Three months ago, I wrote a blog post in which I described an XSS I found in Google Colaboratory . In this post, I will expand the topic and show you another XSS I identified in the same application, which is directly related to the previous. I suggest you to have a look at the previous post before reading this one, but here's an overview of what happened last time: I analyzed an application…
A few mongth ago, Google released a new product - Hangouts Chat application, which is surely an answer to Slack . Hangouts Chat might be used both in browser (at https://chat.google.com ; requires G Suite account) and as a desktop or mobile application - to be downloaded from https://get.google.com/chat/ . A few months ago I was given a research grant to analyze the application and decide to focus…
In this note, I describe an interesting XSS that I found in February 2018 in one of the Google applications. I won't only show directly where the XSS was, but it's also a case sudy of what attempts I made to find it and what dead ends I needed to overcome. In addition, I'm showing a Content-Security-Policy bypass using script gadgets . What is Google Colaboratory The app I chose for testing was…
In this short note I'll describe a bug I found in Chrome recently. It allowed to set arbitrary headers in cross-domain requests. @insertScript recently found a very similar bug in Adobe Reader plugin but it turns out you can still expect those bugs in browsers themselves. Why is it serious? Because you can use it to inject any request headers, including ones on which security decisions are based,…
One and a half year ago, I wrote a blog post about my three XSS-es found in Google Docs and Google Developers thanks to Google Caja bypasses . In this year, I had a short look at Caja again and it resulted in three another bypasses, not related to the previous ones. So let's have a look at them! What is Caja? According to the official documentation , Google Caja "is a tool for making third party…
In this post I will explain the Same-Origin policy bypass ( CVE-2015-7188 ) in Firefox I reported to Mozilla last year. The root cause of that issue was a minor nuance in IP address parsing in some of the most popular OS-es. The final working exploit, however, additionally needed Flash installed and activated on the victim's machine. Another limitation was that it only worked to http protocol.…
In this article, I will describe three XSS-es I reported to Google VRP this year. All of them were possible thanks to Google Caja's sandbox escape. Introduction At the beginning of this year, I chose Google Docs as my bug bounty target. In Google Docs you can create scripts using Google Apps Script which are roughly equivalent to Microsoft Office's macros. The scripts are programmed in Javascript.…
In this post, I'll show you a very fun XSS via fie upload found on www.google.com domain in a service called Postini Header Analyzer . Postini, according to Wikipedia, is an e-mail, web security and archiving service, owned by Google since 2007, that provides cloud computing services for filtering e-mail spam and malware. On http://www.google.com/postini/headeranalyzer/ there is a service that…
In the beginning of 2015, Google launched a new program called Vulnerability Research Grants , " with the goal of rewarding security researchers that look into the security of Google products and services even in the case when no vulnerabilities are found ". I have submitted quite a few bugs to them and decided to give it a try. The grant was given to me after a few days of waiting and my task was…
A few months ago I found a really fine XSS in Google's Custom Search Engine. The trick I needed to use doesn't seem to be broadly known and that's a pity as it sometimes might allow to make unexploitable exploitable. So here it is: XSS via Host header - Internet Explorer only. The trick was discovered by Sergey Bobrov ( @Black2Fan ) two years ago and still hasn't been fixed in IE11. Details of the…
Two weeks ago I received a mail from Google Security Team informing me that I was one of top 10 reporters in 2014. I must say that it was a pretty surprising news for me as I didn't actually reported a big number of bugs, with none of them reported in the second half of the year. Anyway, I couldn't wait to get the package which reached my home two days ago. It cointained Moto 360 watch, leather…
In this post, I'll explain to you an interesting bug in Facebook, which made it possible to steal user's name and email as well as an access token that allowed to read person's friend list. This is a bug I personally consider my favourite bug bounty finding, you'll soon find out why :) It was discovered by me and @evil_xorb . With the link below, you can register to FriendFeed using your Facebook…
In this post, I'll show a HTTP response splitting vulnerability, which I've found in Google Doodle website. If you don't know what response splitting is, Wikipedia sums it up pretty nicely: HTTP response splitting is a form of web application vulnerability, resulting from the failure of the application or its environment to properly sanitize input values. It can be used to perform cross-site…
Note: you can also read Polish version of this post on Sekurak In this post I'll show you two XSS-es I've found in Google services: Gmail and Google+. In particular, I'll explain why I needed the second one to exploit the first one and why XSS-es within cookies do matter. Gmail Gmail is one of the most recognized Google services. It comes in many different views, including Basic HTML and old…
Today I had a closer look on HTML source of Google's Vulnerability Submission Form at http://goo.gl/vulnz and it turned out there are a couple of easter eggs: https://www.google.com/appserve/security-bugs/new?rl=z7kuve4n5jf7mpe45mjtcsua&alert(121212) https://www.google.com/appserve/security-bugs/new?rl=z7kuve4n5jf7mpe45mjtcsua&alert(document.domain)…
There's already been some traffic here so let me describe one of my earliest bugs I've reported to Google Security Team. Last August, I had a brief look at Google Code Playground site. I was looking for some client side issues like XSS or CSRF but my attention was caught by the copyright notice on every subpage. As it's licensed on Apache License, which is an open source one, perhaps it's possible…
Hi everybody and welcome to my blog. I'm planning on sharing my bug bounty stories here as well as other thoughts about security, mainly web applications security. Thanks and see you later!