Results 1 to 6 of 6

Thread: Google Email Recovery Vulnerability (Removing Secondary E-mail Address -Self Exploit Share/Save - My123World.Com!

  1. #1

    Google Email Recovery Vulnerability (Removing Secondary E-mail Address -Self Exploit

    #Title: Google Email Recovery Vulnerability (Removing Secondary E-mail Address -Self Exploitation)
    #Author: Sandeep Kamble (www.SandeepKamble.com)
    #Risk Factor: Low (Why low please read below)
    #Attack Type: A User can access B User account Link to remove secondary E-mail address
    #Reported Date: OCT 21 , 2011


    Overview:

    In Google account setting page, when you reset Google account password, it send Reset Password link to your secondary email address. Into that mail there is one more link which can be used remove your secondary email address.

    Vulnerability Description:

    This Vulnerability can be used to remove secondary email address. In this vulnerability we needed to guess ?C variable token to access the any users account link that can be used to remove secondary email address ?C variable token is generating at sever side so that it is not possible to guess this token and so that it can be performed at victim side only. (Self Exploitation)

    Vulnerable Link

    https://www.google.com/accounts/Acco...z_7p8Z4B&hl=en
    Link it has two options, one option is to remove the Secondary and one option to negated email removing operation.
    The above like is accessible to everyone. We cannot generate the token number so we can find the token using

    Google Dork: Inurul : /AccountDisavow?c=

    If you click on the radio button, “No, I didn't create *******@gmail.com - remove my email address, ********@yahoo.com, from this Google Account. “ and then click continue it will remove the email and delete the link token.
    This link will be dead, No one can access it again !

    But if you click on the,” Yes, *******@gmail.com is my Google Account. ” and press continue.
    When u Click on the this radio button the token is not getting deleted, so that may be pages are indexed into Google

    Proof of Concept




    Special thanks to Amol Naik , Anil , veenu bhai

    Warm Regards

    Sandeep Kamble
    www.sandeepkamble.com
    Last edited by [s]; 12-22-2011 at 03:28 PM.
    Garage4Hackers bugs for the community , of the community

    We provide IT
    To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
    :
    To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
    |
    To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.


    To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
    |
    To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
    |
    To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.

  2. #2
    Updating status of this google vulnerability.. 3rd Bug Qualified... Google Rewarded $100



    /$
    Sandeep
    Garage4Hackers bugs for the community , of the community

    We provide IT
    To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
    :
    To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
    |
    To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.


    To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
    |
    To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
    |
    To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.

  3. #3
    Garage Member D4rk357's Avatar
    Join Date
    Jul 2010
    Location
    localhost@mumbai
    Posts
    153
    Blog Entries
    1
    Congratz sandeep .. keep this nice work going ..
    Spirit was turned 2 ashes ,soul endured so much pain..
    now the darker time evanescence ,the fallen shall rise again.

  4. #4
    Infosec Enthusiast AnArKI's Avatar
    Join Date
    Jul 2010
    Location
    London
    Posts
    514
    Blog Entries
    2
    gr8 Sandeep......keep it coming.....lately G4H had become very Google friendly lol..

  5. #5
    Garage Newcomer
    Join Date
    May 2011
    Location
    Localhost@mumbai
    Posts
    32
    good going ... ownage
    Thumbs up

  6. #6
    Garage Newcomer
    Join Date
    Feb 2013
    Location
    127.0.0.1
    Posts
    15
    Way to go bud........ congrats

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •