[Wellwhatsgood?]

Hey everyone, just felt like creating another of the trillion XSS threads ;) Anyways, I found a basic xss vuln in Google.com/cars about 2 months ago, and received a wire payment of $1337 + got my name on the Google Hall of Fame list. This has been confirmed fixed by a Google security engineer.

Vulnerable Link; 😊

Code

https://www.google.com/cars/#!search&Make_S=Acura"><img src="<img src=search"/onerror=alert("XSS")//">&Zipcode_S=94501&User+Distance_D=25&start=0&tab=dealer&tknid=56875272

[img]http://codyscreensnapr.netne.net/s/dXCblJ.jpg[/img]

If you look at the tab you can see that's where it was excecuted. Anyways just wanted to show a poc to people who might appreciate it, thanks. 👍

[RebornX]

Awesome work man. I really liked it.
Keep it up.

[Skorp]

They would pay that amount. 🙂

[Wellwhatsgood?]

Awesome work man. I really liked it.
Keep it up.

Hey man thanks for the positive feedback, I really appreciate it :)

[TheNeutron]

Wow, Cool find mate... Congratz, Enjoy the Money ;)

[Prostitute]

did you copy that off oswap? xD swear i have seen it on there

[Apple J4ck.]

Great job buddy, congratz about the money. :)
I have XSS in google as well, I'm still considering reporting it to them because it can only be done with $_POST data so I'm not sure how much or if they will pay me.

[Wellwhatsgood?]

did you copy that off oswap? xD swear i have seen it on there

Nope all mine, found it February 19th, found out it was worth money the 26th :)

[img]http://codyscreensnapr.netne.net/s/HL60Da.jpg[/img]

---

Great job buddy, congratz about the money. :)
I have XSS in google as well, I'm still considering reporting it to them because it can only be done with $_POST data so I'm not sure how much or if they will pay me.

Go and report it, you got nothing to lose :)

[Great Prosperity]

Wow, that was the easiest place to find an xss vuln. Can't believe it existed.

[Wellwhatsgood?]

Wow, that was the easiest place to find an xss vuln. Can't believe it existed.

Haha Yea man, just a simple string that was changed via a drop down menu!

[michael1026]

They've been taking a while to reply to them lately. I use to get a reply the next day.

[zeru]

great job man i would give a lot to be on the hof

[alignment]

Do you get the reward on paypal?
If so, i may report a few.

[Sonics]

Great job man! You get a beastly backlink for the HOF too! :P

[Hikki]

Congrats. I also found one in Google. So sad someone already reported it. Lost 1337$. I also posted a thread here on HF.