Tom Anthony: Recent Episodes
None
Short version:
In 2013, Google released a tool to view the manual actions (penalties) they were applying to your own site. I discovered the API endpoint did no authorisation checks, and thus I had access to the full manual actions database.
I reported the issue to Google, who took the tool down for a couple of days to fix it, and paid me a $5000 bug bounty reward. Google didn’t block me from writing a blog post at the time, but I didn’t think they were going to be happy about it, so I’ve waited until now (10 years later!) to write this up.
August 9th 2013 was a Friday. I remember being at work and hearing that the evening before Google had released a viewer for manual actions. Before this, as crazy as it may seem nowadays, you simply didn’t know if Google were penalising you or not.
So the tool was a big deal, and the SEO agency I worked at were very interested in reviewing all our customers’ reports (all good!). We were able to access these reports as we had access to these customers’ Google Webmaster Tools (as it was then called) accounts.
I decided to inspect (on my own time) the API calls behind the scenes. I initially checked if it leaked additional info about penalties – it didn’t.
So I then decided to sanity check that I couldn’t access reports for sites that I shouldn’t have access to.
The payload that went to the API looked like this:
I’ve highlighted the obviously interesting part. Utilising my elite level hacking skills I replayed the request but updated the it to look like this:
Shockingly — IT WORKED. I could put any domain name there and I could view the penalties associated with that domain. It appeared there was no authorisation being done at all — a serious and surprising oversight by Google.
In the hands of a black-hat SEO, these were the key to the castle, as you could now target negative SEO attacks at your competitors to amplify existing penalties they had. It would have been very difficult for victims of such a targeted attack to recover.
I immediately reported the issue to Google. I reported it to both their bug bounty program (my introduction to bug bounty), and I emailed the infamous Matt Cutts (who replied in less than 15 minutes and was very grateful and very nice about the whole thing). Within a few hours they had pulled the tool down, blaming a ‘snag’:
It came back online after the weekend, but without any explanation of why it had been taken down. I have since spoken about this at conferences, but never written about it publicly.
Google paid me $5000 under their bug bounty program, and thus I was introduced to the world of bug bounties. I went on to hack Google’s core search functionality, and found Zoom didn’t rate limit their numeric meeting passwords in my efforts to join Boris Johnson’s cabinet meeting.
Thanks for reading! You can follow me on Twitter here: @TomAnthonySEO.
The post The Time I Hacked Google’s Manual Actions Database appeared first on Tom Anthony.
Short version: Zoom meetings were default protected by a 6 digit numeric password, meaning 1 million maximum passwords. I discovered a vulnerability in the Zoom web client that allowed checking if a password is correct for a meeting, due to broken CSRF and no rate limiting. This enabled an attacker to attempt all 1 million […]
The post Zoom Security Exploit – Cracking private meeting passwords appeared first on Tom Anthony.
Googlebot is based on Google Chrome version 41 (2015), and therefore it has no XSS Auditor, which later versions of Chrome use to protect the user from XSS attacks. Many sites are susceptible to XSS Attacks, where the URL can be manipulated to inject unsanitized Javascript code into the site.
The post XSS attacks on Googlebot allow search index manipulation appeared first on Tom Anthony.
Short version: I discovered a bug that would let any web page identify a logged in FB user by confirming their ID. Facebook fixed in 6-9 months and rewarded a $1000 bounty. Hacker News Discussion In last years coverage of the Facebook / Cambridge Analytica privacy concerns, Mark Zuckerberg was asked to testify before Congress, […]
The post Facebook exploit – Confirm website visitor identities appeared first on Tom Anthony.
The post Hijack the Google Login flow (Bug Bounty Submission) appeared first on Tom Anthony.
Short version: For the $12 cost of a domain, I was able to rank in Google search results against Amazon, Walmart etc. for high value money terms in the US. The Adwords bid price for some these terms is currently around $1 per click, and companies are spendings 10s of thousands of dollars a month […]
The post Google exploit via XML Sitemaps to manipulate search results appeared first on Tom Anthony.
I was conducting some experiments on how Googlebot parses and renders Javascript, and I came across a couple of interesting things about the way it does so. The first is that Googlebot’s Math.random() function produces an entirely deterministic series. I created a small script which uses this identify Google in an obfuscated fashion: http://www.tomanthony.co.uk/fun/googlebot_puzzle.html The […]
The post Googlebot’s Javascript random() function is deterministic appeared first on Tom Anthony.
I reported an issue to Google, which allows an attacker to confirm whether someone is logged in to any one of a list of specific Google accounts.
The post How to confirm a Google user’s specific email address (Bug Bounty Submission) appeared first on Tom Anthony.
In the last couple of days Google announced that they were going to start executing javascript on most pages they visit and thus rendering pages far more akin to how our browsers do it. It was inevitable they’d need to do this, so it is a welcome update. Then today, they announced an updated tool […]
The post Googlebot now accepting Cookies appeared first on Tom Anthony.
tl;dr I found a bug that allowed me to find anyone with a Google+ account’s login email address (even if they chose not to share it). This could be used to target specific people or just crawl Google+ collecting emails, and tying them easily to other social accounts as step one of something nefarious (e.g […]
The post Google Exploit – Steal Account Login Email Addresses appeared first on Tom Anthony.
Since the Panda and Penguin updates, the SEO community has been talking more and more about machine learning, and yet often the term still isn't well understood. We know that it is the "magic" behind Panda and Penguin, but how does it work? Why didn't they use it earlier? What does it have to do with the periodic "data refreshes" we see for both of these algorithms? I think that machine learning is going to be playing a bigger and bigger role in SEO, and so I think it is important that we have a basic understanding of how it works.
The post Machine Learning for SEOs (on Moz) appeared first on Tom Anthony.