How I Could Have Stolen Your Photos From Google
summary
Finds a Gmail invite parameter that accepts multiple emails with a crafted display name to spoof addresses and earns $500; discovers Google Slides exposes Drive image URLs via two API calls where a returned random token ties to an image ID allowing retrieval (direct object reference), also $500 and labeled priority one; breaks Google Photos shared-libraries by decoding a URL-safe Base64 token (replace dot with =) to swap the partner email and silently share albums, gets ~$3,000; uses Chrome DevTools and curl and notepad, brute force of long IDs is impractical but exploits work.
AI-written summary · about
chapters (6)
- 0:00Start
- 1:54TABLE OF CONTENTS
- 14:09TAKING A BREAK
- 17:16UNIQUE SHARING MECHANISM
- 23:04LESSONS LEARNED
- 24:26QUESTIONS
related talks
48mThe Accidental Discovery of a New Vulnerability in Google's OAuth Implementation
32mWhat We Can Learn from Google’s Fight with Phishing
30mGoogle Give Me Vulnz
23mGoogle Drive Hunter: Building the Tool Google Should’ve Built (Ayman Elsawah)
39mHacking Google - Lessons learned running and growing an internal red team
22mThe Silent Breach: Security Threats in Google Workspace
28mI'm Not a Human: Breaking the Google Recaptcha
28mHey Google, Activate Spyware! – When Google Assistant Uses a Vulnerability as a Feature