Creating Test Conversion using any App

Joshua Regio
Mar 27, 2018 · 1 min read

The Facebook ad account test can help you understand how many sales or conversions your Facebook, Instagram and Audience Network ads are causing.(source)

Description: A malicious user can create test conversion using any app which could reveal the sales and conversions of an active campaign.

Impact: Before they redesigned this feature a user could choose which type of event should the test count as a conversion. Some of these events type includes purchase, add to wishlist, initial checkout, spend credit, etc…

Reproduction Step:
1. Go to facebook.com/test-and-learn/?act=AD_ACCOUNT_ID
2. Set Up Test
3. Fill in the necessary information.
4. Intercept the request before creating a test.
5. In the /ad-studies request, change the APP ID to your victim’s app id.
6. Test Conversion is created.

Timeline:
Feb. 10, 2018 — Issue Reported
Feb. 16, 2018 — Report Triaged
Mar. 22, 2018 — Issue Fixed
Mar. 26, 2018 — Bounty Awarded $3,000

InfoSec Write-ups

A collection of write-ups from the best hackers in the…

Joshua Regio

Written by

Freelance Bug Hunter

InfoSec Write-ups

A collection of write-ups from the best hackers in the world on topics ranging from bug bounties and CTFs to vulnhub machines, hardware challenges and real life encounters. In a nutshell, we are the largest InfoSec publication on Medium. Maintained by Hackrew

Joshua Regio

Written by

Freelance Bug Hunter

InfoSec Write-ups

A collection of write-ups from the best hackers in the world on topics ranging from bug bounties and CTFs to vulnhub machines, hardware challenges and real life encounters. In a nutshell, we are the largest InfoSec publication on Medium. Maintained by Hackrew

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch
Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore
Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store