5 ms·

Google YOLO clickjacking (2018)

142 points by _Microft 7y ago

dang 7y ago
Discussed at the time: https://news.ycombinator.com/item?id=17044518 https://news.ycombinator.com/item?id=17044518
etxm 7y ago
I feel like the cookie button is shady AF
- p1necone 7y ago
  This is definitely a grey hat blog post.
ethanburrell 7y ago
Hey HN! I really enjoy this type of App Security, anyone know any blogs devoted to this? Or any other places to learn more tricks like this?
- james-imitative 7y ago
  Unenumerated
  - Thorrez 7y ago
    Are you saying there's a blog named Unenumerated that has stuff like this? I can't find it.
- Thorrez 7y ago
  You might check out writeups for CTF challenges in the web category. Also check out the Youtube channel LiveOverflow. A lot of the stuff is binary exploitation, but some is web. https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w
- EdOverflow 7y ago
  Aside from Filedescriptor's work, here are some of my favourite blogs in the web application security space (not an exhaustive list): - https://blog.orange.tw/ https://blog.orange.tw/ - https://ngailong.wordpress.com/ https://ngailong.wordpress.com/ - https://whitton.io/ https://whitton.io/ - https://sakurity.com/blog https://sakurity.com/blog - https://homakov.blogspot.com/ https://homakov.blogspot.com/ - https://buer.haus/ https://buer.haus/ - https://philippeharewood.com/ https://philippeharewood.com/ - https://portswigger.net/research https://portswigger.net/research - https://gerbenjavado.com/ https://gerbenjavado.com/ - https://medium.com/@intideceukelaire https://medium.com/@intideceukelaire - https://samcurry.net/ https://samcurry.net/ - https://stephensclafani.com/ https://stephensclafani.com/ - https://www.josipfranjkovic.com/ https://www.josipfranjkovic.com/ - https://www.arneswinnen.net/ https://www.arneswinnen.net/ - https://blog.assetnote.io/ https://blog.assetnote.io/ - https://medium.com/@alex.birsan https://medium.com/@alex.birsan - https://cablej.io/ https://cablej.io/ - https://jonbottarini.com/ https://jonbottarini.com/ - https://www.corben.io/ https://www.corben.io/ There is also this massive list of write-ups that might be of interest to you: https://github.com/ngalongc/bug-bounty-reference https://github.com/ngalongc/bug-bounty-reference. Shameless plug: I write about web application security at https://edoverflow.com/ https://edoverflow.com/.
  - wrboyce 7y ago
    You may want to edit your comment so the links are not inside a code block (and thus clickable). Thanks.
    - EdOverflow 7y ago
      Updated accordingly. :)
Thorrez 7y ago
Obviously related to the Facebook comment jacking post from yesterday: https://news.ycombinator.com/item?id=22176180 https://news.ycombinator.com/item?id=22176180
dandare 7y ago
> Update. Shortly after thie article was published, Google silently prevented my domain from using the API That will certainly make the problem go away Google ;)
- finnthehuman 7y ago
  Security reports at google are the same as any user interaction: they blow you off until you prove your point on Hacker News

142 points by _Microft 7y ago

dang 7y ago

Discussed at the time: https://news.ycombinator.com/item?id=17044518 https://news.ycombinator.com/item?id=17044518

etxm 7y ago

I feel like the cookie button is shady AF

p1necone 7y ago
This is definitely a grey hat blog post.

ethanburrell 7y ago

Hey HN! I really enjoy this type of App Security, anyone know any blogs devoted to this? Or any other places to learn more tricks like this?

james-imitative 7y ago
Unenumerated
- Thorrez 7y ago
  Are you saying there's a blog named Unenumerated that has stuff like this? I can't find it.
Thorrez 7y ago
You might check out writeups for CTF challenges in the web category. Also check out the Youtube channel LiveOverflow. A lot of the stuff is binary exploitation, but some is web. https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w
EdOverflow 7y ago
Aside from Filedescriptor's work, here are some of my favourite blogs in the web application security space (not an exhaustive list): - https://blog.orange.tw/ https://blog.orange.tw/ - https://ngailong.wordpress.com/ https://ngailong.wordpress.com/ - https://whitton.io/ https://whitton.io/ - https://sakurity.com/blog https://sakurity.com/blog - https://homakov.blogspot.com/ https://homakov.blogspot.com/ - https://buer.haus/ https://buer.haus/ - https://philippeharewood.com/ https://philippeharewood.com/ - https://portswigger.net/research https://portswigger.net/research - https://gerbenjavado.com/ https://gerbenjavado.com/ - https://medium.com/@intideceukelaire https://medium.com/@intideceukelaire - https://samcurry.net/ https://samcurry.net/ - https://stephensclafani.com/ https://stephensclafani.com/ - https://www.josipfranjkovic.com/ https://www.josipfranjkovic.com/ - https://www.arneswinnen.net/ https://www.arneswinnen.net/ - https://blog.assetnote.io/ https://blog.assetnote.io/ - https://medium.com/@alex.birsan https://medium.com/@alex.birsan - https://cablej.io/ https://cablej.io/ - https://jonbottarini.com/ https://jonbottarini.com/ - https://www.corben.io/ https://www.corben.io/ There is also this massive list of write-ups that might be of interest to you: https://github.com/ngalongc/bug-bounty-reference https://github.com/ngalongc/bug-bounty-reference. Shameless plug: I write about web application security at https://edoverflow.com/ https://edoverflow.com/.
- wrboyce 7y ago
  You may want to edit your comment so the links are not inside a code block (and thus clickable). Thanks.
  - EdOverflow 7y ago
    Updated accordingly. :)

Thorrez 7y ago

Obviously related to the Facebook comment jacking post from yesterday: https://news.ycombinator.com/item?id=22176180 https://news.ycombinator.com/item?id=22176180

dandare 7y ago

> Update. Shortly after thie article was published, Google silently prevented my domain from using the API That will certainly make the problem go away Google ;)

finnthehuman 7y ago
Security reports at google are the same as any user interaction: they blow you off until you prove your point on Hacker News