The Time I Hacked Google's Manual Actions Database
In 2013 Google released their Manual Actions viewer tool; within 24 hours I had hacked it and could view the penalties applied to any website.
Read the articleBlog
Tom's blog.
This is my rarely updated blog – mostly focused on my hacking endeavours, but also bit of search, AI, and other random bits.
All posts
Zoom Security Exploit - Cracking private meeting passwords
Short version: Zoom meetings were default protected by a 6 digit numeric password, meaning 1 million maximum passwords. I discovered a vulnerability in the Zoom web…
Read the articleXSS attacks on Googlebot allow search index manipulation
Googlebot is based on Google Chrome version 41 (2015), and therefore it has no XSS Auditor, which later versions of Chrome use to protect the user from XSS attacks…
Read the articleFacebook exploit - Confirm website visitor identities
I discovered a Facebook bug which allows me to identify whether a visitor is logged in to a specific Facebook account. It can check hundreds of identities per second.
Read the articleHijack the Google Login flow (Bug Bounty Submission)
<short version> Google takes some user supplied data in a URL parameter which it expects to be a domain name, but does not validate it is a proper domain name or…
Read the articleGoogle exploit via XML Sitemaps to manipulate search results
Short version: For the $12 cost of a domain, I was able to rank in Google search results against Amazon, Walmart etc. for high value money terms in the US. The…
Read the articleGooglebot's Javascript random() function is deterministic
I was conducting some experiments on how Googlebot parses and renders Javascript, and I came across a couple of interesting things about the way it does so. The first…
Read the articleHow to confirm a Google user's specific email address (Bug Bounty Submission)
I reported an issue to Google, which allows an attacker to confirm whether someone is logged in to any one of a list of specific Google accounts.
Read the articleGooglebot now accepting Cookies
In the last couple of days Google announced that they were going to start executing javascript on most pages they visit and thus rendering pages far more akin to how…
Read the articleGoogle Exploit - Steal Account Login Email Addresses
I found a bug that allowed me to find anyone with a Google+ account's login email address. This could be used to target specific people for spear phishing.
Read the articleDetect if visitors are logged into Twitter, Facebook or Google+
Javascript code to determine whether a website visitor is currently logged into a social media site (Twitter, Facebook or Google+).
Read the articleSetting up Amazon Mechanical Turk with SERP Turkey
Read how to setup and use Amazon's Mechanical Turk with the SERP Turkey tool; a free split-testing CTR analytics tool for SERPs.
Read the articleGoogle's +1 vulnerable to clickjacking?
Facebook and Twitter have both succumbed to clickjacking, and now it seems that Google's new +1 button is just as vulnerable.
Read the article