Use this Graph API method:
https://graph.facebook.com/{user}/friends
but you need an additional access token from the user
from the API docs -
Getting an access token for a user with no extended permissions allows you to access the information that the user has made available to everyone on Facebook.
there are two other methods that I know of
See this for the FQL:
http://developers.facebook.com/docs/reference/fql/friendlist/
Depreciated call, Get method: http://developers.facebook.com/docs/reference/rest/friends.getLists/
As far as permissions note this
Friend lists are private on Facebook, so you cannot republish this information to anyone other than the logged in user.