Web Security

In April 2015, I reported an Insecure Direct Object Reference (IDOR) vulnerability to the Google Vulnerability Reward Program (Google VRP) affecting Google Drive and Gmail attachments. The flaw allowed an attacker to query document metadata, filenames, user account names, and direct download authorization hashes for arbitrary Google Drive accounts by manipulating internal directory object identifiers (docId). Google resolved the issue and awarded a $3,133.70 bounty. Background: Google Drive Sharing Flow When users share files in Google Drive or attach photos/documents via Gmail, Google generates a resource token (a unique file hash) and associates it with the user’s root folder collection (docId). ...

Underc0de 3 is a vulnerable Boot2Root virtual machine designed for penetration testing practice. The attack chain spans web reconnaissance, encoded Local File Inclusion (LFI), credential discovery, cronjob command injection, and final privilege escalation via an SUID buffer overflow. Phase 1: Network Reconnaissance and Port Scanning Identify the target VM using netdiscover or arp-scan: Target IP: 192.168.1.112 Run a full Nmap service scan: nmap -sS -sV -p- -T4 192.168.1.112 PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 6.0p1 Debian 4+deb7u2 25/tcp open smtp Postfix smtpd 80/tcp open http Apache httpd 2.2.22 (Debian) Phase 2: Web Reconnaissance & Base64-Encoded LFI Directory enumeration using dirb reveals an /ascii/ folder and /index.html. Inspecting the HTML source reveals a hidden comment: ...