Google- Multiple Account Creation Bug [Write-up & Video]

Steps to reproduce bug:

1. Go to https://accounts.google.com/SignUpMobile

2. Enter your mobile number and click "Next". You will receive a message on your phone. Open message and there would be a link like http://g.co/xxxx or http://g.co/gms/xxxx

3. Go to the link in computer's web browser and confirm the verification. Follow the steps and create a Google account.

For verification: Open new tab and go to http://mail.google.com . You will be logged into the the account that you've just created.

4. Now, hit back button twice or till you're back to "Choose your username" page.

Enter New Username->Password->Account Created.

Hit back button, Enter New Username->Password->Account Created. Repeat it again and again.

To make this process more easier, create a bot and run it with multiple threads :)

Video (POC):

Read more

Google.com XSS [FIXED] [HOF]

Vulnerability Type: Cross Site Scripting (XSS)

• Reported on 28 June 3013
• Fixed Now

Details-

Sign into Google account and go to:

http://www.google.com/merchants/newfeed

Now, Tick the box "I want to use Google Spreadsheet to store, edit and upload my feed" and Select 2nd option.

It will ask us to enter the URL, type "javascript:alert(1)" without quotes and type "Click Me" in Doc's Title field.

Click OK. Now click on "Click Me" and you will see a Pop-up due to XSS vulnerability.

POC:

I reported this vulnerability to Google and I received below reply:

Hey,
Due to the requirement for the victim to take a few actions, the panel has determined this bug didn't meet the threshold for a reward. Nonetheless, we'd like to acknowledge your assistance on our credit page (http://www.google.com/about/appsecurity/hall-of-fame/distinction/) under "Honorable Mention" - are you interested? If so, what name/link should we list?
It should be of the form: name - site [site link] 

I re-edited my URL :

http://www.google.com/merchants/newfeed?noCheck&verticalId=v:products&trixDocTitle=ClickMe&trixDocUrl=javascript:alert(1)

Now, the victim has to only tick the "I want to use Google" option and click on "Click Me"

To make it more easier, we could write something else in place of  "Click Me" like:

• Session Timed Out! Click To Login Again
• Click here to Sign in

I re-submitted  and received below reply from Google-

Hi,
Thank you for the followup however the decision stands as is.

The vulnerability was fixed after few days.

Read more

Paypal- Privilege Escalation Vulnerability [Delete Any User]

Vulnerability Type: Privilege Escalation

Vulnerable Website: https://www.paypal-labs.com

Status: Fixed

Vulnerability Overview: This vulnerability allowed an attacker to delete any user registered in paypal-labs.com.

Details/Write-up: 

I forgot to take screenshots but I am sure my detail write-up will clear everything.

Read more

Google Play - Cross Site Scripting (XSS) Vulnerability

Vulnerability Type: Cross Site Scripting (XSS)

• Reported on 16 July 3013
• Fixed on 17 July 2013

Details/Writeup-

Google recently changed it's design of Google Play which lead to this XSS vulnerability.

Head to Google Play settings (https://play.google.com/settings)

Read more