simonkoeck.com

How I Found a $90,000 Remote Code Execution Vulnerability in Google | Simon Koeck

A Flask cookie on developers.google.com was signed with a secret it carried inside itself. Pulling that secret out turned a forged session into code execution across Google's developer sites.

If the page stays blank, open it in a new tab. Your Weird rating still works from the top bar.

Open source