How I Could Have Promoted Any Facebook Page For Free.

AneesKhan
AneesKhan
Mar 30, 2018 · 5 min read

Greetings Everyone!

This Blog Post is about How I was able to promote my Facebook Page Free of cost.

What is Facebook Promotion:

Image for post
Image for post

How Does it Work:

Image for post
Image for post

Here’s the Link, If you wanna read more about Promotions:
https://www.facebook.com/business/help/1189028774466371

So Lets start Hacking this Mechanism :)

I created a Fresh facebook page and Uploaded some Images to it. There was an Option called “Boost Post” below Every Image.

Image for post
Image for post

When I clicked on Boost Post, I was returned to a new page something like:

Image for post
Image for post

Now here we have to set the amount and for how many days do have have to run our ad. So I filled up the form and clicked on Boost. And facebook asked me to add a Valid Card for the transaction.

Image for post
Image for post

NOTE: I only had 4 to 5 US Dollars in my Card but I started an ad for 100000 PKR which is almost 1000 USD.

I added my Card details and clicked on Continue. And it said that the Post is Under Review:

Image for post
Image for post

I was thinking that Facebook Might have a Manual check or review and I might be Blocked after this .But After a Couple Of Minutes I recieved a Notification Saying that You ad has been approved.

Image for post
Image for post

I was Like:

Image for post
Image for post

But I was not sure that the ad will run completely or not. So I waited for a couple of hours and when I checked it again. I was as shocked as before.

My Post Reached 34,792 people and got 7.1k Likes.

Image for post
Image for post

My Reactions:

Image for post
Image for post

But All of a sudden my ad stoppped. I was not sure why is it stopped and what next steps do I have to take. But after reading there blogs and other stuff I sorted out that its some kind of functionality by facebook.

So How Does it Work.

When we Boost a Post in Facebook then at that time it doesn’t charge the money from our card but instead it saves the money in our account that we need to pay later and it is named as “Threshold Amount”. But the threshold has got its limit. So when Our boosted post reaches the limit of 2500 pkr (20–25 Dollars), then the ad will be automatically stopped and it will be started again after paying that amount. So we can just Promote ads for 2500pkr.

Amount I have to Pay:

Image for post
Image for post

Threshold Limit:

Image for post
Image for post

I tried to change the threshold limit but it didn’t happen :(
I tried lots of different methods to bypass this protection but all in vain. So I left it.
But after a couple of days an Idea Came into my Mind. I thought what If we change the ownership of the page?
So what ? I went ahead and changed the admin of that page and removed the previous admin.

And Boom!!!

No Amount Due was shown this time So by doing the same process again I could have boosted up as many posts as I could.

Image for post
Image for post

Steps to Reproduce:

  1. Create a Facebook Page and Boost a Post.
  2. Add a Valid card which has at least 2–3 dollars in it.
  3. The Ad will be started and it will run untill it reaches its threshold limit.
    You can check the summary of your ads and amout spent by going to the following url:
    https://www.facebook.com/ads/manager
  4. Once the ad reaches its threshold limit, change the admin of the page and remove the previous admin.
  5. Now start the whole process once again by boosting other or the same posts :)

I didn’t waste much more time and reported it to facebook but at first they were not able to reproduce it. So I provided them as much information as I could. Actually the issue with facebook was that it wasn’t validating the amount in the card. So after having a chit chat for a couple of days they Finally reproduced it and they Amused me by their Outstanding Reply:

Image for post
Image for post

Ok So they were already aware of the issue But were unable to reproduce it when I first reported it to them :P (Only Leets Can understand what I mean.)
I said Not a problem if you don’t wanna take it seriously.

NOTE: There’s something Notable in their reply which is “This behavior will eventually get caught by our fraud detection.”

I said why not challenging my self to see If I get caught or not. So I made a Brand New page and uploaded a video and some images and boosted them using the same process again and again.

Here are the results:

Image for post
Image for post

This was not just Limited to Posts but the Facebook Pages could’ve also been Promoted as well.

Image for post
Image for post

Got 2,514 Page Likes + Followers within a day :)

I showed these images to facebook and they’ve now implemented some fixes but Unfortunatley “Every Fix has a Bypass ” :D

I wasn’t awarded anything as they were already aware of the issue.

I Hope You Enjoyed this Write-Up.

Best Regards,
Anees Khan

InfoSec Write-ups

A collection of write-ups from the best hackers in the…

AneesKhan

Written by

AneesKhan

Twitter: @aneesethical

InfoSec Write-ups

A collection of write-ups from the best hackers in the world on topics ranging from bug bounties and CTFs to vulnhub machines, hardware challenges and real life encounters. In a nutshell, we are the largest InfoSec publication on Medium. Maintained by Hackrew

AneesKhan

Written by

AneesKhan

Twitter: @aneesethical

InfoSec Write-ups

A collection of write-ups from the best hackers in the world on topics ranging from bug bounties and CTFs to vulnhub machines, hardware challenges and real life encounters. In a nutshell, we are the largest InfoSec publication on Medium. Maintained by Hackrew

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch
Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore
Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store