White Hats - Nepal

In part two of G Suite vulnerability discussion, I am writing about a simple but quite serious vulnerability in yet another part of G Suite Application. In general, G Suite is a major application of Google with multiple features. Its primary security relies on the concept of Domain Ownership Verification.

Keep reading

After recent finding about Uber and SendGrid bug, I decided to check other third party applications that were also used for similar cases. During the investigation, some third party applications were found to be vulnerable including G Suite.

Keep reading

This is a small proof of concept regarding “Reflective Cross-Site Scripting [ R-XSS ]” which I had found on Ebay. I am not an active participant in bug bounty programs, but one day I had finished all my office works so I was surfing on Facebook and received a  message from my brother, Samir, asking for advice regarding some musical instruments. The message contained a eBay link. Once on eBay, I logged into the site to view details, and suddenly noticed “Help & Contact” menu, I followed that menu and went to “Customer Service” page where I saw a search field, I decided to check for “Cross-Site Scripting [ XSS ]” vulnerability and unexpectedly found POST type R-XSS.

Testing For XSS

As all security researchers do, I also have certain pathways to find vulnerabilities. I always use ’>Test12345<“  as it contains number, letter and syntax. This allows me to see how a website handles user inputs. Some questions like “is the user input sanitized? how sensitive is user input?” can be answered from this idea.

Keep reading

When researching about MX records of slack.com, I noticed that they used a 3rd party email service. In that service, however slack.com was already claimed. After a little more research, I found that all the sub-domains of slack.com like teamname.slack.com also had MX set to the same service. These team domains were not claimed, so the emails for these domains could also be intercepted. What is the major issue with this? Could you send a message to your team from an email? These initial questions lead to a deeper research which discovered a critical vulnerability on Slack that would let me snoop into private slack messages. 

Keep reading

After recent finding about one of the Uber’s subdomain takeover was publicly disclosed, I looked into Uber to find similar bugs. One of my colleagues Abhibandu Kafle, pointed out that em.uber.com also had CNAME pointing to SendGrid and could be vulnerable to similar kind of issue.


I had limited experience using SendGrid, so I focussed on finding other issues instead. Sometimes later, I decided to give it a shot anyway because looking at it through different angles can sometimes open various doors and I was running out of endpoints to look into. So I signed up on SendGrid, a transactional and marketing email service used by uber, to see what was possible. 

Keep reading

Reporter : Vaxo Dai (@___0x00)

After signing up client needs to verify his email address to further use but the confirmation can be bypassed and can put any email address to confirm the user account

Keep reading

This vulnerability has been fixed as of July 20, 2016 and is shared with consent from the vendor.
If you wish to share the information provided in the write up, provide credit for the original author or contact [email protected] for more info.  Timeline of the report

Keep reading