FBML Injection on Facebook Stream Attachments

---

As you might already know, on Facebook, we can insert some certain media attachment like image, video/flash or mp3 audio through our own application. The attachment is an array of structured data that defines the post. To understand how to post what kind of attachment we would like to post, we need to understand about Facebook Stream Attachments. You can read more about the detail on their page. Here, we are discussing the issue on one of its parameters named “name”. You can use this Stream Attachments through :

• Facebook.streamPublish
• Facebook Feed Dialog, or
• Facebook Prompt Feed

As i said above before, here we’re gonna try to use the ‘name’ parameter on the attachment to add an FBML Injection to our post. This trick found by some of our brothers and sisters on balikita, inspired by a tag button then Roy Castillo use fb:lives-tream, then tweaked more by some other forum members. Let’s assume that you have already known about how to insert the attachment, you can insert some FBML codes inside the parameter like :

• fb:captcha
• fb:live-stream
• fb:editor-textarea
• fb:editor-button
• fb:editor-date
• and many more

You can try to insert those FBML tag using our Facebook Bold Text, simply put those FBML codes inside the ‘Message’ Box, there’s also a preview button. You can find more about FBML tag on this page : http://developers.facebook.com/docs/reference/fbml/ try it, who knows you will find another way to insert XSS vector using this trick
Below is the preview of the fb:livestream inside the ‘name’ parameter :
http://www.facebook.com/official.profile/posts/189641377770440
Screenshot :

I’m using the trick to show visitor profile picture on newsfeed, try it yourself on your wall by clicking this li