Episode 177: 2x Google RCE with VRP Legend Brutecat

I don't know, I can't remember any dates or whatever, but I can remember, I can remember that weird header, or that password. I can remember the password of my first domain admin that I popped, you know, like, but I can't, I can't remember. I don't remember my, I don't remember my own mom's birthday, but I remember, I remember this. Hey, what's up guys. Before we get into the show, I wanted to mention something super quick from our friends at ThreatLocker. And I actually think you're going to think it's pretty awesome because so much of bug bounty is often, you know, kind of quoted as like, yeah, the hackers will never exploit that because they can just get in via phishing. Well, that's actually true. You know, most of the time, whenever companies get breached, it's because of phishing or access to that user. Or, you know, they do something like do a whole bunch of push notification to FA and eventually a user gets so much fatigue, they approve it, but they have a solution for this. ThreatLocker has a thing called zero trust cloud access, right? Which prevents access to cloud resources or SAS resources based on the device you're logging in from. So if a user gets phished, right, they put in their credentials, they get phished or they get phished. They, the attacker has their credentials. Maybe they even have a way to get the MFA because they did some sort of SIM swap because they have a hookup at Verizon. So, you know, I don't know. I don't know. I don't know. Or AT&T or whatever. Right. So they have the credentials, they have the MFA. They still can't get in because the zero trust cloud access like will basically straight up allow or deny people access to resources based on the device you're logging in from. So if you're an enterprise or a company and you're concerned about the highest risk, which really is phishing, this is a way to add another like basically impenetrable layer to preventing it and securing your network. Yeah. Back to the show. All right, dude. I guess we'll cut right in. I don't know, man. If you want to release the episode, we'll release the episode. But this is some crazy shit you're about to talk about. So Brute, thanks for coming on, man. I really appreciate it. Obviously, you've done a lot of to be honest, that one blog post that you put with the rec to proto was like an life changing thing for me when hacking Google. So you have nothing to prove, but the tradition is the tradition. So let's go ahead and start off with a bug. Before we get into your introduction. So thanks so much for having me in the pod. So yeah, the first the first bug I'll cover here is remote code execution in board grants, Google Cloud production. So this bug is actually super interesting. Like it's my it's my first RCE. Well, it's two RCS. But the way I found it was so I had this whole AI scanning like setup, right. So my AI scanner would scan like all the API's in and dark dark Google and it would let me know if like any of them have a potential bug, right. So this scanner actually notified me about few endpoints in this API. So cloud CRM IP front end PA.google API. It's a mouthful. But yeah, this, it was super interesting, because the first endpoint I found was like this endpoint, it took in like a guy ID, and it would return an email. So this kind of like, reminded me of like my old research or whatever. So this by itself was kind of cool. But I looked through the other endpoints in this API, right. And I saw some really weird endpoint, there's like this endpoint, where it was called get proto definition. So in Google, right, everything is protobop, right, literally everything. So even the request that you send, it's just protobop support message, right. So if you can meet the type of this protobop message, you can then use this get proto definition endpoint, it would just dump the whole protobop. So that was super useful. But I asked, I asked Sam, and they're like, Nope, you're not allowed. So I got stuck there. But I would have loved to archive this for the whole Google. Yeah, oh my gosh, dude, I that I have chills just thinking about that. Like, now every every because like, to be honest, man, one of the hardest things about hacking on Google is literally just dealing with the proto JSON protobuf nonsense that they kick out all the time. There's so much obscurity in there, that, you know, it's just, it's horrible. So I mean, having the keys to the kingdom like that, that must have felt great. Exactly. And I think that's mostly Google is people think it's a hard target. But I think it's just security by obscurity. Yeah, for a lot of it, because how do you how do you know which endpoints to hit or whatever, it's sort of like a traditional target, in the sense that most other like apps or whatever. In this target, it's super weird, you have to just recon is like the probably the most important thing in Google, right. So that's why that's why I published the direct to proto research, which is essentially this tool where you can hit any endpoint and uses like JSON plus protobuf. It's like this GSPB. It's like a super weird content type. But for some reason, Google's back end will like leak a bunch of error messages. So you can like probe it with with like random payloads, and it will start dumping like everything at once for about so you can you can use this and like build out the whole request protobuf with this, right. So this is super useful for a lot of my research. But the only problem is that it only works for API's that have this specific content type of name, right, right, which a lot of API's don't. So this would have allowed for like dumping the protobufs for those and or even batch execute or these kind of like weird API's they all they're all protobuf. But how are you supposed to know, like what each parameter is, it's just super confusing. But yeah, with this, you could have done that. So I mean, I did I did use it a fair bit for here and there for like some of the research I'm working on to to kind of like see what each of them are. But I couldn't I couldn't touch too much on it. Yeah. But anyways, I looked more at this this API, right, because it was super interesting. And I saw that there was like this weird endpoint was called like list quota queue. So it was taking it like a filter parameter. So in Google, right, the most annoying error that I keep getting is like invalid argument. So for hacking, like server side, you just use it's a super generic error, it doesn't it doesn't tell you anything. If you hit the same error in like, like intranet inside Google, right, it will actually dump the full stack trace. But yeah, if you're looking for like, you know, like, you know, if you're looking for like, you know, like, you know, like, you know, like, you know, like, they don't they don't get that. So we're kind of screwed. That's interesting. So I was looking at like the parameters that I could supply in this API. And one of them was like a filter parameter, right? And filter usually means like, it's, it's just, it usually follows some sort of like AIP standard, right? So I looked up the standard of this filter. And I was trying a bunch of stuff, like I tried like, various different things. And eventually, I tried like client ID is greater than like 123 or something that just worked. Oh, my gosh. So this is like a filtered language. language that you're getting in here that you can inject. Okay. Yeah, it's some sort of, I'm not too sure how it looks like in the back end. But I assume it's just some implementation of this AIP. Right? So because everything in the AIP seem to work here. So yeah, I tried this, but this Yeah, okay. Interesting. Yeah, yeah, I tried that. But the problem was, it would say some error, like, oh, this, we can't we can't convert the response to JSON, because I'm guessing they didn't, they didn't set up like a JSON, like a convert version thing for this. I didn't didn't have like a protobuf or something for this. So yeah, that was a problem. So I didn't, I didn't know how to get past that, of course, then I kind of realized that, yeah, I can just use like alt equals to proto, right. But even that had its problems, because you can't just supply protobuf in like a JSON article. Okay, so this is endpoint client six on Google. Right. And client six on Google com is like an alias to Google API. But the difference is, you can use cookies with it, right? That's what's kind of useful about. But the problem is, you can't use protobuf. Like, direct kind of protobuf responses directly into client six on Google, because Google freaks out about it. Like, I'm not too sure why I'm assuming some sort of like, like XSS prevention. I don't know. But there's they don't they don't allow you just there's some like, when you say protobuf responses, you mean like, like binary protobuf, not the proto JSON? Yeah, exactly. Okay. So they just freak out. But so I remember this one trick, right? So I'm sure you guys know who is equal prayer is? Yeah. Oh, yeah. Yes. Okay, so I love this guy's content. So I like I hear like some random video uploaded, like I think one of his talks in in bug squad, right? So I literally went through every single second of that whole talk. And I took down those and everything. Everything is a gospel. Yeah. So I was taking notes like constantly. And one of those notes and one of the second of his like, hour long video was this this header, x gook and code response if executable basic support. Wow, dude. Okay, okay. So now you've got this header that allows you to mutate the protobuf that's coming out of the back end. Yeah, exactly. So it converts it to base 64, which is allowed for the front end or whatever. So right, it's allowed for client six on Google account. So once I had this, I could I could then dump like the response in basic support. It was massive, by the way, it was like, super big. I think the server took like 10 seconds to even respond back. And then I just use like, the protoc command line tool, I just like dumped everything. I mean, I was able to also use the same protocol definition, I could just use that it's kind of fine. The broader definition of this and then, and I was able to decode it back. Wow, did you so so did you get to this stop, like point where you needed that header, and then you went and did the research to find it? Or did you already have that research, like saved off? And then you just like, when you were kind of scrambling, then you found it? I mean, it just came to me because I remembered, I remember, I took down all the notes, right? Yeah, basically, you had it up in the noggin. No AI there. Just he had it. That's the classic. That's the classic, like, you know, hyper focus hacker mentality is like, I don't know, I can't remember any dates or whatever. But I can remember, I can remember that weird header. That password, I can remember the password of my first domain admin that I popped, you know, like, but I can't, I can't remember my I don't remember my own mom's birthday. Exactly, exactly, dude. It's that hyper, hyper hacker focus. That's a great tip, though, when converting, you're getting raw protobuf out of a, you know, client six dot Google, right then. So, you know, you can get this out with this, which is pretty cool. And so let me ask one clarifying question here though, because you said Google APIs, right? That's of course, Google APIs and client6.google.com have a relationship there. Were you saying that googleapis.com, you can get the raw proto out, but you can't do it on client6? Yes, but you can't use first-party authentication. This whole endpoint was working with first-party auth, which is a cookie auth, right? So you can't use it with Google APIs. That's a problem. Okay. So if you tried to hit the same endpoint on Google APIs, it wouldn't work because first-party auth doesn't work there. So you had to do it through client6. Exactly. Okay. Yeah. Wow. Very interesting, man. You know a lot of these little quirks of Google. This is, once again, I can't believe you're sharing this, but thank you so much. This is very helpful. So, all right. You finally get the response out, base64, you proto C to get the action. So inside there, it was a bunch of random stuff, random workflow, internal workflows. So I was looking at what exactly it is. It seemed to be some sort of task. So if a Googler can configure a task, right? And then this is the execution log of the task, right? So I was seeing some weird spanners syncing to Salesforce. So spanners like Google's internal database, I mean, they have a cloud product for it as well, but they use this everywhere. So it was already quite interesting. So, okay. At this point, I already reported it because like, I don't want to touch too much. Like I've had experience in the past where like I went too far or whatever, so I don't want to risk anything. So I just reported, then I keep looking after that. Right. So I sent the report, but then I wanted to see like even deeper because see they're executing tasks here. So can I execute my own task? Because that was, that would be pretty interesting. So I looked through the discovery document, right? So I was scanning through the whole document and I noticed like one thing that was super interesting, generic stubby type task, B2. So this instantly set off like red flags for me because, so if you know anything about Google, right. So stubby is their internal RPC format. So just like a refresher or whatever, if you send any requests to a Google API, right. It's actually just sending to some sort of RPC. So some of these RPCs are like exposed or some of them are internal, right? So this, so let's say, let's say I send a request to like compute.googleapis.com or whatever. So that server that's handling that, that org, the org task or whatever, it can also fetch like other RPCs to fetch whatever it needs. And then it returns it back to you. Right. So it does this through stubby using a production account. So something, like whatever prod.google.com. Right. So if you can somehow like execute arbitrary stubby queries, you can reach all these internal RPCs that would otherwise not be exposed publicly. Wow. Right. So it's a massive risk. So it's kind of like an SSRF at Google. Cause I know they famously told me like, oh, we don't really have SSRF, but being able to make arbitrary stubby RPC calls is basically the equivalent of an SSRF at Google. Right. Yeah, exactly. And in fact, I would say like an RCE in Google, most people think of RCE as like, oh, I've, I've shell access to the server. Right. But in Google, it doesn't really work that way. Like even if you have remote code execution on a board task, which is like, if you, if you mentioned like any sort of Google application, if you get code execution, it's on the board task, but what is the real impact there? Sure. You can see what's being processed locally, but that's still like a sandbox environment that the real impact here is the stubby access, which is why they pay so much for, for stubby. Right. Okay, guys. So we really need to take away from this year that anytime you see stubby, you need to be very interested, which is very interesting because I actually one of my bugs that I've had, I submitted recently to Google, it utilized a stubby endpoint. And I was like, I don't like, I don't know why this works, but it works. And so anyway, we'll have to compare notes on that afterwards, because I haven't gotten any disclosure permission on that. Maybe you can do something with that, that I couldn't. But that, that is really interesting, man. So just to clarify, you know, traditional architecture for RCE is, you know, you get a shell, you take over the server, whatever. Google infrastructure architecture is a little different. All of these APIs are being mapped back to a central RPC sort of environment. And you know, typically it's taking an API endpoint and mapping that to an RPC call, but there might be some scenarios where you can take a API call and map it to an arbitrary RPC call. Right. And that is where you get RCE really impactful RCE on Google. Is that, is my understanding that correctly? Yeah. If they have some weird proxy thing, which just proxy stubby queries, exactly like, like this kind of sounds like it would do generic stubby type tasks. Sounds like I can just send anything I want. Right. So it was pretty interesting. Yeah. So I was looking forward to this and I was trying to see, okay, is there a way I can like configure this task or whatever? Right. So I tried, I tried like creating a task. And at first I wasn't able to, it was like, I had to fill in like this whole like payload or whatever. I have a discovery document, but you see, like, you still don't know what to like put in there. Right. So you can have the comments and kind of hint that you weren't putting there, but still you still have to guess the parameters half the time. Yeah. So I was trying a bunch, but I wasn't able to do it, but I noticed, like I was constantly getting invalid argument, which is a generic error, but I looked at the workflow execution log that I leaked earlier. And I saw like, there was like some client ID default there. Like, I'm not sure what that means. So I just copied that and pasted it and it just worked. So I was able to create this, this workflow. Right. So, so once I had the workflow, I mean, I was, I was trying to, okay, can I just run this workflow now? But no, it's not that easy. When I try to run it, it tells me, oh no, you have to publish it first. Right. And when I try to publish it, it tells me, oh, sorry, you, you, the publisher can't be the same as the last editor. So this kind of stopped me because I thought that, oh, it was even saying something like, oh, you have to raise a request for approval. Like, what does that mean? Do I have to like send you some Googler and have them approve it? They're not going to approve it from me. So yeah, I, I, I kind of hit a roadblock there. I was trying a bunch of different stuff to kind of bypass that, but I was, I was really stuck here. So I was stuck here for maybe like a month, right. Literally like a month. And, and because of the original report that I did, right. When I, I initially just leaked the workflow execution logs. So they were really like starting to patch out all these endpoints. So that was like a big problem for me. But anyways, like I was in some random like discord chat, like just out of nowhere. Right. I just happened to ask like another researcher in the same discord group that like, Hey, do you need, do you need any protoboffs or anything? Cause I have like an endpoint. I can just get any protoboff for you. Cause they didn't like fully patch it yet. Right. And then it turns out this guy had the exact same thing. Like I was like, what are the odds of that? Like some random guy in a chat has the exact same endpoint. And then we started DMing. I was like, is it, is it the cloud CRM API? Yeah, it's the same API. And then, and we realized we were stuck at like two different points. Okay. So he was kind of looking at it a whole different aspect. I didn't even like think of this. So he realized that this API, right. It's very similar to this product called application integration, which is like the public GCP product, right. It's like the internal version of it. And he was looking into this application integration a lot. So he found these same endpoints from the JS files of that product. Does that make sense? Yeah. Yeah. Where, where did you find this guy, dude? Bro, I, I, I just introduced him, like not that long going by some friends. Oh my gosh dude, that's crazy. And it just happened to me. It's not even like, yeah, it's just. There's a lot, there's a lot of sub communities, Justin, a little, little sub hacker groups, you know? Yeah. And, and Brukat, you acted like that was kind of an anomalous like thing that you all had found the same thing, but literally every time I messaged you with something, you're like, oh yeah, I already know that. I've already seen that. Yeah. Same, same. So it's like, yeah. I'm pretty sure that's not that uncommon that, uh, there's an intersection there finding the same thing. Yeah. But you know, but it's different if it, when it's us to Brutekat versus Brutekat. That's true. You know what I'm saying? Like you gotta, gotta, gotta give, give credit where credit's due here. Um, okay. So this is the internal version of the public, um, service for running these, uh, you know, application integration tasks. Yeah, exactly. So I was looking, I was looking forward to it. So he was able to, but he couldn't figure out how to create the workflow because he didn't know that client ID thing. Right. Cause he wasn't able to leak the whole workflow execution log or whatever that I was able to do. He was, he was trying to get like different parameters. He could just never create the workflow and kept saying invalid argument, but I knew how to create the workflow, but he knew how to kind of get past that because he was super, like he knew this whole product, like at the back of his head, like he, like he completely knew application integration, but I didn't know anything about it. So he, I sent him like, we compared notes. I sent them exactly how to create the task. Right. And then we were working together. So, okay. So at this point we had a, we had a bit of a problem. So, so while I could create the task before, but I can't actually do that anymore because they, they patched the end point, right. It's just, it's just the return permission denied because, because of the patches of the initial bug that are important. So we were trying to see like what ways we can do around it. So for some weird reason, this, this API is kind of weird. I've never seen this before, but they have like duplicate end points. So they have like the, they have like, let's say get pro definition and then that one's blocked, but work close support slash get pro definition. That, that one works fine. And all of these were in the discovery doc. Yeah. All of them, they're all, they're all the discovery. Wow. So yeah, so I found that, but the problem was the only end point that didn't have a counterpart was the create workflow. So we were screwed. Yeah. So we were, we were literally stuck in, but then I, then I said the thing that like shrug, cause he was like messing around with it. And so he created the workflow. I was like, what? Like, it doesn't work for me. How does it work for you? So then we realized that like the, the fix wasn't like rolled out to all the Google servers. So like he was from Canada, right. So it worked for him, but not for me because I'm from Singapore. Right. So that was super interesting. So he was able to like reproduce it super easily. He's able to create the task. Then, then we realized that he sent me like, so Google has like this, this, their DNS system is kind of interesting. So depending on like which IP address you resolve, like www.googleaps.com, it like returns like a different IP address. Right. And this IP address is linked to like a, they call it like a 1E100.net domain. So it's like something.1E100.net. So basically he sent me his 1E100.net domain and I, I put it into my like burp or whatever, the target, and I was able to do it easily. So then we were like figuring out, out like this whole thing to create this task. So that way you can sort of pin what, what host is dealing with your request. So you, you can buy as direct as that. It's just kind of like, you can pin it to a specific country. I would say it's not like a specific server. Right. Yeah. Okay. So yeah, anyways, we, we were trying to figure out like, like how can we like publish this now? So he realized that we could like add like a different guy up to some ad ACL endpoint. I got, I didn't even notice this. I don't know. I don't know why, but he could like add a different guy there. Then you could use that guy to approve your own integration or your own like workflow, whatever. And then you can like publish it. And then we ran the workflow and it actually executed. Oh my gosh, dude. That's that you must've been so like hype when that adrenaline rush was crazy. I I'm sure you just, at that point you just like flip your desk and you're like, oh my gosh. So what's crazy to me though, is that he knew, you know, how, how to change that. Um, access control, uh, that ACL, um, and I'm trying to find it. I've got this, you know, the write-up open here. Uh, but it, it was like a pretty obscure key that he needed for that. So, uh, I'm, I'm very curious how he came up with that key. Um, but I guess that's a little part of it. He was just guessing. Yeah. Wow. Yeah. We're just, we're just playing around, trying to see what works. Wow. Yeah. And, and I guess there's probably maybe these set of strings as well in the, um, in the application integration. App in Google cloud. So maybe he's kind of taking some of the stuff from there and then trying it on this, uh, you know, internal version. Exactly. Right. And, and actually another thing is the, for the stubby task, right. We had, we had to fill up the parameters for it. So it wasn't as easy as just like executing the task. Like what do I put inside this task? It doesn't, there's no documentation that I can refer to for the parameters. So we actually figured out that the application, the public application integration, if you tried to configure the task there, it wouldn't work because it would like leak this, like the parameters, it would tell you, Oh, you need this, this like a server spec, or you need this method parameter. So using, using that, we were able to slowly piece out exactly what we needed for the request. Then, then we also figured out, like, we looked through like random discovery documents and we were able to find like some random GSLB address, like GSLB alkali base, that's the one we use and, and like, so is equal Pereira, but you remember, like I mentioned that he had this like RC from super long ago, so we look at the write-up for that and we just like took some random stubby method. I think, I think we use like a server status, like get services, right? So we took that and we tried it and that's how we managed to get the whole thing working, dude. Wow. Yeah. Wasn't there some other bug or something, Justin, at one of the live hacking events we were at, or someone used a GSLB address and they had to like also find it or dude, I don't know, to be honest that that is so far over my head with some of this stuff. I don't think I even remember it. So, uh, that is really impressive that you guys were able to piece that together. I guess I need to go back and review some of this stuff. I'm going to go back and look at some of this guy's, uh, you know, YouTube videos or talks and stuff like that, because there's gold there. If you, if you know where to look, apparently. So. For the, for listeners that don't understand, like GSLB is Google service load balancer. It's like their internal DNS sort of thing where you can sort of reach this specific host. So Alkali base is, is like this. Okay. So Alkali is Google's internal framework for like creating API. So these APIs have to be super insecure. It's like this, it's like an easy way for a Googler to spin up an API. It's like a dev thing. So historically they've had like. Yeah. So many bugs, but yeah, we just happened to find this, this one address. I mean, it could work for different ones, but, but yeah, so we, we had this working, but like, and we sent them to report to, to like Google, but they, they like told it like just one hour after we send the report. So we realized that like everything stopped working because the fix is fully rolled out. So if we had done this like one hour later, we wouldn't have been able to prove anything. No way. That's crazy. It was super clutch. That is super clutch. For stuff like this. I can't. I can't help, but think, and some, and some of the stuff we're gonna talk about later today with like the reports you put in, like some, some of the write-ups you have are like, you know, three reports covered this and paid out a total of, you know, $30,000 or whatever. How, how do you decide kind of where I like on Google specifically where to draw the line with like, why, like, why would you throw it all in one report versus why would you kind of break it up? Cause like this one, like, I'm curious, like once you all got that stubby, uh, that stubby RPC call working, did you just throw it on the report you already had? Or did you all submit another report? You know, I'm just really curious how your mind thinks about. Like when to combine them versus when to report them separately for Google's program specifically. So that's actually a really good question. So you have to be kind of careful here. So generally, okay. I would say in this specific case, if I tried making a different report, they would kind of like lump it all together because it's the same API. Right. So there's no, there's no point of making a different report. It's going to get duped like the previous report's going to get duped or something, or the new one might get duped. So if it's a SIEM API and the API is pretty small, like it's just a couple of methods here. Like I would like, I would like to think that you should probably just do it in the same report, but if it's a pretty big API, like maybe like a hundred plus methods, I would split it up into different reports. I mean, it's really, it's really nuanced. It's hard to like tell straight away. You could, you could be losing out on bounties. Like in this case, like the initial bug I reported, I don't think they paid for that. They just like the RCE, like overrode and everything. So you have to be a bit careful there. Wow. Yeah, dude, it's a little tricky, man. I'm running into this a little bit with Google too, is like they, they actually do pretty decent due diligence when you submit your report sometimes. You know, and they'll fix stuff that's adjacent and, and, you know, same, similar root cause stuff. So a lot of that stuff will end up getting duped back. But I, but I also feel like just as a critique of the Google program, I feel like that is not incentivized as well for you to like prove full impact across multiple different environments. Right. So if you've got, you know, eight different things that are vulnerable here, you're not really, they don't incentivize you outlining. That in your report very well, you know? Exactly. That that's super well said. Yeah. So, so I would like for them to, I would like to see either a multiplier, you know, they, they do multipliers for their report quality, which I think is a super important thing to, to, to do. Um, and they do multipliers for other stuff, but then I think they're sort of, um, on the fly, uh, you know, at will, uh, extra bonus that they can add for things like, you know, having multiple instances that are vulnerable. Uh, yeah. Is very limited, uh, you know, a grand or two. So I definitely think a multiplier would be there. So it would be better there so that it, it kind of encompasses the impact that you can have if you've got a massively, you know, critical vulnerability that spans multiple different, you know, API endpoints or services. So generally in such cases, right. What I actually do, if, if I find like two different bugs and like, let's say I find the first one I reported, but the second one doesn't help me get any additional impact. Yeah. Like it's just another different issue. So I'll actually just not report the second one. Yeah. I'll wait till. They fix the first one, then I'll report the second one. And that always works out. Yeah. Yeah. And I think if anybody's listening and thinks that that's like weird or offensive, this is like exactly like you want to create a system. Like we should all work towards creating systems that like encourage the most ethical behavior, you know? And so like, you know, I would tell Google or, or, and I know people that do the same exact thing on hacker one programs and bug crop programs. This isn't exclusive to Google. Like hackers are obviously going to try to provide the most for their family that they can, you know? And so that's the way the system should be set up. And so. You know, what should actually happen there is you should be able to report both of those and they treat them independently or whatever, you know, especially if they're separate fixes, which they obviously were, but could you just prove that by waiting? Right. Right. Yeah. And, and you give them the opportunity to realize that, Hey, maybe the due diligence isn't always done as well as it should be. Right. So, so, you know, you shouldn't always do these back, right. Uh, because look now I've just reported another adjacent service and that, that is, you know, not fixed. Right. And, and so, um, yeah, I think that that. It's a little bit of a roll of the dice, but I think it's a little bit of a roll of the dice, but it's a little bit of a roll of the dice, but it's a little bit of a roll of the dice. It's the best way to show exactly whether the root cause analysis that they're doing is producing the results that it should, right? I know this doesn't always work, but for the most part, what you should try to do, at least for Google, is, I mean, at least for now until they change this, but you should try to find as much impact as possible, right? So, like, even if that means, like, sitting on it for, like, a day or two, just try to find as much impact as possible, report the most impactful thing, and that's it, right? So, then you can, like, wait and report this, like, less impactful stuff if they don't patch it. So, that way you can, like, save yourself. Yeah, I totally agree. So, that is, so, you know, calling that service list on the prod probably got to be such a crazy moment. You must have been so hype. But that's not the end of the story here. So, tell me how this continues to get another crazy bug out of Google. Okay, so, when we first tried, when I first saw this RCE, I was super tempted to, like, play around with it and stuff, like, oh, can I, can I, like. Yeah, I was quickly told that, no, I should just, like, stop touching this. But, yeah, so, I had to leave it there. So, I was kind of sad because I really wanted to try all these, like, internal, like, RPCs or whatever. I've collected them over, like, I guess, like, the year or whatever that I've been hunting Google. So, I wanted to play around with them, but no, I couldn't. But anyways, that's why I was, like, working on a bunch of other stuff, right? And, like, maybe, like, three months later, I was, like, improving my scanner and I was targeting Google Cloud at this point. So, I was on Google Cloud APIs. And for some reason, this integrations, application integration, like, popped up again. So my scanner, it out. There was this problem across the whole application integration API. So you could put slash project slash your project number, but reference someone else's UUID, and it just works. It's like some super dumb ID. And this works for all the endpoints in this whole integration API. But the problem is, how do you get this ID? Because this ID is like a UUID. So I was going to screw you. Because if you just report this by itself, it's not going to be too impactful, I'll say, because there's no way to prove to go that UUID. So they're going to downgrade it a lot. So I was saying, okay, is there any way I can sort of beat this UUID? So I was looking through the whole application integration, and this is where I was really playing around with it. So I saw there's this feature called test cases. So you can create a test case for your integration. So just for anyone who doesn't understand, application integration is kind of this no-code automation workflow. So you can drag and drop stuff and connect them together. So let's say I take something from one place and send it to another place. So that's kind of how this application integration works. So they have a test case feature where you can create a test case for a specific integration. So I can test just this one part of this integration. This is like a send email task for it. So I can create a test for that and test that. But this test case thing was super weird. So when I created my test case, I looked at how it was listing the test cases. So it was like some RPC, list test cases. But then I decoded the protobuf because it was sending in protobuf. And I saw it was sending workflow ID equals to and then my workflow ID, as some filter. So that's kind of how this works. But why is it a client side? That should be like server side, right? So that was super weird. Then I was like, okay, so surely if I remove this filter, it's not going to dump everybody's things, right? So I just removed the whole filter and it just dumped the test cases for everybody in the whole GCP, right, who uses this product. Holy crap, dude. That response size on that must have been massive. Okay. So yeah, it was pretty massive. I think there was like a page size or something. So I had it set as like 1,000. But yeah, I got a super big response. And I was like, okay, I'm going to try this. I'm going to try this. I'm instantly know like something is wrong and i can see all these like at google.com because it's like all these googlers have been like their own integrations oh no that's crazy dude oh my gosh so i would definitely have just submitted it there it's really it's really funny to me that you're like no i need to get this uuid out oh yeah i'm not gonna like i don't want to stop there because it's not going to be a good bounty right i want to escalate the impact as much as possible right until before i report so i was trying to see okay can i get the ui from this because now i leaked all the test cases right it should be in the path but for some reason there's like a dash there like where am i like ui the ui is supposed to be it wasn't showing it so i was i was kind of stumped here like because i i thought i could stop it and get it working but no so i was trying to see okay what what way can i have around this okay so right now what i can do is i can list all the test cases i can execute the test cases using the test case id with the same dash as the integration uid but i can't actually like i can't actually get the whole integration because i can't get the integration uid that makes sense so i was trying to see how i can leak that yes but then i realized wait can i just use the same filter parameter as earlier and then just do like a binary search on that so i can fix it to unknown test case then i can just use binary search and like keep trying all the different stuff until i can leak out the whole uid off that like of the guy who owns the test case wow does that make sense yeah that makes sense prick i love that man i love those filter injection you know filter based binary search things those are amazing it feels so good when you pull that off man oh my gosh yeah i love it no literally so i had like i had a cloud like right up the the whole script and it just did like first try and i could see like the little animation of it like slowly burning it it was it was awesome oh my gosh dude i haven't had one of those since claude has been around but i i do remember the last time i coded one up manually and i finally the last time i did it you know it required a bunch of weird you know statements in there with like different parentheses to get the order of operations correct and it was like when it finally you know you could tweak one variable and it would you know show yes or no i was like oh my gosh yes so it's amazing i would have i would have never thought to use this on a uid for some reason like i just wouldn't think of it as being something that could be binary searched with like greater than less than but clearly it can no because it's the same it's the same filter aip thing right it's all the same thing yeah so you could use the same logic there and do the binary search i mean i was stuck here for a while and i was like oh my god it took me like maybe like a day to figure out this this whole binary search thing i don't think even claude figured it out like i had claude like working on this like can you can you try to escalate this impact can you try to like see if there's any way we can leak it but but no but but i had to manually figure this out but yeah so once i once i had this working i got the uid i was able to then do idors across this whole thing so i could i could just take over some guy's integration i can like view all their integrations i can i can do all this kind of stuff but see remember earlier right those test cases had like add google.com or something so i was thinking what if what if like there was like these internal integrations or whatever but they're not they're using this application integration but they're using some sort of internal task type right can i like somehow like use that and like steal their integration and execute that task time so i was trying to see up in that angle right but i had to be a bit careful as well because i you have to draw a line right i can't i can't like i can't like iterate your customer data because they're gonna like they're not gonna accept the report so i had to send everything i had so far and just and like and just tell them to look for it but like i wasn't satisfied in that way so i had to send everything i had so far and just and like and just tell them to look for it but like i wasn't satisfied in that way so i had to send everything i had so far like i don't want them to look for it i wanted to find it myself so i was looking deeper so what is exactly stopping me from creating my own integration if i try to create an integration with like the same stubby type task is it what is stopping me from having from doing that so i tried it out and i was actually able to create the integration but when i try to execute this this integration it will just like time up like it'll just say oh like this this thing is timed out after like 120 seconds and it doesn't say anything else so it's kind of vague but i looked for my stubby integration and then execute that test case so okay at first i was playing around with all the different internal test times i wasn't even playing around stubby i was doing some weird python task or something so i was trying that python task then i got some like super like so when i when i when i press the play button for the thing the test or test case i just made i got some super suspicious like error like like insufficient like disk space or something like it's it looked like some like linux error the standard letter when you ran out of like space in there's something weird here so yeah i was then i was looking at like okay so this is probably reaching some sort of like execution back end right yeah i think that's the error here no space left the device gosh dude what no space left yeah java io exception no space left on this is the sketchiest thing ever wow it was showing the ui as well like a big big red like notice oh like no space left the device oh my gosh so yeah then i was like okay can i can i try this this one but the stubby one would just give me some like super generic error i go unknown error and that that's it like it doesn't tell me anything else but i figured out right i could look at the workflow execution logs and that had like a stack trace so i fetched i fetched the whole stack trace and i got some super suspicious error like it was like uber mint verification failed so like it was had an rpc security policy error and it had a bunch of stuff like that so this error in google usually means that like the product counter that you're trying to reach doesn't have like a rpc security policy defined for the rpc you're trying to hit so like it's not wireless for the rpc or something so because i was it's a different product count than the other one right this is like a completely different product count so i'm guessing this one didn't have access to alkali base or what i was trying here so this was this already told me that it's definitely hitting like stubby so i checked with like sam if i could like escalate this anymore like if i can try to keep testing this right then they they like they checked it and it was fully exploitable so i had to stop everything here wow wow dude look at that execute stubby call oh my gosh that is beautiful and and they they said all right back off we'll we'll take it from here dude wow you have to be super careful like if you i've heard of this like this is a good rumor going on around like whatever where some guy like took his rce too far and then they like they avoided the whole thing so i i don't know i don't play too much i better just report this and and let them deal with it so but i was looking at like the like how the source code works because like it leaks out everything in the stack trace so i kind of like figured out like how it's like setting this different parameters and stuff so yeah i i reported this i didn't hear back for like almost a month so i was at this point i was like wondering like did they like why does it take so long because the other one like was rewarded in just a few days but it turns out right this this one got 75 000. so there's like three different tiers in google's like vrp rewards so 50 000 is for like a sort of unprivileged production user right but but if you get 75 000 that means it's a highly privileged like production user and 100k would be like complete like admin in google cloud right and see in many cases in my opinion right even if you have an unprivileged user or whatever you can you can usually like privilege escalate to like different arts like rbcs and stuff but they won't let you test that obviously but it's definitely probably possible so they just look at like i guess the permissions of the product but in this case like i was speaking to kote right they would be they're super big about this they won't tell me more about this even though i keep like pressing them on this but apparently there's some sort of like escalation that even i didn't show here that you could do and you can get even more impact so that that's why they they were ordered the 75k tier wow dude very very cool that is uh quite a story and i think probably this is the longest intro bug that we've ever had in history of critical thinking but totally worth it but completely totally worth it totally worth it man um absolutely inspiring uh a double rc on google yeah dang no that's insane so i did take some notes and i do have some some questions to go back to on this um but before we do that I do want to give you the proper introduction. As we mentioned, guys, this is BruteCat. You can get on his blog at BruteCat.com. On Twitter, it's just at BruteCat, right? Yeah. And you're also doing some consulting now, right? Tell us a little bit about that. Yeah. I mean, I've just recently started doing a bunch of. I started my own company, BruteCat Security. So you can just go to BruteCat.com slash hunt if you want me to pen test your stuff. I have a whole AI thing, the same AI that I use for pen testing Google, right? I've kind of worked that out for pen testing other companies as well. And I've had tons of success with that. So if you want me to run it on your company, just feel free to reach out. Nice, dude. That's awesome. And yeah, I mean, this guy is the pinnacle of Google hacker. I've read all of his blogs multiple times. So dude, really excited to have you on the pod. Let me blow everybody's mind real quick. Literally out here, I was telling my wife that we were coming in. And I was like, yeah, this guy's amazing. He's been hacking Google for forever. He's like one of the goats. And then I see it in our doc, how I got into Google mid-2014, mid-2024. What the heck? Mid to late 2024. No, in my head, for some reason, you're like this always epic Google hacker that's been around for 10 years. And I'm like, wait a second. He started hacking Google two years ago. What am I doing with my life? Exactly, dude. That's how I feel too. Yeah, well, it's funny you mentioned your wife because I said it. I said the same thing to my wife and she knew who he was because I talked about his research before to her. I was like, yeah, man, this guy, BruteCat, he came up with this crazy way to like let me access Google APIs a little bit better. So that's pretty funny, man. Going back to the write-up. So I wanted to ask you a couple of things. One, you mentioned that you were using your AI to guess the parameters for, you know, these requests, right? So what sort of additional information have you given Claude to enable it to, you know, do these guesses correctly? And how do you get it normalized to your account? Like where you have different objects created and that sort of thing? Okay, I can touch on this now, but probably be better if I talk about this later because I have a whole thing I can really explain. You want to cover it in that section? Yeah, yeah, we should probably cover it. Okay, let's do that then. And then the other thing that I had here, you already covered GSLB, but the Google SRE handbook is quoted multiple times in this, you know, in this write-up. I mean, have you just read this whole thing cover to cover? Yeah, I've read it like five times. I mean, the first time I read it, I didn't know anything. But I kept reading it again and again. And not just this. So I read a bunch of stuff. Like I would read like Beyond Prod and their whole documentation there. Like they documented so much stuff. I've even read about like, like as much stuff as I can, all different papers about like, because Google releases a lot of these papers and it's about their whole internal infrastructure. If you can like read that and learn it and bring those tips into the hunting, it's actually super beneficial. Yeah, there's just so much to figure out with Google because it is architected very much, you know, different from any other company that I've seen. Okay, so the Google SRE handbook, you mentioned something called Beyond Prod. And then do you have any other resources that you really gained, you know, got a lot out of when prepping for, I guess, hacking Google infrastructure? I would say that, okay, they do have like some papers on like Chubby or this kind of like internal stuff, but mostly just these two resources that you mentioned. Those are the, if you just want to get started, you should be reading this. Those are like the minimum requirement. Okay, nice. Well, I'm going to go get those. Go read through those. Because I have referenced the Google SRE handbook a couple of times, but I haven't actually like read it. I've read it cover to cover. So I think I'll have to go back and do that. Sweet, man. Well, that was a whirlwind. So just a couple of takeaways from that write up. If you're using client six and first party auth and you're getting a protobuf response, you know, or you're not getting a protobuf response out and you think you should be, then you can use the Google encoded response if executable header to get it out as base64. You've got the whole request proto. We did sort of a head nod to that, you know, because you found request to proto as a service there. But there's this whole primitive essentially gadget that you've outlined on your blog about how to do an error-based oracle to leak the JSON, the proto JSON request structure for these Google APIs requests. And we should be on the lookout. For anything related to stubby, no matter if you see stubby, you need to like lock in because there could be some really impactful stuff there. And it should be said that request to proto is also a project on his GitHub. Yeah. Oh, for sure. Yeah. Beautiful, beautiful project. Anything else that you think we should have as takeaway from that write up? I think it's pretty well said. And like you mentioned, if you see any sort of stubby, right, you should try to find a way to reach that. Like there's so many like potential, in fact, if you look at all the discovery documents, if you try to grab for stubby, you'll find a bunch of like stuff like that. And you can look at, you can grab for like GSLB, grab for these kind of keywords and see if there's anything referencing that because that could potentially be a way you can get access to this, right? And they have so many like webhooks, like random stubby webhooks. I'm guessing the Googlers made it to make their life easier, but the same thing can be used for us hackers, right? So you want to try to find as many of those as possible. And in fact, it may not even be in the discovery document directly. It could be like embedded inside some service. Let's say you, okay. Let's say you're hacking on some GCP product, right? And maybe you've got access to like the tenant project or something, and you have a shell or something. If you see anything inside there that's referencing stubby, that could be another thing, right? It doesn't have to be in the discovery document. - 'Cause they've got to tape this, they've got to tape everything back together with these RPC calls, right? So if you've got any sort of primitive, you know, inside of, you know, the shell in your own org in that product and that thing can do anything, right? You know, then it needs to tie back out to RPC calls at the end of the day. And if they don't do that in a secure way, then you could get arbitrary RPC call execution. Very interesting. And then the last call out that I had here that I did forget in my notes was, take a look at the AIP 160 filtering spec and just realize that that is something that is used pretty widely across Google, because you can run into these bugs where you can create these, you know, filter binary searches, or at least, you know, be able to notice when there is a filter being used. And you might be able to use that to access other people's information. One thing, one takeaway I had, which I always associated with like old Yahoo stuff is just that is the whole load balancer thing. Like, you know, I don't think that people should intentionally try everything like from different regions or a hundred times or whatever, but I do think if you ever try something and it works and then you're, you know, later on, you're trying to reproduce and it doesn't work, you can think about the fact that, oh, maybe it's because I was connected to a VPN or maybe, you know, maybe if it's working for a buddy and not for you, you know, it may be due to the fact that it's going through like a different load balancer. - Yeah, I need to send this request like- - Yes, the way, yeah, exactly. See, the way Google does their requests, right? It's like, they do a fix. Let's say you report a bug and they fix it. Like their fixes roll out gradually. It's not like an instant rollout for many cases, right? So if you can, you can use this trick usually and find like some post or something that you can use to route a request through and reach a server that hasn't had that fix rolled out yet. So this is like a way to kind of bypass it temporarily. - Very nice, man. Very nice. - Cool. - All right. So let's jump into how you got into Google VRP and it starts with a obsession with YouTube. It looks like, which I think many people can relate to. So give us that story. - Okay, so it wasn't necessarily obsession with YouTube, but that was pretty related. But it was mostly an obsession with like OSINT stuff. So I was, okay, I was a complete noob, by the way. Like, I didn't know like anything was going on. Like, I just wanted to, I thought it was super interesting that these like OSINT tools existed. Where you can sort of like find out information of any guy you wanted, right? So I wanted to see, like Google was pretty interesting because if you can, everyone has a Google account, pretty much, right? Like I don't think there's a single person that doesn't have a Gmail, right? So if you can somehow like leak information off the Gmail, like maybe have a maps review or like a play review or something, that'd be pretty, it's pretty fun, right? So I was looking into this, right? And I saw this like this random website, like, okay, I think it was called OSINT Industries or something, but this website was pretty funny because you could input an email and it would find the YouTube channel tied to the email. So I was like, how does that, that work? Because I'm like, actually you can dox me from that. - You're like, that's a bug. You're like, I know, that's a bug, right? - Yeah. - Yeah. - So, so yeah, like a lot of these OSINT stuff like relates to actual bugs, but, but yeah, I was like kind of, I was super interested in this. I was like, super obsessed with it. I was trying to figure it out. Then eventually I think I went to some like super ancient, like Discord server for, for this guy. And I saw some screenshot that he like sent and inside there, there's like a part of his like, his like home directory or something. He has some terminal open and you can see the path there and it said something about profile card. So I was like, okay, this has to be related to this. Cause he was talking about that, that whole YouTube thing, like right before this. So then I was like, okay, what is a profile card? I looked through everything to try to like find a profile card references. Then turns out profile card is like some super weird, like YouTube feature. So if you have like a, okay, first it was only for mobile. If you went to like YouTube and you start a YouTube video in the comment section and you tap on a profile there, it would like load this kind of like mini card and you can like see subscriber or whatever, right? So this is called a profile card. It didn't exist in the web yet. but i was curious how it worked so i set up like a whole like i've written like tutorial or something and i set up a whole link on my ios phone i could like sniff the traffic right through like burp and then i was like looking through all the different requests and it was in protobof so i couldn't read it but i noticed the id there it looked a lot like a gaia id which is like a google account identifier so i was like so i could just pass in any guy id here and it's going to return the youtube channel and then and it worked but i was also thinking if it's able to do that how is it getting the gaia right because surely it's getting it from somewhere and then i looked more into it and it turns out whenever you load the comments of any like channel page or whatever it had the gaia id of every single user like tied to that oh my god see the thing is google they have two different types of guidance they have an obfuscated focus guy id right so most focus of skinny guy foggy that's what they call it but they also have an obfuscated guy right so like the raw guy but the thing is see the many themes the teams across google they think that they can just safely release this obfuscated one but the truth is that you can many times convert this obfuscated one to an email or like convert this obfuscated one to fetch some other information so it's it's like the issue with across the teams at google because google is so big right they don't realize that one team thinks it's it's like it's not safe the other team thinks it's perfectly fine so they they did a massive screw up here like in fact you probably go to wayback machine and look through that i bet you will find a guy id stuff like so many channels there so yeah this this was interesting but so i had this for a while i built it to my little little tool or whatever i could like sort of do that but i didn't even think of it as like a bug i was like i wasn't even trying to find bugs to be honest like hacking google in particular but i was just trying to find these ghosts and stuff but then i noticed they rolled out this fix to like like okay so first of all they've rolled out this feature the web so instead the web you can tap on it and a ton of people found the same thing because it's super easy to like see the requested web as compared to ios right so then they i started rolling out the patches for this like instead of they start they start like supplying the guy id they started like doing some like channel id or something it said like the reason why it was a guy to begin with is because this comments back end in youtube is is like from g plus days so back in the day like they didn't want to like lose those comments that were made in g plus days so they it's like it's still a guy id back end like your comments are tied to your google account it's still tied to your youtube channel so if you move your youtube channel to a different guy account it's gonna lose all the comments because it's all tied to this interesting so yeah i was i was looking at that and then i was able to yeah so they they start they start patch the whole thing and then i was like kind of something i wanted to find like another way to do it so i was looking through like every all the apis like with a friend and we're trying to see like is there any other way we can like click these guys and we figured out like there was this one this one like endpoint if you had a live chat and you like tap the three dots on like a side of like a live chat like on a bloodshot viewer let's say they write a message you type three dots there it like opens this context menu like you can block the guy or report the guy or something and then you can like you can use this block functionality like how does the block work there because like how does it what does the block mean if i block a guy here is it blocked across all of google because then it's tied to the guy id so it turns out if you like if you block the guy and then you look at your list of blocked people through the people api it just lists the guy id there so you just have another way to do it dude that is such a good trick and i've used that multiple times i think i actually shouted it out on the pot a couple couple weeks ago but like going through that like abuse and report functionality to de-anonymize people is super clean and it works almost every time i've ever tried it um that's a that's a big you know sort of conceptual takeaway that spans multiple targets i think so then i was looking at like how this thing worked from the request wise right it turns out you don't even need to block the guy like if you just open the three dots it's like it preloads the guy id of the of the guy and it was even worse because you don't even need a live chat message you can just change the channel id to whatever channel id and it just returns the guy right so oh wow yeah at this point i had the guy id but like how could i get more impact like sure you can you can list like the maps reviews or like the play reviews or whatever but i want to get the email wait a second wait a second just clarifying you said he doesn't even need to comment you can just change the channel id and it drops the guys of every viewer so okay yeah what are you doing yeah say it again i said what do you mean by change the channel id okay so pretty much in the in the three dots right if you just tap on that it loads this context menu for that user right so you can just change the user any user the whole youtube it'll just load the three dots for that user does that make sense he's saying in the request that in the request that gets sent when you hit the three dots if in that request you just change it to the channel id aka the user id of any user then it will just immediately respond with the guy id i see i see okay gotcha that makes sense continue there's always so much assumed knowledge we never you're interviewing experts like when you say channel id to me i'm thinking like channels that people publish from but you know everyone on youtube has their own channel id because like and so anyways exactly right it's funny yeah yeah so yeah i had this i had this like primitive or whatever i could get the guy id but i wanted to see how i could escalate this further so i was looking for like all these different like all the different like apps in google because there's so many weird apps they've had so many leaks before like in the past right you could just you can open like a this is back when google hangouts existed you could open a hangouts chat with somebody and it just returns it just opens the chat with their email if that makes sense so there's probably some leak out there so i was looking through all the super old apps like i found this app like pixel recorder okay it was like this niche app or if you have a pixel phone you can like have recordings and sync it to the cloud so i had this app and i synced it to the cloud and i went to this recorder.google.com or something and at this point like there was like a share functionality so i just tested it out can i can i share what if i shared this recording and it took in the office gated guy id and it returned the the email like it took because it adds a guide and then you could this is the people added and it has email there so now i have the full chain because i could just i could just take the guy id then leak the email and not have the email of any youtube channel or any youtube user for that matter wow dude that that's intense so channel to gaia gaia to email right so you get that chain and then you leak the email out wow that chain is like something that a seasoned bug bounty expert would uh report and it's just his first google bug yeah i know right yeah like that's such a such a crazy thing dude very good work yeah i think the os into background really that's a great that's a great transition right because you're so focused you're focused very literally on like leaking data that is useful you know um so you don't get as many reports where you're like oh i can leak this you know completely unrelated thing you're like oh okay email yep that's useful for sure so um that's a leak leaking leaking into top buck hunters seems to be such a a clear route like there's obviously all the game leakers yeah have done the exact same thing on like uh or fortnite and stuff for sure so then you just kind of after this looking at the doc it kind of seems like you just went ham on youtube right okay so okay but i'm not done with the story yet so it wasn't it wasn't complete yet because see the problem with this pixel recorder was when i shared the the recording or something it's a super long email oh this guy shared a like recording with you so it's it's super like messy like i don't want that the victim seeing that it's the victim sees that it lowers the impact so much right like and my ocean tools like there's like this general rule in ocean where like if you have something that works it shouldn't notify the guy if it's if it notifies the guy it's like a red light so i was trying to see okay is there a way i can like stop this notification i so i tried to see like okay the parameters there's no parameters to like not like uncheck like the notify but i i thought about it like what what exactly is in the notification email right there's a title of the recording in the title of the subject email and there's like the recording like whatever description or something but if the title probably has some sort of limit right if you reach a limit it just probably won't send the email because it's so i just i just like wrote like a 1.2 million character like title and i created the pixel recording then i shared it there was no email i i don't want you building osent tools for anyone okay stick to bug bounty buddy because that if if there are osent uh builders who are out there who are as smart as you they're going to be able to pull off some crazy stuff yeah wow that that is a good i i love how some of the solution could be that simple sometimes you're just like yeah what if the email was really really really freaking big you know like this is making me regret so much i feel like there's so many like sensitive actions that you can take on behalf of other users that are often like mitigated by basically notification emails and now i want to go back and retest all of those totally that was so smart wow great great finding dude so at this point i was like okay this is truly like a vrp like level bug like i should probably report this to google like i don't think i should be having this it looks too broken so yeah i i looked into like like okay like open like a security report or something so i sent in the the report it was like a super like messy report i didn't even know what i was doing so i just wrote out like all the steps of the how to get this working and i sent it off right so then eventually so they took like quite a while to get back i think it was like around like november december of like 2024 or something like that i remember the exact timeline but something like that so there was it took it took a while because it was like a holiday period i guess but eventually they they they took quite a while to get back i think it was like around like november or december of like 2024 or something like that i don't remember the exact timeline but something like that so there was it took it took quite a while because it was like the holiday period i guess but eventually they they they they got a nice cash i had to like debug with the treasure like i think there was like some weird like case where the treasure wasn't able to actually test it and it didn't work for him because he was trying to get the three dots working for his own channel which doesn't work because like you can't open the you can't block yourself you feel me like right you can only block other people so that just didn't work but yeah in the end we started out and it got like a nice cash so this was my very first like google bug right so this kind of got me into this whole this whole thing and i think it was roared in the end like 10k or something right it was a pretty big i mean so i was looking i was looking at more into this thing i was still looking at still focused i wasn't i wasn't i didn't actually care about like vrp hacking entirely so I was looking at like how I can I had this like database or whatever I was like scraping a bunch of YouTube data because it was quite interesting to me getting all this big data stuff like can I list all the comments of some guy right because if you if I if I like scrape all the comments can I like list all the comments for this particular channel so our user so I was like doing that and across from doing that I learned so much about Google APIs right so I think that that knowledge was super valuable so first of all I figured out like what like protobuf and gRPC was like I could hit request directly with gRPC like all this wasn't documented properly like I had to find some like I found some how to RPC like markdown page of like Google release but even that didn't explain gRPC too well like there's a difference between proto over HTTP and gRPC I was using gRPC itself because I wanted this to be as fast as possible because if you're doing a scale of like YouTube you have to it has to be fast then I figured out like oh there's this header xgoog field mask so I can like I could just reuse it to exactly what fields I want right the comment text or whatever and this is where I learned the 1e100. metric where you can load balance across like all different all YouTube normal different posts on Google so that way you're not like just hammering this one host and and Google also had like great limits but at this point I figured out like I was doing a lot of research and I realized that you can use IPv6 right to bypass this whole great limits because great limits are normally per IP address for unauthenticated requests right but they didn't consider the fact that an IPv6 like IPs are super cheap you can just get like a slash 64 or something has so many IPs and billions of IPs and you can just use that and rotate between each IP and they can't they can't stop you unless you do like a subnet ban but at this point that didn't exist so you could just kind of do this and bypass the entire rate limits wow dude yeah I remember back in the day when I was in the recon game you know there was this problem where you couldn't Google dork very effectively you know in an automated way and the solution that we had to that back in the day was get a slash 64 you know IPv6 and then use that to hit Google and and do your do your search until it you know blocks you and then just rotate the IP but I guess I guess they've probably fixed that now with subnet bans oh yeah so the tricks they have now is they do I think it's like a layered approach so if you try to use 6 slash 64 they'll ban the slash 64 then if you try to use a slash 48 like it slowly increases the subnet size of the ban so that I think it's a smart approach but I mean it's still possible to get like a you can still rent out like a super big like ISP level like range or something or if you if you have a shared range with other customers right that could also be another way like it's super hard to block this I don't think IP is a really good way to yeah I mean you can just buy like proxy rotation right through like some of those like more shady services and it will just rotate every request through a bunch of different residential IPs and you'll just never be blocked yeah that's true yeah exactly so yeah that was that was kind of what I was working on but through this this whole process of trying to like how I can get as much information as possible from a YouTube channel I was looking through all the API so at this point I found this recto proto thing right it's like this tool where I can I can just probe I can use this JSON plus protobuf and I can just probe like like one two three four five I just send that in like array and send that to the server it's just leaking a bunch of error messages which tell me the whole protobuf message right so I can reconstruct the whole protobuf that the request has so this this leaks so many like internal things that would otherwise not be seen anywhere right so I went to I was looking through all the channel endpoints and I found this this one endpoint like the get creator channel so if you go to your YouTube channel and you like I think click on the earn tab or one of the tabs it like fetches information about your own channel right so you just get creator channels like endpoint but you can also use this to fetch other people's channels but for restricted fields like you can supply like specific fields that you want to fetch and it would only be like the public fields so I was saying is there any sort of like parameter I can like use here so I leaked I used the recto proto and I leaked all the parameters and I saw something like include suspended is true so that sounds like you would think it means the channels are a ban but that's not what it was it just it just appended some random content owner association I don't know what what this was So I was trying to figure that out. Like it added some content owner association with some ID, right? So I started looking into this. Okay, what is a content owner? And I went through this whole rabbit hole. So it turns out like content owners are like this CMS accounts on YouTube. It's like a Scott Mode account. They give it to a few enterprises and they essentially can strike anyone they want. They can like monetize any channel they want. They can claim your content. It's a super sensitive tool. So this tool or whatever can link channels to it, right? And this would leak the association with that tool. And the way these rights management tools work a lot is if I'm like a big company or whatever and I want to contact another company, I need to like find your email or something to contact it, right? So they have this endpoint, like some endpoint to sort of get the email of the other company. But it's just a conflict. It's like a notification email. You send this as a public email. It's not like some sort of account email. You can put it as whatever like at your company.com, right? So it's just intended functionality. So this is required by the CMS account. You can do it in the first place. But then I looked deeper into YouTube, right? And I realized that, you know, the copyright match tool that a lot of YouTube channels have. So you can see like other people claim your content. Like, how does that work? It's probably just content ID in the backend, right? So is it making a secret CMS account in the backend? And it sure was. So it made some like weird CMS account in the backend. It's like some, like, I guess they had to do that in order to make this hack work to get the content ID working for that. So then I realized that I can get the ID of that, right? And what is the content, the notification email set? For that account? Is it like, cause you can't set that anywhere, right? And it turns out it goes to the account email of the YouTube channel. Nice dude. So I was able to do this whole chain. I could like, I could sort of think this, this initial ID, then I could convert this ID and leak the no conflict notification email, which would be the channels email. And then I had the, I had the email for basically any YouTube partner I wanted to. Wow, dude. Yeah, that is a good chain. So there's that, there's that aspect there of like. How does this value get populated when the account is created automatically? I like that. So, so that's just trying, I'm always trying to take these principles and kind of bring them up to a higher level, I guess. So even in those situations where you can create, you know, let's say an email that's adjacent to, to the one associated with your specific account, if you can figure out a way for that to access it in its default state, right before the user has set it, then that might be, you know, associated with the main account. That's very good. That is an awesome principle. Exactly. Yeah. So that, that worked out here. So I think this one even higher, but either the other one, I don't know, it's kind of confusing because you know, they're, they're abused VRP, like caps out. The first one got rewarded as abuse, but this one got rewarded as like the normal VRP. So it got like 20 K, but the other one was 10 K. I mean, I don't know, man. Like, I feel like they should increase the rewards for the abuse. Yeah, dude, I don't abuse that is one of the things that we've, we've, we've kind of bumped up against with them often. I'll, I'll share this situation that I had. Where, um, you know, I, I was able to enumerate the phone number for any Google account and, uh, but it was through essentially a mat, uh, a, what is the word I'm looking for? A not magnified, but like a brute force that is powerful across multiple requests, right? Like I can send, you know, 10,000 in one request. Um, and so, you know, it was, it was pretty low traffic. It was like, you know, 60 to a hundred thousand requests. Uh, to leak a full, a full, um, you know, 10, 10 character phone number. Um, but somehow that got put in abuse, even because of it, if it's like brute forcing something, I'm like, but this, at the end of the day, it's still leaks the same phone number. Like if there's an API that just re responded with this phone number, then you would say it's Google VRP all day. But if I have to send, you know, 60,000 requests and to leak it, you know, then it. And it's abuse. I don't, I don't understand. It's, it's a little bit of a weird setup. They have there. No, even if they wanted to do this, in my opinion, they should like match up the route, the abuser wants to be equal to this because you can have an abuse bug or abuse above it, whatever. It's super high impact, right? Like you mentioned. So it doesn't make sense that the rewards are capped at like 13 K or 10 K or something, but the VRP of the others, like Google VRP is not capped like that. Yeah. Yeah. Yeah. I, I hate that. Like the, which maybe this is only the gen I. Stuff, but the API keys that gave internal access to internal AI models historically were treated as like abuse API leaks and they paid 500 bucks for them. I will say the ones this year did pay better, but still for the type of, uh, impact there again, I think that in Google VRP, it would have paid a lot more. Like if you could just like take over a Google account that had access to those same models, they would pay you like 50 K. Right. But because it's like an abuse bug, then it's like capped at like nine. We've had the Google team on here to talk about that in the past and they're like, guys abuses for when, you know, Google VRP isn't going to pay you at all. And I'm like, see, I don't think that's true. Like, you know, cause I don't think that you would not pay me to be able to link the phone number of any arbitrary Google account. Right. Like that doesn't make any sense. So, uh, I don't know. There's definitely some, some, some tweaking that, that needs to be done there. And I'll say, you know, I've said it on the pod. I'll say it again. I often. Almost every bug, to be honest, push it back to Google, you know, and, and I would say a lot of the time they do adjust the bounty at the end of the day after more rationale, but I, uh, it is frustrating to me that I have to push it back every time and be like, no, this is this tier. No, this is this data sensitivity. No, this is not abuse. This is, you know, and it, it, it takes time, man. It's not a insubstantial amount of time that, uh, that it takes to do these debates. So super tiring as well, because like you report a bug and you think that it's just going to be. but no yeah you have to you have to keep like fighting i guess appeal it and talk back and forward it's just super annoying like you can't just report it and be happy i think other like programs i'm not too sure but i'm pretty sure other programs would report the same report same thing as you mentioned as like a normal tier it wouldn't be like abuse and then some lore it's on it's on dude justin you were just talking about how you leak phone numbers and then i scroll down here in the doc and literally birdcat has found the same thing early 2025 okay but but he didn't have to do it via some convoluted abuse way he did it in a real way i don't know there's an ipv6 bypass there he might be brute forcing stuff too what do you what do you got this is a brute force as well yeah it's the same thing no but which year did you find it i found it super long ago i found it uh it must have been it must have actually been late 2025 but mine was on oh wow okay so uh richard oh i know about that no but that's like yeah that's like yeah well yes mute that too please richard but yeah yeah so no idea about that i just didn't report it because i didn't want to like because it was part of my thing yeah i could kind of like get that you burned his oscent tool justin what are you doing i'm sorry well i don't even who knows if they even fixed it because it's abuse you know but whatever um so anyway hit it hit us with what you got for this phone leak okay yeah so anyways so this this phone leak is for like the account recovery number right so right you could basically everyone has this set pretty much so i was looking through like the the javascript like like all these google pages right for some reason something worked without javascript which is kind of odd because like in the modern web right you don't really see many things that work without javascript right so i was just playing around with it i wasn't expecting anything so i went to the login page the login page didn't work but for some reason this forget pass like the forget password page or something it just worked right and i'm sorry it wasn't forget passwords like forget username or something yeah so this page just worked and the forget username functionality is super interesting so you can enter like a full name right and then you can enter like a phone number which tells you if it matches together so is there an account which has this full name and this phone number and it worked without javascript so this was like a huge red flag because if you think about it javascript is how okay so do you know what guard is have you heard of it yeah yeah i've heard about guard so it's like it's like google's like obfuscated proof of work right so they use this everywhere they want to stop like body because the idea with it is like by the time you spend all this time to reverse it like the chip is a new challenge already and it's it takes so it takes super hard to reverse it and you have to it's a proof of work as well so it takes a lot if you want to generate the token right so this is how they prevent it but they can't do this without javascript they need javascript to load the challenge but everything seemed to work without javascript so that was super sus and i knew a bunch of like these weird like login pages that work without javascript as well like youtube.com tv for the longest time you could do a login without javascript but then they patched that but this one wasn't patched right so i was looking at it and and i was looking okay so can i just reinforce this so okay this is something super interesting i don't mean maybe people realize this but many services are going to be patched like paypal they leak like so many digits of your phone number so if i go to paypal.com and if i do a password reset of your email they're like show me oh do you want to text this number like plus one six five and then just just four digits sensor everything else is revealed i've never thought about how that this is probably some super useful bit of information for o-centers yeah but yes of course we know exactly what you're talking about if you think about it if you change enough services you could probably just leave yeah but even if not if you're doing some sort of like um node based mapping of people right because like that's obviously a big problem is like linking profiles and stuff even those three digits might be useful enough to like link like 60 of profiles or something in like an oscent database which is kind of interesting yeah so i was i was looking at how this works so i had i could take the i only i only need to brute four digits or something for the paypal one so and that sounded super easy to do so i wrote up some like script or something and i was able to i was able to get it so it would it worked but then i wanted to see okay can i take it steps further can i just brute force the entire phone number right but at this point there was okay there's a bunch of issues okay so first of all how do i know which country code your phone number is because it's so different formats right it could be like plus one it could be plus six five for singapore but turns out if you look at like the password reset like the it's like some form that they write the phone number in like a bunch of dots a dots in a space and something like that you can use that and reverse it in here and figure out which country it's from so then you know which like plus code it is so that's the first way and you can get the last digits from the the like password reset or whatever it shows like the last digits on google right then the other the other problem was how do i get the full name because if i'm going to brute force this i need to have a full name to fix on and then brute force it right but i didn't know a way to get a full name so but after i looked through like a bunch of weird services okay so it's for this ocean thing right google was has been like trying to get rid of all this full full name leaks for the longest time so they've been stopping as many leaks as possible so this was like a big thing that they tried doing it like i don't remember exactly when i think it was like like april of like 2024 they tried like duking all the different leaks but i found for some reason you could like share like a looker studio report with somebody and then it like leaks their their full name or something if you share ownership it doesn't remember his mom's birthday but remembers the date that he they stopped doing the full name leaks on google so the reason this works is because like the if you think about it in google right if you you can always see the drive owner's name right like any sort of google drive so i think like they have this consensus where if somebody owns a document they can they can see the name of that person but for some reason they didn't consider the fact that looker studio doesn't require the other guy to accept ownership you can just transfer it and he's not the owner you don't have to the guy doesn't have to prove it for drive the guy has to approve it for this so this kind of allowed me to leak the full name of the person then i could chain it together so i could now i can now brute force it but so i had i had a whole working by psc i was like ready to report it and then like i try it again it just stops working like what they they they fixed it like i was screwed here like i had everything ready and they screwed it but then i then i was like saying okay is there any way to like kind of salvage this like is there something like bypass or something i could do so i was super disappointed i was looking through like the javascript version of it and i saw they passed through like some bot guard parameter so they passed in a real board card token so i was like what if i do this on like the no js endpoint like what happens there so i just tried it like for fun and it seemed to just work like it just didn't have any sort of limit like you've had one bar got your event you could send infinite requests with that one token wow that's crazy so i could compute it myself like i could do the proof of work once then i could use the same token infinite times then the whole thing worked again so i could so for any google account if you have a recovery phone number which is everyone you could just find the number right so that was pretty interesting and i actually demoed this to a bunch of journalists because they were super interested in this because there's a little impact here for sim swapping if you think about it if you have a guy's phone number that's probably the hardest part of sim swap right you can just use a rope like telco provider or something in and then sim swap a guy and steal their crypto or whatever so this is a the sim the phone number is the hardest part and this just gives you the phone number so a bunch of like journalists were interested in it and they ended up covering it i think there's a bunch of articles on this you could get like any us number in like one hour so i did a live demo to them as well like they said they sent me their email i got the phone trooper and sent it back to them that's great dude oh man that i i love it when you get to do when you get to actually like exploit it and show it you know um did did you report this one to google as well or is this one you decided to just go the full disclosure route on or or both oh no i reported to google but like while it was like while the report was like they haven't fixed it yet i i was able to do a demo with the generalist right but i didn't give them the info about the exploit itself i just like kind of did it on their email because they could send it to it right so they were so i had this whole embargo and indeed we released article and it was pretty pretty cool but but yeah this was rewarded under abuse i think it was like 5k 5k bounty yeah dude see that does that not just feel off to you like i feel like the value of a google you know google account to phone number mapping is like so much more valuable than that for exactly the reasons you said like what a powerful exploitation tool for malicious actors exactly i don't know why they they did that i guess it's because the abuse problem but but oh well i mean the same thing with google vrp right would be like it would be like probably like a 30k or something totally right wow dude very good yeah dude i i gotta go back and look at that report again from from before and be like and because i went back and forth to them like four or five times about it but they didn't keep it pull it out of abuse so um all right man uh i think the last one or maybe we'll do one more section before we we cut for this week but um i want to hear you talk about the discovery docs and your experiences with that because i just speaking personally google ran a grant back i think end of 2024 i want to say where uh they gave a bunch of discovery docs you know to the to the hackers and the hackers you know were able to use these to attack and we found out that you can get these actually from hitting you know dollar sign discovery rest uh but then since then there has been a bunch of changes to that after my eyes were opened um and you know it's not quite as simple anymore so what kind of tips and tricks do you have for discovery docs so for this okay for discovery docs in general i wasn't actually part of this grant right so i didn't have access to the discovery docs or anything but i found it through an entirely different approach like i was just looking through this awesome stuff and i was looking at the people api because those people appear was super interesting you could look up a gaia user and see a bunch of stuff about it right you could look up a guy id so i was looking to that but i couldn't figure out all the parameters from just guessing from the request right i had to get a doc so the doc the doc outlined everything had comments everything so this is kind of how i fought discovery docs like back in the day you could just do it back in the day i mean like 2024 you could just do slash like dollar sign discovery rest and it would just give you a doc but recently i mean within the last year or so they've like they've nuked all this so you can't just because had some like scandal or something like this related to like content warehouse api so they accidentally released a bunch of protos and like they also started locking on discovery documents because of it and yeah it was a big thing but but if you're smart this is the way around it okay but i'm not gonna i won't say here but if you can figure it out it's possible you can still get a discovery document from many apis interesting just think about think about the rbc angle of it okay hmm i'm gonna turn on that i'm gonna turn on that a bit so yeah anyways i was looking through the the discovery document and but the thing is you need the keys to access them right you can't just access the discovery document by itself like a lot of them require api key so i spent this time like going through all the different like various sites i was doing this manually at first right i would just go to all the different sites capture all the keys i could get and i had this like database it was like a humble database of like 200 keys and i was able to sort of like leak a bunch of documents but and that's when i published an article as well like i wrote the whole like thing about discovery documents i didn't i didn't i didn't even utilize it that much like i should have in hindsight i should have like done more stuff there with hacking it but i just kind of left it there and i did other stuff so that's that's kind of like the whole discovery document thing i did at first and for youtube like the discovery document was interesting because you can't just do such discovery such rest because they did a weird thing a weird rule where they blocked all like um get requests or something like you could you can't do any get requests but the get request had to be done for this discovery document to work right because it's discovery stress so how did i get that one so it turns out you could use some like xhtp method override so you can send a post and then convert it to a get and it just leaks a document so i had it was a super big document in fact this is the biggest discovery document that exists in google it's the youtube document so it had all kinds of apis inside and i was able to like trace back and find that youtube exploit that i had or include suspended i saw it there and i'm sure there's still tons of exploits you can find on youtube if you look at this there's like hundreds of methods it's super big there's even this whole like testing ctp you know two endpoints like they're super suspicious like maybe you should look at that dude that that there's so whenever you get one of those docs and you start parsing through it it's like i just feel like a kid in a candy shop i'm like oh man i can't wait to like you know work through all the functionality of these things when when you get a primitive like this when you get a a way to get insight into these apis uh on any target in a reliable fashion that is such a high signal that you need to be paying very very very close attention there exactly yeah on google specifically it is a little overwhelming though oh for sure for sure 100 um yeah so i think the discovery docs they're in this proprietary format but there's also conversions that you can do to um like swagger and stuff like that have you had uh is that what you use or do you parse out the actual raw discovery doc itself and and put it into a format that's readable for you so i wouldn't actually do that i wouldn't actually convert it to swagger because you're going to lose a lot of stuff exactly because the way the widgets documents are formed it's like put above messages they're converted to like json right if you it's not a standard like swagger format because yeah it's like it's super weird it's a google signal format if you do this you're going to lose a lot of comments or like enums or something like that like you don't want to lose it you want to parse it exactly like it is so yeah that's something do you have a do you have like a preferred method of doing that or do you just have your custom solution so i built a whole less like front end for doing this like i can't have a front end where i can upload a discovery document and it shows like a whole thing i'll explain more about that like later on but but yeah like that's kind of how i i parse it myself i don't actually i mean you can probably make some custom like tool or command line tool or whatever but front end was the easiest for me because i wanted to build a way i can sort of upload a discovery document list all the methods see which one i want have first party off already enabled for him copied it and immediately start testing it so i built up this whole thing very nice man yeah i i definitely i definitely want to double click into that um let's let's see uh we've got one more thing left but before i think we're going to cut for today um do you want to talk about google api hacking at bug swap mexico uh in this in this one or should we push that to next week next okay let's do it so all right that's a wrap dude thanks for coming on this episode we're gonna we're gonna tease uh next week's episode um you know there's there's a lot of really really crazy that fruit cat has been doing on google and he's gonna show how he uses his ai to uh hack the apis that are associated with google take advantage of these discovery docs and api key correlations and put all that together to net over 500k in bounties so um you know we don't we try to avoid part one part two sort of situations on ctpb but i think this time we're gonna we're gonna make exceptions so um he basically did what me and justin did but way better yeah but like you know five times better better yeah that's it's amazing um sweet all right well we'll see you guys next week peace and that's a wrap on this episode of critical thinking thanks so much for watching to the end y'all if you want more critical thinking content uh or if you want to support the show head over to ctv.show discord you can hop in the community there's lots of great high level hacking discussion happening there on top of the map master classes hackalongs exclusive content and a full-time hunters guild if you're a full-time hunter it's a great time trust me i'll see you there