CTF/pwn writeups and V8 exploitation notes.

A chance Discord message, two missing pieces, and one hour before the window closed: From info leak to RCE on Google Cloud. Three months later, it happened again.

Introduction Hello, I’m RyotaK (@ryotkak ), a security engineer at GMO Flatt Security Inc. A while ago, I participated in the Google Cloud VRP bugSWAT, a live hacking event organized by Google. During this event, I discovered a remote command execution vulnerability in one of Google Cloud’s services. As the vulnerability has now been fixed, I would like to share the technical details in this article. TL;DR Google Cloud has a product called Looker, and this product has a feature to manage Git repositories.

Table of Contents Preface TLDR Live Hacking Event 101 Getting invited Picking the target Why Google SecOps SOAR? Reading the docs Methodology SOAR Integrations Python execution environment aka RCE-as-a-Service IDE custom code validation bypass We are in, what next? Fetching the OAuth Access Token Access token introspection What is gke-init-python used for? Service Account impersonation Prior art What can gke-init-python do? Malachite enters the scene Revised architecture diagram Auth flow is complex Examining SOAR_SIGNED_JWT Connecting the dots Let’s sign our own JWTs! Vertical Privilege Escalation Full SSRF via the HTTPv2 integration Code Execution via SSTI in TemplateEngine PowerUp Full attack scenario The aftermath Remediation Closing Remarks Preface Link to heading This is a behind-the-scenes story of how I found a Service Account impersonation chain leading to vertical privilege escalation within Google SecOps SOAR.

Pentesting Firebase Rəqəmsal oğrulara salam olsun. Pentest üçün mobile app göndərirlər, atırsan JADX ilə statik olaraq analiz etməyə. Şesi nəsə tapmaq üçün “secret_key” …

Found a security vulnerability? Discover our forms for reporting security issues to Google: for the standard VRP, Google Play, and Play Data Abuse.

Technical breakdown of a Remote Code Execution vulnerability in Google Web Designer via a malicious Video Ad Template abusing the NinjaShell API.

Chrome V8 Type Confusion Zero-Day: CVE-2025-10585 - Detailed Code Analysis and Visual Examination

XSS to RCE in Google IDX Workstation: A Technical Deep Dive