Earlier quoted context omitted.
http://i.imgur.com/3UuEZ.png
Hmm, anybody have an idea as to why mine's different? http://i.imgur.com/OrqtK.png
Maybe it's a specific theme? The old default theme?
Break Google
11–20 of 92 posts
Re: Break Google
#12Oh, cute. Yet another injection flaw in Google.
Guys, (and I don't mean Google, I mean all of us), don't fix injection by plugging injection bugs; put together some framework that actually avoids all of these problems (or at least doesn't let you add bugs).
Re: Break Google
#13Tip to the poster, and to anyone: Google (and Facebook, and others) have bug bounty programs. You can get paid tens to thousands of dollars if you report vulns to the vendor first.
Re: Break Google
#14When you search for "${", the page is missing 26 lines of minified JavaScript (lines 9-35 of a non-broken page, at least for me), almost certainly because of a templating bug. These lines, among other things, are responsible for adding the top toolbar to the page. (The missing JS is here: http://pastebin.com/B9cy3T2c)
Re: Break Google
#15If this is a templating engine type thing, you should be able to do something like
${KEYWORD}${
If you can figure out what "KEYWORD" is for a given template tag as well. I tried links and a few others, but none that I can identify: it does still reproduce the bug though.
Re: Break Google
#16Earlier quoted context omitted.
http://i.imgur.com/3UuEZ.png
Hmm, anybody have an idea as to why mine's different? http://i.imgur.com/OrqtK.png
You loaded the page directly. It only seems to happen if autosearch was involved.
Loading http://www.google.com/search?q=${ does what you see, but entering ${ in to the search box and pressing enter does what everyone else sees.
edit: compare your clean human generated address bar to the other screenshot's messy software generated one.
Re: Break Google
#17Earlier quoted context omitted.
I'm not seeing it. Can you post a screenshot?
http://i.imgur.com/3UuEZ.png
Looking at those screenshots, I see that you all tried:
${
However, I tried the literal
'${'
Which also breaks it. In fact, it looks like anything that has ${ in it will break it, anywhere at all in the search string.
Also, if you close the parentheses, e.g. ${}, it fixes it. This works with any number of leading ${, e.g. ${${${${${}
Re: Break Google
#18Seems likely that it's due to a lack of escaping in a custom templating layer. I wonder if it could be used to perform a XSS attack?
Unlikely. You'd have to get someone else to run the same query.