Disclose the email address and phone number of chinese business reseller

2 min readJul 11, 2024

There is a XController that shows the resellerInfoSpecMap of a Chinese business reseller. The resellerInfoSpecMap contains email address and phone number of few Chinese business resellers.

Proof of concept

Send the below HTTP POST request as an AJAX call in the console window.

new AsyncRequest('https://www.facebook.com/china_businesses/onboarding/pre_flow_fetch').send()

The response from this request will disclose email address and phone number of few Chinese business resellers.

The above endpoint was found in one of the Js file via the XChinaBusinessGraphOnboardingPreFlowFetchController XController

__d("XChinaBusinessGraphOnboardingPreFlowFetchController", ["XController"], (function(a, b, c, d, e, f) {
 e.exports = b("XController").create("/china_businesses/onboarding/pre_flow_fetch/", {
 reseller_name: {
 type: "String"
 }
 })
}