Episode 178: 600k in ~3 months - BruteCat pt 2

like in three months it got like okay so i wrote the title of this blog post is hacking google for 500k but it's actually 670k right now oh my god and basically three four months oh my god i'm just running this that's crazy i literally have done the exact same thing you did in this blog post and i did it for like three weeks and i had and it was extremely structured it was like you know consider all the types of auth consider all the types of requests consider all the types you know like all the different api keys we have you know like the 800 api keys we have like let's test everything comprehensively from end to from top to bottom with all the discovery docs that we've had access to or that we've leaked through bugs and we've leaked through all the discovery docs that we've had access to bugs or gadgets using every form of auth and every api key and like i found some bugs but i mean i'm talking on the order of probably like 10 of what you found right like i think i probably made like 50k across all those bugs so i mean this is definitely downstream i don't think that we should write this off as like you just using ai well this is downstream of your expertise by a mile oh yeah i think and and taking that and then taking the leads from the ai and exploiting them further manually i'm sure right you gotta you would say that that's true correct broodcat yeah exactly so i think like a lot of the leads i get i don't just leave it at that i try to like push the impact as much as possible but i will also say in terms of the ai hunting right so you don't want to give too much to the ai because if the ai has like access to do like anything it wants it's not gonna like for example i'll just try to explain this in a simple way but pretty much the authentication itself i've kind of like abstracted that out of the ai completely so the ai doesn't even think of that it just focuses on this one task of testing the api right and another thing is there's so much noise when it comes to like it's not like it's not like it's not like it's not this hackbots or whatever you have to find a way to filter that out so for me that was like building this thing where i could sort of see the request and response and and i could like and there's no way that i could fake that because it's like every request ai does i tie it to like an operation right and that operation is then like associated with like the request response so i can just see what it did if there's like a pi leak i can see the pi there's no bullshit right wow yeah so you're you're getting a really one you're abstracting away a lot of the complicated parts of hacking on google and then you're you're not giving the ai room to do much besides exactly what you need it for which is sort of filling in these pieces of information and correlating them across uh you know different google apis that's that's pretty sick man that's pretty sick um all right well okay hold on we you know we we got we got roll in there um we're back with part two uh of brood cats saga here um and today we're going to talk about uh ai and how he has made over five hundred thousand dollars hacking on google um using ai uh over the past it's not even like a year it's like eight months at this point maybe um so dude i'm so excited for this i think before we get into the all the ai stuff um we also wanted to kind of go back and do a refresher on some of the discovery doc stuff um so let's let's do a refresher on that and then we'll jump right into the ai uh component so arvin you built a basically a system for this specifically right yeah so pretty much i built this whole thing where i can take a discovery document right i can parse it out and have this whole ui where i can see each method and type on it and inspect it right so instead of doing an approach where converting the swagger and trying to look at it that way i had this one ui i took a lot of inspiration from google's so you know do you know how every google api that's a public api they have this like try it like explorer or whatever so i really love that because you can you can just see the methods and test it like right away so i actually want i mean open source at one point but i guess they just made it not open source anymore but it's fine like i made my own version of it so my own version has like all the auth and everything all cut bigger and so you just have to all you have to do is just upload your document tap on the endpoint you can start testing right away you don't even need burp because it has like a burp inside of it right so i just focus my time on testing it so this is not this is just for like testing the leads of my ai reports right so i can just test it directly yeah dude it's beautiful to have tools like that that reduce the friction so you can just test it directly and you can just test it directly so much uh that that you can just you know that's when you know that your your your methodology is really streamlined when you have these super custom tools for this stuff yeah exactly um so okay so we've got the discovery docs we've got the um you know sort of built-in burp or kaido or whatever you know replayer for these uh specific calls how are you tying the ai into this and uh and getting it to give you these leads uh from the discovery doc structure that you've built out so let me let me back up a bit into explaining how i even got to this in the first place okay so there was like this bug swat in mexico last year right so the whole bug swat i wasn't actually hacking i was just i was just thinking about like how because i was looking at the source code like google is they let you see the source codes of any app you want or anything so i was completely fully abusing this but that also kind of got me interested back in the hacking right so for this like our this time i was i've been using cloud for like around a year so even my like recto proto tool was completely written by cloud like back in the old days of thought so i would like write it in the the web chat and then copy it and paste it and then take the whole thing with that so yeah i was doing all that but but i had an idea like why couldn't i use cloud or like whatever ai and why can't i test the discovery documents because you see the thing about discovery documents and testing the endpoints it's just tedious right yeah like if you're looking for access controls i don't think it's like too technically complicated it's just more of like are you gonna do you have the time to like look through every single api right considering how many apis there are it's like it's just too much right you have to you have to settle in your scope or whatever but in this case if i can use ai to look through everything it'll be so much faster so i had this idea and i was selling free rom and everybody but like and they were they were listening to me but i don't think they understood like what i meant like i was fully like engrossed in this so this is the only thing in my mind like how i can use ai to do this so right after boxwell ended like i was on a flight back i did like one week later i had a whole mvp working so i had a i had this like web ui where i could sort of input like a discovery document and it would like show all the methods of the side show everything and so google has this auth like called first party auth v2 right so they actually ended up so there's something funny right they actually ended up leaking the source code or whatever like the client sites like the typescript source of this first party auth and some random like uh google site because they had the source maps enabled so you could you can get like the whole specification of this first party auth from there so from there i realized that first party auth is not as simple as i've been using it for a long time you originally thought like this there's like this little like sacral full post that's like documenting this author right but there's a bit of extra like fields you can have for like getting the full thing so sorry what did you say there was what did you say there was about the auth a blog post there's like these extra fields that you can have in the first party auth for the authorizing header it's not just a sappy sappy hash i mean there is it's a sappy hash but the way you compute it so this this is required for many apis like drive front end pa they're not going to be physical you can't just use the the normal one you have to use this to this one so i was able to figure out all this from that and and actually yeah so this was this was super useful i combined this with the the discovery docs and like the whole like discovery topic thing where i had a ui and in the end i could just go to my website click on any method it would have the whole like burp thing set up for me i could just copy the request or or play it in the thing itself with authentication everything handled so the only thing i had to do was like change the request parameters so i built up this whole thing first right this whole ui but then the thing was once i had this ui i need to get api keys right if the test apis you can't just you can't just use api you need keys so i had this like humble collection of like like 100 keys or whatever but that's all right so i did this effort with michael dalton he's another researcher i spent like so long like trying to find as many sources of keys as i could so this meant like i was trying like i took every single apk that google has ever published like i scraped all that i like which all of them like extracted out as many keys as i could from that even for ipas we like decrypted it and we took all the keys from that we set up like a like this chrome extension with google like debugger api and we were able to sort of like look at every single request automatically and capture keys right then we went through every single google like domain and we were using as much functionality as possible and trying to get keys that way so in total right this whole thing like ended up with like a few thousand keys from just this whole effort but the problem was it wasn't it wasn't over yet see many of these keys they might be customer keys they wouldn't be like google's keys right and i want to keep the scope to just google i don't want to attack customers right so for this reason i found a super interesting endpoint like i don't i don't remember where i came across it but it's in cloud marketplace some endpoint where you can pass in a project number and it tells you which domain it's from so you can get a project number from any key from just going to like say protos or google apis.com and if i go to discovery document i try a key there this this key is this key is not the same as api for the project for this key is not enabled for this api so it tells you oh this gives you some error and it leaks the project number in that error so you can then use that project number and check which domain skis from essentially so i was able to filter up non-google ones yeah very cool so this allows you to filter it down yeah exactly so there's also another way to get keys okay so i wouldn't i wouldn't say i okay i'm not gonna say here publicly whether i got keys from this or not but if you're if you're smart you can figure out it's like z handlers in google right there's like these debug handlers and then you can filter it down and then you can filter it something are leaked. And if you go to certain debug handlers, like Flagsy, you can find keys inside there. Or Proxy is like an LFI as a service. You can just use any LFI you want and read any file you want. And this is on the broadcast. You can just dump the classes of running processes and stuff and get the keys from those. Dude, that is a crazy thing. I've not heard of that. That's got to produce some crazy powerful keys. So, okay. On the topic of Z handlers, something super funny. This was quite recently, but Google accidentally leaked some random binary. So, first of all, these Z handlers are like, you're supposed to be the corporate network to access them. You have to be connected to the intranet or whatever. Otherwise, you won't see them. They're like on www.google.com proxy. But Google leaked some binary. And inside there, they bundled all the Z handlers with it. So, I had Z handlers running locally. Really? Wow. Yeah. It was super cool. So, I could see all the Z handlers. And inside there, I found this one Z handler. For fun, I was just looking at reflected XSS. Is there something like XSS in this? Because it's all the main domain, like www.google.com slash whatever. Or any domain has the Z handlers for it. So, I saw this one path. I could just put a super simple XSS payload and it would pop an alert. And I sent it to Ezekiel. I was like, hey, can you check this out? And it popped an alert for him. No way, dude. Oh my gosh. On www? Yeah. Oh my gosh. The amount of crap I went through to get an XSS on www. And you just find this Z handler with a simple. Dang it, dude. Yeah, but this only works for Googlers. But I could argue that that's where the most impact is. Oh, yeah. Sure. Yeah. Once you have access to that, you can start fetching all the internal stuff. So, this is pretty funny. But this binary also had. Like the full stubby implementation, the server side of the implementation, the client side of the implementation. So, I reverse engineered all of this. I have a working stubby client that I can just play around with. Wow. Dude, that's amazing. So, you can get all this from Z handlers, essentially. But the story doesn't end there. Because every API key has their own restrictions to it. So, there's web API keys. There's web restrictions or Android restrictions or iOS restrictions. So, depending on the restriction, you have to supply certain headers in order to make it work. So, for web, that's. For Android, there's some special header you have to supply. So, you have to brute force the values for all of these. If you don't have the values for these, it's basically useless. You can't really use the key. So, I spent a whole effort individually looking at each key and trying to brute force the values and storing them in my database. So, I had a whole database, all the keys, and all the values for each key. So, this was super useful. I think I had around 3.6 thousand keys from all this. So, these keys are Google's? Yeah, exactly. Oh, my gosh, dude. That is way bigger than my collection. I thought I was doing good with like 800. He's got 3.6K keys. Wow. So, yeah, that was. Because if you think about it, keys are the only thing that's preventing you from using the API. So, for AI scanning Google, keys are the most critical thing. You have to get as many keys as you want if you want to access all the APIs, or else you're just limited to whatever APIs that your keys can have. So, I brute force a list of all the Google APIs. So, something interesting is if you send a GET request to any Google API and look at the server header, it tells you. If you see some server header there, you can tell if it's a valid Google API or not. So, you can brute force and find all these various Google APIs. Then you can use various tricks to delete the discovery document of this API. So, then I had this whole collection of discovery documents for all the APIs. And then I put all this together. So, I built this AI tool, which. Or even before that, I had to find which keys are enabled for each API. I had to write a script that goes through each method, tries to get first-party auth working there, and then it tries to brute force each key until it finds the keys working for each API. Then I had that whole thing in the database. So, then I could go to any API. So, my front end looked like this now. I could go to any API. I had all the keys there. I could select which key I wanted. I could play all the keys, because some keys have different responses. So, I click play all, and everything works in the UI, and I could see the responses and play around with parameters. I had all this going on. So, then the next step was to actually use AI to scan everything. Because now I can just do this manually, but I don't have time for all that. So, I implemented a basic graph like Wiggum do. So, this was back in the day. There was no concept of this control plane of Bash. So, nowadays, we're all using Cloud Core, which has access to Bash. But back then, this wasn't really a widely thing. MCP was just pretty new, I guess. And so, I just used AI SDK, and I was writing some simple thing with that, where I had MCP tools for each thing. So, I had these three. I had a few MCP tools. First one was a probe API tool, where I could probe an API. The second one was report vulnerability, and the third one was complete testing. So, this probe API, at first, it wasn't optimized at all. I was sending so much extra stuff, which wasn't needed. In this probe API body, maybe you want to show the document? I could sort of. Yeah, I'll share it right now. Actually, it's going to be a little bit challenging, because you've got this behind auth currently, because the article that should be, hopefully, will be released in conjunction with this episode. We'll see pending approvals and stuff like that. But currently, it's behind auth. So, let me go ahead and see if I can share it. Yeah, here we go. I think just go to the simplifying probe API section. Okay. Simplifying probe API. There it is right here. Yep. Okay. Yeah. So, it looks super ugly at first. I was sending all this method ID and path and all this stuff. I mean, okay. Path is needed, but there's a bunch of stuff that wasn't needed. Why does the AI need to send this every single time? And the AI is constructing this MCP itself. So, it has to think of this in writing. So, I want to abstract as much as possible away from the AI. I want the AI to just focus on testing itself. So, I simplified this a lot. So, now it just supplies the endpoint, the path, because sometimes you have to supply path parameters, right? And for the accounts, I just gave it include creds. So, it can use include creds, supply the Gaia ID of the account it wants to use, and it doesn't have to worry about auth itself. It just thinks of this. Okay. Right. So, this is a perfect example of how you're abstracting away things from the AI to make it simpler for it to test as well. Exactly. Because if you were to let it control auth itself, right, it's going to hallucinate more or have issues with that. So, I want the AI to just focus on creating request bodies to test it, right? Because that's the hard part. That's the part of this AI to think about. Right. How do you, in the application's context, how do you create a right request body or something to test this API? Now, I did want to push on something here. You said that you got all this hooked up via MCPs, and I know that you were architecting a lot of this in 2024, 2025, that sort of thing. But the best practice that we've seen nowadays in the industry is to be using skills for these sort of things. Are you thinking about re-architecting or do you think you're going to stick with your MCP structure? Well, I would say in this case, for what he's doing here, actually, I would think that the key point is actually the CLI piece, right? Yeah. The skill might tell it how to use it, the same way I'm sure he told it how to use this MCP because there's always MCP docs as well. But the way that I would think about doing this simplified thing he did here would actually be a skill plus a command line utility, which is passing in a few of these parameters. Yeah. That's kind of what I mean by skill. Precisely. Yeah. So, that's actually the way I do it right now. I'm not doing. This was back in the day, maybe 2025 or whatever, when it wasn't too. We weren't using Bash that much. But now, the system is all like the CLI. I just have a CLI. And I don't use the skill. I just tell it like the prompt or whatever, the system instructions. I tell it how to use this CLI. And yeah, that works very well for me. So, I'm not actually using MCP at all. Okay. So, nowadays, it is essentially a skill. It's just not in a skill. It's just in the system prompt how to use your CLI tool. Exactly. Okay. Yeah. So, then the other issue I had was, remember how I mentioned that different keys could have different responses? Yeah. So, I had to play all functionality, right? But how do I give this to the AI? So, sure, I could do every single request and then give it every single response back, but it's wasting responses, because a lot of the time, it's going to be the same response. So, instead of doing that, I grouped them together. So, I basically made this mapping where I have a hash or whatever of the response body, and then I can map it together. And the AI just sees each result, and it sees, okay, response body hash is response one. And then, it could look at response one to see what response one is. So, it doesn't have to send the same response every single time. So, I'm just reducing the amount of tokens that's being wasted in random stuff like this. That's a really good solution, though, because like you said, you don't want it to have to look at every single one for 100 keys. And I'm sure on a lot of these services, it's enabled on hundreds of keys, right? And so, this basically condenses down all the ones that don't have data in them and then gives you unique responses for the ones that do have data. So, then the other thing is I had to apply my knowledge of Google APIs. So, Google APIs, they tend to give super weird responses. For example, if you get a response saying "method not found," it doesn't mean the method isn't found. It just means you don't have the visibility label on your key when you're trying to fetch this method, right? So, how's the AI supposed to know this, right? So, the AI only knows so much in this context menu. So, I basically simplify this out. So, for all those generic error messages, I basically convert it into the standard error. So, it just says standard error, missing required visibility label, or standard error, invalid argument, no details, right? So, instead of providing the whole thing for each. You baked in your knowledge into an error for the model you're running. That's really cool. That is really good this is the correct way of implementing ai tools yeah no the way i would have done this which is incorrect is put in the skill if you see param not found that means missing required visibility label but now it's having to like do this like extra leap of logic every time it sees that whereas you just baked it straight into your tool yeah so cool you know what you know what's so beautiful about this too is this is very much how humans work as well right like as as little friction as you can have when testing these things the better and you know in obviously in our brains we know you know okay if it's 404 then it means i'm missing the visibility label and it's there and you know eventually it just becomes like you know you don't really think about it but honestly as as little friction as you can possibly have uh you know between what you see and and inhibiting your thought processes right that's better for testing which is why you built out that whole environment in the front end right where you're parsing discovery docs you just press play and go and you're also applying that to the ai agent here in a really really effective way that's that's freaking sick dude and not only did i provide like the standard error type i would also provide like an explanation so if you scroll down a bit right you can see standard error explanation this request was rejected by the application due to invalid arguments but no details are provided so it kind of explains this error to it if it doesn't understand what this error is so it doesn't have to like relate the past knowledge it just sees it right here so wow this worked out really well for me so in terms of the ai figuring out like these errors because other people don't understand what's going on right so i had to go through each one and validate them and it was super tiring for me so i wanted to find a way to make sure that i was able to get all of them right so i had to find a way to make sure that i was able to get all of them right so i had to go through each one and validate them and it was super tiring for me so i wanted to find a way to make sure that i was able to get all of them right so i had to go through each one and validate them and it was super tiring for me so i wanted to find a way to make sure that i was able to get all of them right so i had to go through each one and validate them and it was super tiring for me so i wanted to find a way to make sure that i was able to get all of them right so i had to go through each one and validate them and it was super tiring for me so i wanted to find a way how can i cut down this this 90 jump right how can i make it like super like like i want like super high signal so in this case i figured out it's like the solution where i could have like an operation id so every time the ai makes a tool call right i tie it to some sort of id and when it makes a lead it has to reference this ids that it made so it knows it knows which id it knows which operation id it did so it just has to reference that id inside the report and i'll reject the report if it doesn't have any id so it can't make a false report and the other thing was like a lot of the times in google there's a lot of things that like you would think might look like a bug but it's not really a bug so i had i like fixed the system problem a lot and i i basically had like testing rules where like oh if you id enumeration like sure that's that's cool but it's not a bug okay i mean sure it's like interesting you can use this for testing but if you can tell that id1 exists and id2 doesn't exist like i don't i don't really care about that i don't want to report this to vip so like and also give it like ideas for maybe like testing idors like you can use use a few values if you notice there like if you scroll down a bit you see don't know a parameter value use use one test me default i wonder if that's how it found like the client id default i mean or that it could be in another way because yeah but should we also add a dash there because i feel like you've mentioned seeing dash in some fields too i was gonna say should we add a dash there for the don't know prime value because i feel like sometimes in paths the the project id will be just be dashed yeah definitely definitely yeah 100 yeah so i built up this whole like sort of this whole thing and i wrote there like even severity level so i can have like like a debug means okay it's like internal debug info that's leaked that's not like leaking some random google type right or like a suspected id or but you have no way to like prove it so that's another that's like info our medium is like these few like things like a guy id to email but a pretty good example of a guy id to email but a pretty good example of a guy id to email but a pretty good example of a guy id to email but a pretty good or a high would be like an id or it's leaking people's pi right so and so i built up this whole thing and the signal was super high like i would say like most reports like i got were all valid and they're all like they're all real well released so at this point our brand is across the whole group like all 14 000 apis on google i had like a whole session oh yeah and not just this i will also have to group it together in groups because you see a discovery document is quite big big big if i just have a whole testing session if i just have a whole testing session if i just have a whole testing session just for one discovery document it's going to just for one discovery document it's going to just for one discovery document it's going to like focus on one part and leave out another like focus on one part and leave out another like focus on one part and leave out another part so instead of doing that i sort of made part so instead of doing that i sort of made part so instead of doing that i sort of made them like i had like this whole uh process them like i had like this whole uh process them like i had like this whole uh process beforehand where i would like group these beforehand where i would like group these beforehand where i would like group these endpoints into like front groups i guess endpoints into like front groups i guess endpoints into like front groups i guess you could say you could say you could say and it would test each group for one one and it would test each group for one one and it would test each group for one one whole session for each whole session for each whole session for each group so that way like everything is group so that way like everything is group so that way like everything is having attention give to it it's not having attention give to it it's not having attention give to it it's not like just gonna focus on one area and like just gonna focus on one area and like just gonna focus on one area and ignore everything else ignore everything else ignore everything else and i guess if you're doing that there and i guess if you're doing that there and i guess if you're doing that there needs to be decent documentation so that needs to be decent documentation so that needs to be decent documentation so that you can compare notes cross groups you can compare notes cross groups you can compare notes cross groups though right like if one primitive from though right like if one primitive from though right like if one primitive from one group needs to be used in another one group needs to be used in another one group needs to be used in another you know group is that something you've you know group is that something you've you know group is that something you've implemented or implemented or implemented or yes i did so i made some like sort of yes i did so i made some like sort of yes i did so i made some like sort of summary thing where it like some at the summary thing where it like some at the summary thing where it like some at the very end of a testing session it very end of a testing session it very end of a testing session it summarizes everything and learned from summarizes everything and learned from summarizes everything and learned from that and it passes that on to the that and it passes that on to the that and it passes that on to the context of the next testing group nice context of the next testing group nice context of the next testing group nice yeah that's really good um yeah that's really good um yeah that's really good um you just uh i need i need to audit that you just uh i need i need to audit that you just uh i need i need to audit that file can you hand me that file that file can you hand me that file that file can you hand me that file that gets passed from from yeah we're gonna gets passed from from yeah we're gonna gets passed from from yeah we're gonna need those just uh you know for need those just uh you know for need those just uh you know for journalistic purposes uh no that journalistic purposes uh no that journalistic purposes uh no that that's great i actually can't believe that's great i actually can't believe that's great i actually can't believe that you that you that you like are you sure you want to leak this like are you sure you want to leak this like are you sure you want to leak this whole this part of the system prompt whole this part of the system prompt whole this part of the system prompt here here here like yeah sure everything is public oh like yeah sure everything is public oh like yeah sure everything is public oh my god i'm happy to give all this you're my god i'm happy to give all this you're my god i'm happy to give all this you're so generous so generous so generous yeah i i am um very yeah i am um very yeah i am um very very blown away very blown away very blown away justin you got two weeks justin you got two weeks justin you got two weeks yeah seriously i'm glad we have two yeah seriously i'm glad we have two yeah seriously i'm glad we have two weekends up on this this is crazy yeah weekends up on this this is crazy yeah weekends up on this this is crazy yeah um um um you just casually mentioned 14k apis you just casually mentioned 14k apis you just casually mentioned 14k apis that's a lot of apis dude i think i've that's a lot of apis dude i think i've that's a lot of apis dude i think i've got got got somewhere to the tune of 2k um somewhere to the tune of 2k um somewhere to the tune of 2k um you mentioned some technique before for you mentioned some technique before for you mentioned some technique before for brute forcing brute forcing brute forcing and then being able to tell off of the and then being able to tell off of the and then being able to tell off of the server header is that anything you care server header is that anything you care server header is that anything you care to elaborate on there or to elaborate on there or to elaborate on there or yeah so that's pretty much how you can i yeah so that's pretty much how you can i yeah so that's pretty much how you can i mean you can find apis throughout many mean you can find apis throughout many mean you can find apis throughout many races right you can you can see from races right you can you can see from races right you can you can see from like the apks or from the js files right There's actually this super cool trick you can do in JS files where you can like, okay, I don't remember exactly what it was, but you know how JS files are like module system? Yeah. So you can actually dump the full JS file without just those modules, everything. So you can change like D equals to one or D equals to zero, something like that. And you can dump the whole JS file. So that's kind of how you can get more keys or more host names from there. So I collect the host names for all these various parts. And then I use those various tricks to leak the discovery document, even though they try blocking it. So maybe you can hit it through like gRPC or something and it'll leak the discovery document. So there's a lot of like tricks you can do in this. So that's in total, I have like 14,000 discovery documents, like almost every single discovery document in Google. 14,000 discovery documents? Holy. Wow, dude. That is crazy. I thought you were saying you had 14K APIs, not 14K discovery documents. That's insane, dude. Yeah. So I had all of that. Yeah. I had this whole gold mine. I just need to like extract it now. So I have everything set up. Time to roll. So I basically, I ran it across the whole Google. It found so many bugs. Like in three months, it got like, okay, so I wrote the title of this blog post is Hacking Google for 500K, but it's actually 670K right now. Oh my God. And basically three, four months. Oh my gosh. From just running this. That's crazy. Well, we have our clip for the start of the episode. Yeah, seriously. What the heck, dude? That is insane. So really, a couple of comments here. One, I can clearly see your OSINT background coming in strong here, right? Like you are really thinking about this almost like a big data project, right? Where you are, you know, doing a ton of recon, grabbing all this data from all sorts of areas, cross-correlating it, getting primitives, getting, you know, abstracting away things into modules, right? This is like classic OSINT behavior here. And then you're tying it all together and then AI is the glue between all of these different pieces that is helping fill in the blanks. That's sick, for one. For two, I wanted to ask specifically, you've done a lot of work getting different auth methods for Google. You mentioned first-party auth. You've also done some really excellent work on Android-related auth. There's also some references in here to iOS-related auth. In your experience, what is the most. Do you have, off of vibes, the auth method that is producing most access to the things that you want? Definitely, like, first-party auth. Like, that has so much access to almost all APIs. As long as the API has a host name of client6.google.com. So, okay, you have to take note of this. So, not all APIs have this alias. Only some APIs have an internet-exposed client6.google.com. And if it does, like 90% of the time, you can use first-party auth for it, right? You're saying 90% of the time? Yeah, I would say 90%. Dude, I'm doing something wrong then. That is very high. Okay, interesting. Yeah, so pretty much it's super good. But I also implemented, like, a bearer token. So, I have a bunch of, like, these Android clients and even web clients. So, that's a whole different thing that I did. I don't think it's covered in this article, but I basically implemented all of this. So, when you send a request, the play all thing, it's doing all of this. It's not just the keys with first-party auth. It's doing bearer auth, it's doing Android auth, doing iOS auth, everything. So, I found that sometimes you will. I saw, you know, you do multiple requests with multiple different keys there and give the response back, you know, in long form. Have you found that if you actually. If you're using the same API key, but a different auth method, that sometimes you will get different results? Or is it mostly. tied to the API key. So API key is only a web concept. You don't really use API keys with a bearer token because a bearer token usually contains the authorization of a GCP product itself. Well, what about the situations? I guess there are some situations where you've got first party auth or you've just got an API key, that sort of thing, right? Or maybe you've got a bearer token that has a specific scope to it. And then you've also. Is there never an overlap where you've got first party auth and it works with the Android auth or whatever? Oh, yeah. Many times it works with both. But I would say. Yeah, but most of the time, if you want the thing that works for most places, it's going to be first party auth. It's going to be first party auth. Okay. Gotcha. All right, man. Wow. Well, that is pretty sick. I've got a lot of stuff to go back and review on my own infrastructure. I will say, Joseph and I both have a similar system. Like Joseph said last week's episode, we have a similar system to this. We have gadgets that we're tying together to cross-correlate these API keys, correlate project names, correlate all of this stuff. But we have done it much less successfully. And it's still been good for me. I've enjoyed it. I've found some good bounties out of it, but not 670K worth of bounties. No. I think it's mostly the auth thing. I don't think that I have really solved first party auth or had like connected it to the client six APIs in the way you did, Brooke. Yeah. Yeah. I definitely did. And I still didn't have that piece. I think the area where he's crushing it right now after reading through his article is actually enumeration of the referrer and origin header, which is massive, right? So can you talk a little bit to how that integrates with first party auth here? Yeah. So if you want to use an API key, right? Like I mentioned, they have, they all have like different restrictions, right? You can have like Android header restrictions or iOS for header restrictions. If you're just skipping past this and like not doing it properly, right? You're going to skip so many keys that could otherwise work. Oh, and another thing I want to mention, right? So all these APIs, they have an origin whitelist. So with first party auth, you can't just use any origin you want. You have to use a specific like whitelist origin. If you don't use a whitelist origin, it's going to give you some like error that just says session token, like error. Like it's actually just means the origin is all whitelisted. So you can brute force all of the origins, like a bunch of lists of like Google domains and find a working origin. And in fact, the key to this is, right? If you find any, like any Google APIs, just only work on corp origins. That's a huge red flag. I found so many bugs on one set just only work in corp origins. So you can actually just corp origins there. And in fact, the origin doesn't even have to be like.google.com. It can be like with google.com, even though like the cookies obviously doesn't make sense for it to be there. But it works. Wow. That's very interesting. I need to get a wider scope of these domains cataloged for my brute force, I think, because I, I mean, I've got a ton of APIs that I have working API keys for, but not a referrer that's correctly scoped. So I bet that's where, I bet that's one of the keys with that. I'm kind of falling off on here and missing access to a lot of auth. It feels like there's so many secret API versions in the path. And also so many different secret labels as well. Yeah. You really got to get all of these pieces together, Ben. And I, you know, I bet, I bet BruteCat has decent coverage, but not probably perfect coverage. So I wonder what's going to happen next, the next time BruteCat like figures out some little thing and then applies it across the scale of the whole system, how many more APIs and stuff he's going to get access to. Well, actually, that's a good question. Do you know what the percentage of APIs that you have where you, you don't have access to like either the correct origin or a key to access it, or do you know any of those numbers? Okay. So one thing I will say is that, like I mentioned before how I had most of my success with first-party authoring, but like, to be honest, right, there's a whole untapped surface of using like the bearer auth better because like my system for the bearer auth is just kind of like, like taped together. It's not that good. Like my focus is mostly first-party auth. If you use bearer auth and try to find all these different various clients, and find ways, or even, it doesn't have to be a client that way. It could be like, let's say I'm hacking GCP, and I managed to get an access token of like a tenant project. Maybe that has access to some APIs that otherwise you wouldn't be able to access. And if it's an internal API, it probably has some bugs in it. So that's, that whole area is completely untapped. And I haven't, I haven't even extracted that yet. Oh my gosh, dude. I don't, why are you saying that on the podcast? Oh my gosh, dude, that is a. Oh my gosh, dude. Oh my gosh, dude. Oh my gosh, dude. Oh my gosh, dude. Oh my gosh, dude. Oh my gosh, dude. Oh my gosh, dude. Oh my gosh, dude. Oh my gosh, dude. Yeah. And there's also the extra component I mentioned for the computing, the authorization header. I actually provided the leaked like TS file or whatever, which I got from the source map. So it's in this blog. So you can, you can just use that. Okay. The computer whole thing. Gotcha. Yeah. And there's also some like goaded stack overflow, like a article that, that had some code for that too. That's a good one. Okay. That's what I used for my implementation, but yeah, actually using the actual TSX from Google's implementation is way better. And there are, correct me if I'm wrong here, but there, there are individual error messages that can tell us whether we are missing an origin header or refer header, or it doesn't support this specific type of auth and that sort of thing. And you have to be able to understand, you know, what is the situation for this given API key and API pair. So the errors are all documented in this blog post. And not only that, I've also had a section in this where I show like each layer of where things are checked. Right. So for example, for brooding keys, right. In the past, right. You could like finding valid keys. You have to get like, you have to get first party auth first working. And then you have to like get like refers all working. You get what I mean? Like there's different like layers to this. You have to get like authentication first and only then you can start like brooding the keys. So if you want to build a program for like brooding the keys for each API, you should like take note of all these different things. So I even had a section here where I showed each layer essentially. So you can feed that to your cloud or whatever. Okay. So let me ask you this. How do you determine, how do you determine whether first party auth is working for a given API without having an API endpoint to hit on that API? You mean like a docs endpoint? I mean, you need an API method in order to be able to check if you can do first party auth, right? You just need one API method. And API methods, you don't have to necessarily have a doc to test API methods, right? Why can't I test an API method that's like leaked in some JavaScript file or something? Okay. So you can use that and sort of like test it that way. So you don't have to test it through the discovery document. And a lot of times the discovery document goes down, but you have an older discovery document. So you still want to test it, use the methods to test it. Does that make sense? Yeah. Okay. Okay. So we do need a method. So we need a method and we need a host. And then we can, using that, we can check whether it supports first party auth, even if we don't have an API key that's compatible with that host. Is that correct or not? Okay. No, I think, I think I misspoke earlier. You need to, you need to have a, okay, so you need to have like a valid API key first in order to even start like. API if you want to check first-party auth, right? So that key check happens And then after that, it checks for restrictions on the key. So does this key have the right header for a header, or does it have the right iOS header? So that whole thing happens. And then at that point, I think the first-party auth origin check happens. So it checks whether you have the right origin for your first-party auth. If not, it just says session cookie invalid. If you have everything sorted so far, it checks the visibility label. Does your key have the-- or does the GCP project that has your key have the label that's needed for this endpoint? If it doesn't, return method not found, which is like that bullshit response. But if it does, it lets you through. Then it checks, oh, is this method blocked for this GCP project, or I saw our key or something. Some keys have certain methods blocked for them. So you have to get through this whole thing, and only then you can get a request process. Wow. And this is why it's so hard to test Google APIs. Goodness. Yeah. And this is why Brute says, actually, once you get through the security by obscurity, it's not that hardened of a target, right, because nobody can get through the security by obscurity here, which is crazy. OK. So we go through all of that whole flow. We get an API. We get a method. We hit the-- we correlate the API key. Then we determine first party auth. We make sure that we have our refer and our origin header that work with that for us to be able to generate that first party auth. We establish an authenticated primitive to access the specific API. Then from there, we utilize some tricks or whatever to either, you know, get the discovery doc from, you know, slash discovery slash rest, or we call methods that we found inside of JS files related to the specific coast, which you have documented in your correlation, which I assume came from your Chrome extension that you're using, too? Yeah. Yeah. Or the big data research that you've done that essentially correlates where you got that specific API key or host. Is that accurate? Yeah. OK. Yeah. And then you feed all of that into the API. Then the AI tries to take that structure, you know, either with the discovery docs or with the JS files or whatever, and then construct a valid proto JSON request body, and then send that to the API. And then it will respond or not respond, you know, until you-- and you tweak it, tweak it, tweak it, tweak it, until you hit something you're not supposed to be hitting. Is that-- is that a good summary of the whole flow? I think the key here is, yeah, but you should like-- I think the key here is that everything's abstracted away. The AI is not thinking of this, right? Right. The tooling is all doing this. Like, the AI just thinks about the body, what's it sent. Like, all this happens behind the scenes in the tool itself. Like, all this research into which API has first party auth enabled, which-- what keys we have for this. These are all like background tooling that I've done. And the AI itself is just testing this specific body. The body for the endpoint. Yeah. That's essential. That's essential is you're perfectly exemplifying what, you know-- we should not use AI for things that you can do without AI, right? Like, if you can brute force all these things, correlate all of this, establish your auth primitives, you know, enumerate these specific endpoints or whatever, if you can do all of that outside of AI, then don't use AI for that. Only use AI for the very little tiny bit of, you know, intellectual magic that you need to correlate and construct these request bodies. Is that accurate? Yeah. Nice, dude. Dang. That is pretty-- you know, it's starting to make sense, man. It's starting to make sense. You know, why your method is producing such fruitful results. OK. So you mentioned in here, just kind of going into that AI implementation about the Ralph Wiggum loop and stuff like that. Are you still using that? Are you using the /loop primitives now? How do you train your AI on when to give up and be done testing an API, versus when to keep pushing? OK. So in this case-- so the whole thing I've mentioned where I did was AISDK, and I had like MCP tools set up. So that's all scrapped now. Instead, I have like a whole container or whatever. I have Cloud Codes running in the container. I think it's a similar setup to what you have. But in this-- yeah, so I feed the AI whatever it needs to do this. And in fact, the discovery documents, I'm not even providing it as a context. In the past, I used to provide it as a context. But that's a horrible method. The better method is-- you can convert this to like markdown files, and the AI can read that. So the AI reads all of this. And then according to that, it tests whatever it wants. In terms of giving up, I would say that-- OK, so this loop-- I have this thing where it doesn't end until it finishes testing everything. If it tries ending and it hasn't tested everything, I'm not going to let it end. I'm going to poke it again and say, oh, you have not finished testing these endpoints. So that's kind of a way I can ensure it doesn't just quit early, and it ensures it tests everything. So you mean literally via code, like if it hasn't seen-- if your opcodes don't show that it's hit every single endpoint for coverage, then it keeps going? Precisely. Oh my gosh. Dude, he's baked in literally every hackbot type trick in the book just naturally. Yeah, that is amazing. Yeah, my brain is kind of spinning with that now. Because yeah, of course, you can check what request this thing has sent, right? Yeah, you can just take a sitemap and be like, if you haven't hit every API key or every API path, then you're not allowed to be done. Yeah, absolutely. That's really cool, man. Codifying all of that has definitely got to be what's pushing this to the next level. I mean, obviously, including your in-depth understanding of the Google APIs and all of that structure. But I think you're using AI better than I've seen almost anybody use AI to this point. And I think this is a really key component of that. Awesome, man. All right, well, let's go from there. And let's go a little bit further down in the write-up and then talk about some of the Pwn and Google stories that you have from this result. Does that sound good or do you have any other comments to put in that whole infrastructure section? Okay, I think that sounds good. Yeah, we can cover a few of these. This is the most fun part. Like, so you can completely Pwn and Move. Like, there's so many different bugs here. It's so cool. And these are just a few of them. By the way, I couldn't fit all of them in the write-up because, like, I had to get Sam to, like, fit all of these in. Right, right. And see which one, yeah. Poor Sam. But these are the ones that I finalized. Right. But, like, the product team had to, like, give feedback for, like, each of them. So, but yeah, that all ended up happening. But, yeah, I wish I could have included more, to be honest. There's a lot more cooler ones I could have included. Yeah, dude, you've got, like, 15, you know, ATOs in here. ATO, ATO, ATO. This is ridiculous, dude. Okay, all right, hit us. Okay, so the first one is Google Voice. So this is super, this is super funny. This is literally, like, you don't even need auth for this endpoint. Like, this GFiber Voice PA, you can just hit this endpoint with, like, an unobfuscated guy. Keep in mind, these are, like, incremental, basically. You can, like, increment this. And it dumps, like, the Google account phone number, the Google Voice number, like, the email, their PIN, like, everything. And it just dumps everything. And it didn't even end there. So there was this endpoint in this where you can assign a number. So I can add a phone number to your Google account, and it would be, like, it literally if you go to my account, the Google account slash phone, you'll see it there. Oh, my gosh. That was pretty funny. That is nuts. I can't believe this had no auth. Oh, my gosh. Yeah, it was, you just needed a key. Like, I guess nobody found the key. So that's why nobody found this. Do you know off the top of your head where this key came from? Like, what strategy you used to get this key? Okay, honestly, I have no traction for that. I have legit no clue where the key came from. Probably one of the various sources I had. But, yeah. I feel like that would be a really interesting piece, though, dude, is to, like, know, "Okay, hey, I have this key. I have this key. I have this key. I have this key." 80% of my keys that I get vulnerabilities in come from, like, old APKs or something like that, right? Yeah, I tracked where I found all of mine, so I can, like, always ask it where it found it. Yeah. Yeah. But I'm also not Brute Cat, so. Yeah. And I also only have, like, 700 keys or 800 keys versus, like, yeah. Wow, dude, that is horrible. Horrifying, for one, and also very interesting scope. I think you said in the write-up that this was actually, like, some sort of provider API. Is that what happened? So, okay, I'm not too sure what this whole, like, API is, honestly. It looks like some admin management API. But the more interesting part of this API is not only could you do all this Google account stuff, it seemed to be, like, some sort of, like, Google Fiber stuff as well. So if you look at the bottom, right? There's, like, some sort of seemingly endpoint that you could do a SimSoft with, like, I mean, I never got to testing this, because I already reported it, and I just didn't, like, go too much, because I didn't want to, like, lose a bounty. But yeah, these are all, like, super interesting endpoints. I wish I could have tested it. Dude, I'm peeved right now, because I'm about to log into my freaking discovery tool that I use to track the -- I think I have this. I think I have this key and this API. Hmm. Hmm. Hmm. What did you miss? I don't know what I missed, man. Because I actually, you know, what's interesting is I have -- just personally, I have Google Fi. And I was like, oh, this is such an interesting, you know, attack surface, because not very many people actually have Google Fi as their phone provider, right? So I found a bunch of bugs in Google Fi and worked on that scope a lot. Hmm. Yeah. Hmm. Okay. All right. I'm going to -- I'm going to not -- I'm pretty sure I've seen this exact end point, which makes me very mad, especially since there's no auth, right? Like, if it was -- if there was no auth, I would have been like, oh, my God. was some crazy shit you were doing okay anyway it's just your get url i can just do a get to this like just just use the url and you can see the phone number and everything it's so stupid and i think that maybe the reason you might have missed it is because it takes in the unobfuscated guy id so this is actually one trick i did is in my like i provided like a context of like all different accounts has access to yeah as well as like ids for each account so like the unobfuscated id then the like the focus obfuscated guy id all this for like various things a project number project id so it has like values to test if that makes sense yeah totally yeah that's definitely necessary and i don't i don't have ai hooked up to mine so i just like i i had to manually test all of them um so wow yeah this is a beautiful bug or you know i don't know when did you find this bug do you know when this was probably maybe like january this year of this year of 2026 yeah damn it yeah all of this is 2026 oh man all of this is 26 man heck me man all right whatever all right what's the next one this is okay so i mean we can cover ad exchange or okay another one is ldar okay that's kind of interesting so ldar is actually okay i'll talk about corporate google account when you when you visit this is a corporate like domain but the for some reason the api wasn't like on the corp corporately it was it was like exposed publicly so the api was public but the domain itself was all public so the front end i mean so this is kind of funny so elder essentially is this this thing i spoke to eduardo do you know who eduardo is yeah yeah he works for google yeah exactly so i was talking to people about what elder is exactly and it was quite interesting when you report like a bug right and they have to discuss with the product team in terms of like what is a bug and what's intended functionality this all goes through ldar and normally that it also has like elder has like a bunch of like um if let's say i'm doing i guess what i i'm pretty sure it works this way if i'm doing some sort of investigation i want to get like access to certain accounts or like log files i have to go through elder that's that's my understanding of this so i mean if you're if you're googling so elder was pretty funny because literally everything was exposed like i could start reading every asset like assessment or every everything like you see like logs access requests and i even i even made like a little front end or something you could you could see how the elder like report looks like oh my god i was able to get like some css elements oh and the way i found out this i got this bug was because like my ai made an elder report and it like shared it with my like email or some and i i checked my email i started seeing like all these emails from elder like no reply google call like and had links everywhere and all these buganizer links so i already knew like i got some fun wow dude that's crazy so the ai submitted a report and then you got emails to your private gmail account that was saying like oh linking to this google 3 stuff oh my gosh yeah i i did i will say i did have a similar thing the other day with my hackbot where i just i was hacking on something i was writing a report actually and i looked down at my phone and and i see an email from an elder report from this government target that i'm working on and it and it's like uh poc you know and the title and the subject line and i'm like oh okay and it just i mean it wasn't a crazy bug it just it had full like you know impersonation of this you know government entity or whatever but uh yeah that's the reason it emailed you yeah it like holds the email from my account or whatever and like emailed me with it uh which was pretty funny so yeah dude wow this is crazy and you know this one i'm just it looks like you you used origin www.google.com and you were able to get in with first party off yeah so this one didn't have any like white or like the whitelist was a wild card for start by google.com so you could just use anything start google.com wow dang that's crazy dude look at this ui dude you're such a jerk you made this ui you're like hey i actually recreated elder on the oh my gosh if you scroll through it you can see a bunch of like internal stuff oh my god what is this yeah i managed to get this approved through google how i don't know how they have you've got some stuff blocked out that's yeah oh yeah i had to bleep out the emails that was like the one thing i couldn't settle on wow dude that's oh dude you even got the like llc yeah thing at the bottom that's hilarious dude i love it i love it in this case i'm gonna go with the ui and then i'm gonna go with the google.com and then i'm gonna go with the google.com and then i'm gonna go with the google.com and then i'm gonna go with the google.com and then i'm gonna go with the google.com and then i'm gonna go with the google.com and then i'm gonna go with the google.com and then i'm gonna go with the google.com and then i'm gonna go with the google.com and then i'm gonna go with the google.com and then i'm gonna go with the google.com and then i'm gonna go with the google.com and then i'm gonna go with the google.com. and then i'm gonna go with the google.com and then i'm gonna go with the google.com and then i'm gonna go with the google.com and then i'm gonna go with the google.com and then i'm gonna go with the google.com and then i'm gonna go with the google.com and then i'm gonna go with the google.com and then i'm gonna go with the google.com and then i'm gonna go with the google.com and then i'm gonna go with the google.com. and then i'm gonna go with the google.com and then i'm gonna go with the google.com and then i'm gonna go with the google.com and then i'm gonna go with the google.com. and then i'm gonna go with the google.com and then i'm gonna go with the google.com and then i'm gonna go with the google.com and then i'm gonna go with the google.com and then i'm gonna go with the google.com and then i'm gonna go with the google.com. whatever the heck you want um this is crazy dude wow all right um man i'm just i'm kind of blown away like because there's so there's so google is so so i felt like google is such a difficult target but when you put it together the pieces like this you start to see it that yeah there's there's a lot of things that you can access that you shouldn't be able to access if you master first party auth and um you know enumeration of all of the api keys right very it's like an onion if you peel away like the layers or whatever and finally you reach the gold mine it's inside where nobody's such as that surface yeah dude frick that's beautiful and there's like 20 years of you know 20 years plus of uh like data in there it's crazy all right what is uh let's keep going you want to do leaking youtube videos or or what okay yeah this is this is this kind of relates to like so the other thing i was mentioned so pretty much every every google every youtube channel that's a partner has like this whatever hidden cms account a content manager so content manager is like this tool it's like a god mode for youtuber you can strike any channel or like banning channel so this is meant for like big enterprises but but like youtube partners have like a secret account that's like this the same thing but it's used for like content id matching it's like some tool in youtube but yeah the the interesting thing was that whenever a a youtuber uploaded a video right this was actually added as a content id asset because that's how it does the content id like copyright matching tool right so if it turns out right you like the the name of this asset is literally just like auto-generated asset dashed a video id so if you search all assets for auto-generated asset dashed like just dash and then you can so you can start like leaking every single like unlisted video and stuff like that they thought it was private wait what do you mean search for this you're not like because the youtube partner api you can just search for all this wow okay and and what all you need to know is like this title or what i think he's saying that i think he's saying that these were originally like anyone who ever has ever found this api and tested it has just assumed probably that it was just like public assets because when you search it it's like oh yeah these are just videos that exist on youtube right it's no big deal but what he's saying is that all the private ones were still in there but obviously people hadn't really noticed that and the way you could find them is by searching for auto-generated asset dash and then everything after that was like technically like the title of the private video wow is that accurate interesting thing about this yeah did i say that right yeah yeah exactly and you can use the filters right so okay it's theoretically possible like i made a poc for this where i can have like a program that's running that's constantly getting you like video ids because i have like i can filter by time right so i keep keep fetching this like every few seconds and i keep like getting video ids so if i upload a video or any partner channel you will see pop it up there so you can like capture like videos and stuff or you can look at historic you can scrape all the historic videos there's so much stuff you can do here and and i think the impact for this is actually quite big because if you think about it right there's there's all this like poly market and these kind of prediction sites where like i could if let's say google has like they upload like the gemini model like video like they send it as a premiere or something if you can just leak it through this you'll know the data that's going to be released and then you can sort of make a poly market bet on it so that's what i'm saying oh my gosh dude yeah this is one and you got 12k for this this is one of those bugs where if you were actually like a black hat you could have just made so much more money off of it just like oh my gosh yeah actually wait this this hitting me aren't some unlisted videos uh like capture the flags and like big ctfs like wasn't that like the solution to mr beast's ctf and not just that not just that they're even like pocs if i if i upload like a poc or something like that's gonna be here oh my gosh dude it was it was a massively yeah yeah see you know in 12k k for this more were they way more abuse because is this 10k plus one no this is not abuse okay actually you know they tried doing this as an abuse first but i got it out of abuse but but it's still like a yeah i don't know they just gave it 12k i'm not sure wow but i think that impact is much more than my opinion yeah dude me too man me too um okay we've got time for maybe one more of these uh of your write-ups and then i want to hit this cloud console graphql stuff um which one do you think we should go with okay so plx is very interesting so plx if you know if you know anything about google right plx is there like it's an internal like dashboard thing so yeah if we know anything about google then you know that right right yeah of course yeah exactly i was i was like yeah of course yeah of course yeah it's a hides google bug hunter shirt underneath the hands okay tell us about plx which of course i know about already okay it's it's this tables thing where you can you can create like a table and you can put like data inside right so most any googler you ask will know what plx is because they use it every day so this is very interesting anyways it like they this is so this is so stupid they had this api like the data hub like client six of google so this this was like data hub is kind of this this api it's meant for like access controls for plx right so one of the things that you can do with this is you can use the data hub to like access controls for plx right so one of the things that you can do with this is you can use the data hub to like access controls for plx right so one of the things that you can do with this is you can use the endpoints this is the very very beginning like you could you could just use like suggest and then you could start suggesting like tables and stuff so this started like leaking a bunch of tables and stuff but and you can see like like data is like need to know employee data or something but yeah that's kind of interesting but like this is just a table names i wanted to get more than this right so at first i was stuck here but then it turns out right a staging environment for this you could just set an iam policy and add yourself as the admin of the table then you take over the whole table oh my god oh my gosh look at this no and then he dumped it and he was and he was so stoked because his oh center was like i just got all the information yeah right yeah so if you if you scroll down you can see some of the the tables and stuff like i gave up much like internal information here but if you scroll down you can see like they're petabytes in size like a lot of them no but the problem was you could yeah this is like a long time but the issue here was you couldn't directly query the table itself you have the acl endpoint like you can you have the access control but i have no way to query it right but so okay something funny i don't think i wrote it here but just like like maybe a month later like i was i was working with shrugged again and and basically he found he found this like that same application integration had like this one query you could do like a run uh i forgot what it was like i think like some some sort of like query you could do like some sort of tasks you could do and it was like even after all the rc patches this still worked and you could like query these tables itself with that so yeah that was pretty funny i just want to read this real quick this is one of the descriptions of one of the i guess functions in here generate a dump of the ypp corpus of lower tier channels for purposes of capitalized conqueror what the heck oh man i want to i want to use all these things i want to play with all these things goodness this is crazy dude wow um and 12k 12k for that wait this one plx is 12k too yeah um come on yeah yeah i mean it's whatever i guess yeah wow um dude this is really this is really crazy research and i think that it's really impressive how you pivot around staging and you you and and this other guy i think shrugged is his name from the first one that uh you know you guys do multi-step exploits like uh adding yourself as an im user and then back in you know hitting these uh tables right and i i think you know correct me if i'm wrong probably ai isn't putting together these chains for you it's giving it's giving you primitives and then you are putting it together yourself 100 like this is all not ai like ai just finds an initial like lead or something but the rest of the post exploitation is mostly just like doing it manually i don't i don't think that ai is like good enough to combine like different like priorities together and think of stuff like that right now maybe in the future but but yeah this part of it is completely manual wow it definitely can on like stuff that is more regular but i think you're definitely right on programs like this where it's requiring so much like contextual knowledge that you have about google that it just doesn't have totally yeah man so i definitely want to go and move over to this graphql stuff but as soon as i clicked on this link i see data batch execute so maybe maybe it'll all pull together but i also really wanted to get your expertise on that because i see that everywhere and it's very opaque and i wish that there was some primitive that i could use to get more information out of these uh batch execute requests do you have anything that you care to share on that okay so the only thing is there's like this known method where in the javascript called the rbc id you can kind of like find the real rbc or the opposite id yeah but that's like the only real trick you have apart from that like i'm not aware of any other trick you have to just use the javascript files and maybe your ai can like figure out what's happening there for the javascript file and then sort of piece together that but yeah i i built up this whole like catalog of all the rpc ids i could and like brute force them on all the different domains and stuff like i have this tooling where i can sort of test that but i haven't i haven't found like too many bugs from bash execute directly but i'm sure there's bugs here because this is just security by obscurity like i feel like google if you're listening maybe have some grant or something where you give us all the like the protobuf types and everything for that so i think that's a good point i think that's a good point i think that's a good point all these batches i have i have begged them for that because that would be i mean there's so many bugs there i'm positive yeah yeah exactly it's just it's just hidden away like i'm not sure that's what they really want like you really want security about security yeah yeah wow okay so tell me about this uh Google Cloud console GraphQL stuff that you have here, which apparently starts with Google Classroom in some way. - Okay, no, so essentially I was just explaining in this, where like Google Classroom is a good example of like, whereas you have a batch execute endpoint, but the reality is behind the batch execute, it's just a Google API, right? But you have to reach through this batch execute 'cause it's not publicly, the RPC is not publicly exposed. So you have to go through this weird proxy and then you can hit the actual Google API behind the scenes. So in this case, this batch execute, which is this RPC ID, is actually just homeroom.dataservices or like whatever API, right? So in the Classroom PA API, but you can't really, I don't think you can actually hit this directly. So this is a way you can get more attack surface, right? Through all these various proxies. But one of the most interesting proxies was this Cloud Console. So Cloud Console, as you know, it uses GraphQL. So if you browse around Cloud Console, you'll see this like request for the Cloud Console PA or whatever, and it's all like GraphQL requests. It looks as giant. It's intimidating. But the reality of it is it's actually quite funny. So whenever you send a request, it's just using Google APIs in the backend and they screwed up big time. The staging endpoint for this was like, allowed you to like introspect everything 'cause they didn't validate the signature on staging. - Wow. - Yeah, basically my AI actually reported this as a lead. So it's saying like, oh, you can just introspect this. And I didn't realize it at first. And then I looked at it more, I was like, wait a second. Like this opens up a whole new world of attack surface. 'Cause like, I wouldn't have been able to reach this from Google API directly. You know what I mean? - Yeah, totally. Wow, that must've been, yeah, dude, that's a game changer. Wow. - So a lot of this, this part of this write-up is just talking about like how we basically, okay, this was, I was working with Michael Dalton, right? 'Cause he's really familiar with GraphQL. So he was handling most of the, kind of like porting the AI tool or whatever for scanning these bugs, this GraphQL stuff and set, right? So we use a lot of various tricks in this sort of, 'cause you see, if you look at this whole, like get resource building info, like some of these are like mapped to RPCs, right? It's kind of complicated 'cause some of these are, yeah, some of these are mapped to RPCs, it's hard to tell. So we have to kind of assume that some of them are RPCs. And in fact, they had comments as well. So that was very interesting. We had to package this all together and give it to the AI. And we started testing like the whole thing. Oh yeah, another point I want to raise is that you have to, okay, this is one thing you have to be a bit careful of. 'Cause if you're testing GCP, you need like a free trial account, or you're not gonna be able to reach most of the attack surface. But if you give it access to like GraphQL or whatever, it can activate the free trial. So you have to be super careful here, 'cause if you, sorry, you can actually get the full billing. So if you accidentally enable billing and it starts like costing a lot of money, you're gonna get bleeded, like dry or something. - Yeah, I literally got charged 3K. I literally got charged 3K like two weeks ago. - No way. - And was only able to do a refund for like 2K of it. I ended up eating the other $1,000. Yeah, and it's, but like, and the model was literally like, oh, I was able to enable 15 free seats on this service. It's like, no, it's not free. They charge you after the fact. They use, you know, you spin it up and then they charge you later. - Oh my gosh. - But also it's so useful, right? Because like I was talking to another Google hacker, I know you know them, BruteCat, named Pedros. And Pedros is like really smart and wrote like that FireBlazer tool, which I mean, he's also just like BruteCat willing to share so much with the community when really if he had just used it only himself, he would have made way more money probably. And he doesn't use any billing accounts for any of his testing. And so even though he's a super talented Google hacker, who's like, you know, made a lot of money and like is not willing to use a billing account. And I'm sure there's so many bugs behind that 'cause there's probably lots of people like him, you know, or people who are just like hesitant or scared. And so for me, I feel like I have to keep leaning into using things that are behind the billing account, but it's also like this huge risk at the same time, so. - Totally. - Okay, so the way I solved this problem actually is, okay, I realized that I could create the free trial or whatever, so I could create a free trial on one Gaia. Then I have a different Gaia which is the actual testing one, the testing account that he has access to. And in that way, so I temporarily give it, give the project access to the testing Gaia through the free trial account one. I link the free trial to that one. Then I like remove it from the account owner. So it can never actually activate the free trial. The billing account is different from the project owner. - Interesting, okay. So you're using Google's own privilege system there to prevent, but guys, I bet we could also just go in there and put billing limits, couldn't we? - I don't think that's possible. - No, you set a billing limit, but it doesn't actually limit how much they charge you. It just, like they don't have any thing for that. They just notify you. - Yeah, yeah, exactly. It's bullshit. Like they'll just tell you, oh, you just lost like $5,000. - No, and Justin, no, he's not wrong. And there's literally no way to like disable a lot of these services without reaching out to support. And then you're waiting days. That's exactly what happened to me. As soon as I saw the charge, I immediately contacted support and I immediately told AI like, hey, go cancel this. Like it destroyed all the services. It even disabled the APIs at the API level, but they kept charging me because like the only way to turn on and off, like Vertex for enterprise or something is like buy support. And so BruteCat is exactly right. You literally cannot get out of getting charged in those cases. And I kept emailing them every day and was like, hey, I just received another $800 charge. Please go turn it off. I'm bleeding money. And then same thing. You apparently can close the billing account, but I have like real services for my real apps running on the same billing account. - Yeah, we can't do that. We gotta create separate accounts for that. Oh my gosh. - Exactly. Like never link that together. And you have to have a different, if you use a trick I mentioned where you have a different, like two different guys, one that owns a free trial and the other one that doesn't have access to it, but it's the project owner. Like this has worked so far, but keep in mind it will also, the AI will also, it's like a monkey with a machine gun. It's gonna bleed out the whole, like use the whole $300 in like 10 seconds. Like, so you have to keep having your free trials. So I have like 10 free trials so far, like all the different, like using, my mom's card, my dad's card. - Oh my gosh. - Hey mom, I'm gonna give your credit card to my AI and yeah, great. - It has a habit of spending too much money. Sorry about that. - Oh, you're just gonna charge 10K? - Yeah, my bad. - My bad. Wow, man, that's awesome. So you were able to also, you know, kind of hit some GraphQL stuff in combination with Google's RPC stuff across the scope. So I think that is, for me, I mean, I think GraphQL stuff is a little bit more approachable than a lot of this, like Google RPC, ProtoJSON nonsense. But yeah, that is impressive that you were able to bridge that gap. Yeah, I think we've got about five more minutes left. There's like so much to cover in this, you know, blog post. So really, listeners, you have to go and read this, you know, blog post like it's gospel, really. We'll link the blog post in the description. - Or just don't, just listen to the audio and go give Brutecat a follow and hire as pen test, but don't apply any of these learnings to your hacking. That'd be great. - Yeah, maybe don't. Yeah, you know. - Yeah, that'd be great. - That's what I would recommend, personally, for my own benefit. - That's right. - Yeah. Did you have anything else that you wanted to add in here and shout out that you feel like the people really need to know from these last couple sections? - Okay, yeah, maybe one thing I could mention is the Vortex Assistant. - Okay. - I know it's a cliche, but it's very interesting. So the way this one worked is it's actually a feature that wasn't even rolled out yet. So we were able to enable the experiment. Okay, so first the AI found it from introspection and it found it, but we couldn't even find the functionality of this, like we were looking through the whole UI, it just didn't exist. - Right. - But by using like various tricks and like, like we're changing the JavaScript or whatever, like using the console and setting a debug point and a break point and stuff like that, we were able to like set the flag to enable it, and then we could see the UI. So in this case, I think they did it, they paid for it because they spoke to the product team and they decided that like, well, normally they don't pay for such things. In this case, it was probably going to be released. So yeah, but they may not do this in the future. So, but I think that there's a lot of attack service in terms of like experimental features that you may want to look at. - Yeah, 100%, man, I've had a lot of success with this. Actually, this is one of my top Google hacking tips is pay attention to the feature flags, because Google's, you know, especially now with AI, the release cycle is so rapid, they've got this stuff pushed to prod way before it, you know, it gets released. Tons of vulnerabilities, and if not vulnerabilities, extra functionality that you could, you know, you can be testing and chaining behind those feature flags. That's a great shout out. - Maybe one last thing I can mention, just quickly talk about the App Engine one, 'cause it's pretty funny. Like this was so interesting. So for whatever reason, this, you know, the App Engine dashboard, if you go to, just search App Engine and like GCP and go to there, it's probably one of the most like traffic, like GCP products, I mean, I'm pretty sure it's used everywhere, but then the same dashboard loading endpoint was, it just worked unauthenticated, and you could just supply any project ID there. It just dumps all the like stats and stuff. - No way. - And the stats. - You're joking. - Yeah, the stats contained like the paths and stuff. So if you have like a password reset link, it would just be shown here. So that was really funny. - What? Oh my gosh, dude. Oh, okay, so hey, also I noticed here, you've got the key in the query parameter versus in the request body. Have you noticed any variance between passing the key in by, via the X dash API key header versus the key in the query parameter? - No, there's no difference. If you use the X API keys, it's the exact same thing. - Okay. - Yeah, so there's not any difference, just whichever is preference, I guess. - Wow, dude, that's crazy. - Yeah, but in this case, see, a lot of Google products, they just run on App Engine itself. Like the bug hunter site was vulnerable to this. So if you go to any bug hunters URL, and then I could just query this and see which URL you went to. So that was pretty funny. - Oh my gosh, dude, that is nuts. for all of this. Wow. Wow. Um, very, very good, uh, write-ups here on all of this. Thank you so much for sharing all this dude. This is, uh, very inspiring and also very informative. Uh, the combination of, of both of them. Um, I'm definitely itching to go back to this API scope now. Um, so hopefully, you know, I don't know. I, I'm a little bit on one hand, I'm like itching on the other hand. I'm like, man, BruteCat is so far ahead on this. You know, it's like, uh, do I even give it a shot? But my, my, my experienced bug hunter within me says, absolutely. You know, there's everyone's got to put everything here. Yeah. All the, all the different gadgets and everything I could think of. I put it all in this one post. So if you, if you want to get started in Google server side hacking, like you should, you should just read this and understand every single like primitive and all the gadgets and stuff and apply all of that and build out all the tooling we discussed here. Cause you're going to, you're definitely going to find bugs. I have no doubt about it. I did not get everything. There's no way, right? Like I've definitely missed it. Wow. Inspiring, man. I'm sure even based on all those leads and findings that it's reported to you, I mean, at 670 K and bounty is like, you had to have overlooked or not found lots of stuff down a lot of those paths, right? Each lead it gives you is like a rabbit, a rabbit trail that you went down and I'm sure you went like, you probably haven't seen some of those trails and then some of them you went down and then stopped and got stuck. And then other ones you turned into a ton of bounties, right? Yeah. No, definitely. Like there's probably, there's probably some stuff in there that I haven't even reviewed it because it just got like washed away or something and new leads came up and I never got to it. But so I still think there's probably, there's probably still like bugs lying around, especially the thing I mentioned earlier, where use a bear token. Cause I was using this whole research was all these bounties were mostly from the first body off, but I did not even use like bear, bear off that much. But I think that you could probably use that. And, and especially if you can access some sort of, some sort of like tenant account that's under like a google.com project that you can use that and they'll have access to like tons of more APIs. Like if I know some APIs that have a stubby RC, I could just see it, but I can't, I can't hit it because it doesn't work at first body off. So it's super annoying. It just pisses me off everything. Every time I think about it. Yeah, man. Yeah. I totally feel that. That's how I feel about like all of the APIs that I have access to as well. And you've got all these additional auth methods. Um, wow. That's, that's very inspiring, dude, dude. Um, Joseph, let's give him a little, round of applause here, man. This is, this is, this is some of the best research I think I've ever seen on critical thinking. Um, so thank you so much for gracing us with, uh, the opportunity to disseminate this to the people and for coming on here and talking about it at length. Um, I'm going to give this as much distribution as I possibly can, because, uh, you know, you'd be goaded forever if it was just the rec to proto, uh, you know, tip that you gave out, but this on top of that is just legendary, man. So, yeah, this is literally going to be the Google hacking Bible going for sure. A hundred percent. Thank you so much, man. Yeah, sure. No worries. I think that more about hundreds to try to share research like this, because I'll be honest, right? Like I met so many people from that initial research I shared that I've been doing collapse with them that I would have never been able to find like so many bounties without them. So I think that sharing knowledge to everybody is actually a good thing in the community. Yeah. Wow. I'm very inspiring. Thank you so much. Um, that's the pod y'all go hack Google. And that's a wrap on this episode of critical thinking. Thanks so much for watching to the end. Y'all if you want more critical thinking content, uh, or if you want to support the show, head over to ctbb.show slash discord. You can hop in the community. There's lots of great high level hacking discussion happening there on top of the masterclasses, hackalongs, exclusive content, and a full-time hunters guild. If you're a full-time hunter, it's a great time. Trust me. I'll see you there.