Finding a $5,000 Google Maps XSS by fiddling with Protobuf
1–10 of 21 posts
Re: Finding a $5,000 Google Maps XSS by fiddling with Protobuf
#2I still think $5,000 is ridiculously low. Lots of research like this fails and it happens you do the work just to be told someone already filled a similar bug before.
Re: Finding a $5,000 Google Maps XSS by fiddling with Protobuf
#3I still think $5,000 is ridiculously low. Lots of research like this fails and it happens you do the work just to be told someone already filled a similar bug before.
the guys who were paid to implement this incorrectly were all paid over $5,000 a week. take the bounty out of their paychecks.
Re: Finding a $5,000 Google Maps XSS by fiddling with Protobuf
#4Awesome find and write up. Wondering why you did not get the full $7500 for this
https://www.google.com/about/appsecurity/reward-program/inde...
How come accounts.google.com more severe than others for XSS ?
Re: Finding a $5,000 Google Maps XSS by fiddling with Protobuf
#5Fantastic write-up. Scripting with Chrome's debug tools seems to be a promising way to find exploits among minified js.
Re: Finding a $5,000 Google Maps XSS by fiddling with Protobuf
#6Nice work, Marin. Great detail on your methods and findings.
Re: Finding a $5,000 Google Maps XSS by fiddling with Protobuf
#7Fantastic analysis of a complex system. Congrats on the bounty! +1 for dropping that you're looking for work at the end, that's a great resume post.
Re: Finding a $5,000 Google Maps XSS by fiddling with Protobuf
#8Awesome find and write up. Wondering why you did not get the full $7500 for this https://www.google.com/about/appsecurity/reward-program/inde... How come accounts.google.com more severe than others for XSS ?
> How come accounts.google.com more severe than others for XSS ?
Because that's where the jewels are: "Control, protect, and secure your account, all in one place"
Re: Finding a $5,000 Google Maps XSS by fiddling with Protobuf
#9I still think $5,000 is ridiculously low. Lots of research like this fails and it happens you do the work just to be told someone already filled a similar bug before.
Pretty elaborate research indeed, I once filed a very simple, but just as dangerous, stored XSS on www.linkedin.com (with access to cookies) + some other bug, hoping to speedup my Partner API Request, got $400 for the XSS and many weeks later $400 for the other bug too (which took them 6+ months to fix). The $/time wasn't worth it, and of course the Partner API Request got declined without explanation.
Re: Finding a $5,000 Google Maps XSS by fiddling with Protobuf
#10Very clever use of the Chrome debugger APIs.
We should connect, my company doesn't have anyone fully remote right now but maybe we could do in the near future...