The Time I Hacked Google's Manual Actions Database
In 2013 Google released their Manual Actions viewer tool; within 24 hours I had hacked it and could view the penalties applied to any website.
Read the articleBlog / Security
Security research, explained.
Findings and investigations from my work testing the edges of the web.
Security
Articles in Security
Zoom Security Exploit - Cracking private meeting passwords
Short version: Zoom meetings were default protected by a 6 digit numeric password, meaning 1 million maximum passwords. I discovered a vulnerability in the Zoom web…
Read the articleXSS attacks on Googlebot allow search index manipulation
Googlebot is based on Google Chrome version 41 (2015), and therefore it has no XSS Auditor, which later versions of Chrome use to protect the user from XSS attacks…
Read the articleFacebook exploit - Confirm website visitor identities
I discovered a Facebook bug which allows me to identify whether a visitor is logged in to a specific Facebook account. It can check hundreds of identities per second.
Read the articleHijack the Google Login flow (Bug Bounty Submission)
<short version> Google takes some user supplied data in a URL parameter which it expects to be a domain name, but does not validate it is a proper domain name or…
Read the articleGoogle exploit via XML Sitemaps to manipulate search results
Short version: For the $12 cost of a domain, I was able to rank in Google search results against Amazon, Walmart etc. for high value money terms in the US. The…
Read the articleHow to confirm a Google user's specific email address (Bug Bounty Submission)
I reported an issue to Google, which allows an attacker to confirm whether someone is logged in to any one of a list of specific Google accounts.
Read the articleGoogle Exploit - Steal Account Login Email Addresses
I found a bug that allowed me to find anyone with a Google+ account's login email address. This could be used to target specific people for spear phishing.
Read the article