brutecat-com

A researcher used a Discord message to find two missing security pieces and achieved RCE on Google Cloud production, earning a $148,337 bounty. The exploit was completed one hour before the disclosure deadline. The same vulnerability was reproduced three months later.

The article discusses the challenge of understanding Google's complex search system and proposes converting it from a black box to a white box approach to make it more transparent and accessible.

A security researcher discovered an attack chain on Google services that could have leaked the email address of any YouTube channel, potentially creating one of the largest data breaches. The vulnerability was reportedly exploitable for $10,000.

A security vulnerability could have exposed private email addresses of monetized YouTube channels through a secret parameter. The flaw, which raised concerns about creator privacy and phishing risks, was discovered as part of a $20,000 bug bounty program.

A security researcher discovered that IPv6's massive address space combined with a botguard bypass could expose any Google user's phone number. The vulnerability allowed attackers to potentially leak phone numbers through systematic enumeration of IPv6 addresses.

The article discusses the challenge of understanding Google's complex search system and proposes converting its attack surface from a black box to a white box as the key to decoding it.

A security researcher discovered a vulnerability that could have allowed attackers to leak the email address of any YouTube channel for $10,000. The attack chain targeted Google services and had the potential to become one of the world's largest data breaches.

A security researcher discovered a vulnerability that could have exposed private email addresses of monetized YouTube creators. The flaw involved a secret parameter that potentially allowed access to sensitive information, prompting a $20,000 bounty from Google.

A security vulnerability allowed attackers to obtain any Google user's phone number by exploiting IPv6's address space and bypassing botguard protections. The flaw exposed phone numbers through rate limit manipulation and infrastructure weaknesses.