CTF/pwn writeups and V8 exploitation notes.

KnowBe4 Threat Lab reveals how attackers abuse six Google services to bypass email gateways and deploy credential harvesters and remote access tools.

Security research by R3dpars3c documenting a Universal XSS vulnerability in Google Translate.

What happens when you unleash an AI across all of Google's infrastructure? 1,500 APIs, 3,600 keys, and $500,000 in bounties later, here's what I found.

A chance Discord message, two missing pieces, and one hour before the window closed: From info leak to RCE on Google Cloud. Three months later, it happened again.

Introduction Hello, I’m RyotaK (@ryotkak ), a security engineer at GMO Flatt Security Inc. A while ago, I participated in the Google Cloud VRP bugSWAT, a live hacking event organized by Google. During this event, I discovered a remote command execution vulnerability in one of Google Cloud’s services. As the vulnerability has now been fixed, I would like to share the technical details in this article. TL;DR Google Cloud has a product called Looker, and this product has a feature to manage Git repositories.

Malware Analysis Crash Course Jae Young Kim and Nick Harbour FLARE Learning Hub Contents Contents Introduction Prerequisite Knowledge Setting Up Ackknowledgements About the Authors Chapter 1: x86 Basics Assembly and Disassembly Data Types x86 Registers Instruction Basics MOV NOP Hacking Assembly...

From rate limits to no limits: How IPv6's massive address space and a crafty botguard bypass left every Google user's phone number vulnerable

Table of Contents Preface TLDR Live Hacking Event 101 Getting invited Picking the target Why Google SecOps SOAR? Reading the docs Methodology SOAR Integrations Python execution environment aka RCE-as-a-Service IDE custom code validation bypass We are in, what next? Fetching the OAuth Access Token Access token introspection What is gke-init-python used for? Service Account impersonation Prior art What can gke-init-python do? Malachite enters the scene Revised architecture diagram Auth flow is complex Examining SOAR_SIGNED_JWT Connecting the dots Let’s sign our own JWTs! Vertical Privilege Escalation Full SSRF via the HTTPv2 integration Code Execution via SSTI in TemplateEngine PowerUp Full attack scenario The aftermath Remediation Closing Remarks Preface Link to heading This is a behind-the-scenes story of how I found a Service Account impersonation chain leading to vertical privilege escalation within Google SecOps SOAR.

Step-by-step container escape from a privileged Docker environment using Linux kernel features, Kubernetes insights, and real exploitation techniques.

Pentesting Firebase Rəqəmsal oğrulara salam olsun. Pentest üçün mobile app göndərirlər, atırsan JADX ilə statik olaraq analiz etməyə. Şesi nəsə tapmaq üçün “secret_key” …

Google Cloud Account Takeover via URL Parsing Confusion TL;DR This article walks through a unique OAuth account takeover vulnerability I had recently discovered affecting several Google services. It …

Found a security vulnerability? Discover our forms for reporting security issues to Google: for the standard VRP, Google Play, and Play Data Abuse.

Technical breakdown of a Remote Code Execution vulnerability in Google Web Designer via a malicious Video Ad Template abusing the NinjaShell API.

Chrome V8 Type Confusion Zero-Day: CVE-2025-10585 - Detailed Code Analysis and Visual Examination

XSS to RCE in Google IDX Workstation: A Technical Deep Dive

In our latest research we describe how droppers on Android are the silent malware gate keepers.

What could've been the largest data breach in the world - an attack chain on Google services to leak the email address of any YouTube channel

Phishers abused Google Sites and DKIM replay to send valid-signed emails, bypassing filters and stealing credentials.

You don’t know me, but there’s a good chance I know you.

Finding Google Meet phone numbers and bruteforcing PINs to join random meetings

xdavidhu's bug bounty writeups.

This post is a write up of an XSS in AMP4Email (obviously already fixed) I reported via Google Vulnerability Reward Program in August 2019. The XSS is an example of a real-world exploitation of well-known browser issue called DOM Clobbering.

In December 2018, Amnesty International documented widespread targeted phishing attacks against human rights defenders (HRDs) in the Middle-East and North Africa, in the report "When Best Practice Isn…

(Please ignore mistakes if any!)

Recently i discovered a semi responded SSRF on Vimeo with code execution possibility. This blog post explains how i found & exploited it…

In this work we present Picasso: a lightweight device class fingerprinting protocol that allows a server to verify the software and hardware stack of a mobile or desktop client.