How I found a Remote Code Execution bug affecting Facebook's ...

I knew I had a XXE because when I told Facebook's server to open /dev/random, the response would never come and eventually a request killer would kick in after ...