Hack Forums
[XSS] Google/Youtube XSS + Hall of Fame - Query Inluded[/XSS] - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [XSS] Google/Youtube XSS + Hall of Fame - Query Inluded[/XSS] (/showthread.php?tid=2141104)

[XSS] Google/Youtube XSS + Hall of Fame - Query Inluded[/XSS] - Shibe - Jan 23, 2012

I am pretty much happy right now that I found a Google XSS (Cross-site Scripting) Vulnerability on Google's website.

I received an email from Google yesterday stating that the vulnerability is eligible
for a $1000 Dollar reward, and a name on the Google Hall of Fame list.

Here is the email they sent me.

Code
Congratulations! The panel has determined that this vulnerability is eligible for a reward of $1000.

To get the ball rolling, we need to collect some payment details as soon as possible:

0. If you'd prefer to donate your reward to charity, reply to this email with the name and URL of the recipient organization. If you choose to do this, Google will match your donation! (e.g. if you received a $500 reward, we'll donate $1000)

1. If we're paying you, I need you enrolled as one of our suppliers. Please fill in our supplier enrolment form here - [REMOVED]

Here is what you need to know:
  - Supplier type: Individual/Sole Proprietor
  - Country where goods/services are being delivered to: United States
  - Type of goods/services provided: Services
  - Currency: USD

Double check that the wire details given are accurate, and that your account will accept USD payments. It is very time-consuming to fix any errors with the wire information! Once you're enrolled as a supplier, it typically takes 4-6 weeks until you receive the money.

2. If you are outside the USA, our finance team will contact you after the above form is complete to request a completed and signed W-8 BEN form (http://www.irs.gov/pub/irs-pdf/fw8ben.pdf). Reply to *that* email with a scanned copy of the completed & signed form. If you don't have a scanner, a digital photo should be sufficient.

3. Finally, please let me know if you’d like your name added to our Hall of Fame page: http://www.google.com/corporate/halloffame.html

Cheers,
Adam

Here's is a picture of the Vulnerability

Spoiler (Click to View)

Shoutouts and thanks to MaXoNe, and Zer0Pwn. (I Couldn't have done it without your tutorials)

Edit - Here is the Vulnerable link that I found XSS on

Code
https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.comm&v=-XSS&timestamp=alert%280%29

Also, a good tutorial for XSS to get you guys started

Beginner Tutorial (By Zer0Pwn) - [TuT]#- Full Ultimate XSS Tutorial -#[TuT]

More Advanced Tutorial (By MaXoNe) - <paper>XSS Behind the mask</ by MaXoNe>



* - phovios - Jan 23, 2012

Hey this is ~!White!~

Good job keep up the good work :)

* - Pi⁣⁣ - Jan 23, 2012

Congratz! If it is patched, would you mind PM'ing me the query? I'm interested.
Really nice find! How long did it take you?

* - cheatson - Jan 23, 2012

Congratulations- nice work. I would also love to know what the url/string was. grats again.

* - zer0pwn - Jan 23, 2012

Hey!
Nice work man!
Proud of you :)

* - ‎Cloud - Jan 23, 2012

Wow, that's probably the greatest achievement I've ever seen on this site. Congrats mate!

* - kray - Jan 23, 2012

Great Job! I gotta find me some exploits in google I need the money!

* - Imurikauppias - Jan 23, 2012

Congratulations!
Good job, what you are going to do with money? Keepit yourself or charity?

* - worldblackstar - Jan 23, 2012

congratulations man. If you dont' mind, then PM me the query .

Once you got the money, go for OSCP certification that will make you professional. If you are rich, then donated to charity.

* - elvinguitar - Jan 24, 2012

Congrats bro! Keep up the good job and enjoy the money.

* - username.txt - Jan 24, 2012

1000 bucks? really? lolgoogle they have more money than the united states, they could give you a little more...

* - Nordic - Jan 24, 2012

Damn man, that's awesome! Do something good with the cash!

* - Shibe - Jan 24, 2012

I just updated the thread. It now shows the Query, and I have linked this thread to the greatest XSS tutorials on HF.

* - Angelic™ - Nov 1, 2012

Gratz on ur achievement brother
:)

* - MaXoNe - Nov 1, 2012

@SquirmyBeast I never saw this , must have missed it , thank bro ,I appreciate it :)