebook's acquisition's servers.

[...]

I also started to look at Facebook's acquisitions. Doing the same, port scanning common ports, probing services that looked interesting.

[...]

I decided to do a full port scan with nmap. The results showed another Jenkins service running on a less common port. Accessing it over this less common port it did not prompt me for authentication. Bingo!

For those of you that do not know, Jenkins is a 'continuous integration server'. Once authenticated it allows you to run 'Groovy script' through the 'Jenkins Script Console'.

By using Groovy script and the Jenkins Script Console I was able to execute commands on the server under the 'jenkins' user.

[...]

I reported this issue to Facebook and they patched it very fast. I was awarded $7,500 through their bug bounty program. The payment took a few months to come through and lots of emails back and forth. But it came through in the end.

What's the takeaway? Don't forget the basics. I was able to find a pretty risky bug in one of Facebook's acquisitions from within my bed by just using Nmap. »

Via http://seenthis.net/messages/322264