Hacking into Google's Network for $133,337

Channel:
United States LiveOverflow
Subscribers:
920,000
Published on ● Video Link: https://www.youtube.com/watch?v=g-JgA1hvJzA


Duration: 31:32
1,057,320 views
27,648

In this video we hear the story how Ezequiel Pereira found a critical vulnerability in Google Cloud and was awarded $164,674 in total. This is a crazy bug, because it requires so much knowledge about Google internals. We will learn about Google's Global Software Load Balancer, BNS addresses and other Google secret tricks!

This video was sponsored by the Google Vulnerability Rewards Program:
https://security.googleblog.com/2021/03/announcing-winners-of-2020-gcp-vrp-prize.html

Ezequiel's own Writeup: https://www.ezequiel.tech/2020/05/rce-in-cloud-dm.html
SRE Book: https://sre.google/books/

GCP Prize 2020: https://www.youtube.com/watch?v=J2icGMocQds

00:00 - Intro
00:33 - Meet Ezequiel Pereira
00:58 - The Impact Of The Bug
02:41 - Winning The $133,337 Prize!
04:03 - How To Find a Product To Research?
06:05 - How To Approach Google Products?
07:16 - The BEST Tip For Bug Hunters!
08:08 - What Does Deployment Manager Do?
09:00 - Type Providers: First Research Into Deployment Manager
11:03 - Using Type Providers for SSRF?
13:00 - Going Deeper - Finding A Hidden Version
15:01 - The Google Dogfood Version
15:52 - Discovering Internal Google Options - GSLB
17:34 - The Google SRE Book - Explaining Googles Software Load Balancer
19:34 - Exploiting GSLB?
21:58 - Failing to Exploit GSLB
22:28 - Abusing Protobuf To Find Hidden Enums
25:34 - Google API GRPC/Protobuf Tricks
29:11 - SUCCESS! Attacking Google's Network via GSLB SSRF!
30:34 - Summary

-=[ ❀️ Support ]=-

β†’ per Video: https://www.patreon.com/join/liveoverflow
β†’ per Month: https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join

-=[ πŸ• Social ]=-

β†’ Twitter: https://twitter.com/LiveOverflow/
β†’ Instagram: https://instagram.com/LiveOverflow/
β†’ Website: https://liveoverflow.com/
β†’ Subreddit: https://www.reddit.com/r/LiveOverflow/
β†’ Facebook: https://www.facebook.com/LiveOverflow/



Other Videos By LiveOverflow


2021-06-04Hacker Culture Meritocracy?
2021-05-22Troubleshooting AFL Fuzzing Problems | Ep. 03
2021-05-15Pentesting vs. Bug Bounty vs. Pentesting ???
2021-05-08How Fuzzing with AFL works! | Ep. 02
2021-04-29Why Pick sudo as Research Target? | Ep. 01
2021-04-22How SUDO on Linux was HACKED! // CVE-2021-3156
2021-04-15How To Protect Your Linux Server From Hackers!
2021-04-07Running Out Of Hacking Video Ideas
2021-04-05New Challenges Released for CSCG 2021 (including mine) #shorts
2021-04-01Security YouTuber Drama...
2021-03-17Hacking into Google's Network for $133,337
2021-03-03Start of Cyber Security Challenge Germany 2021 #shorts
2021-02-25Format String Exploit Troubleshooting Over Twitter - bin 0x11 b
2021-02-14How CPUs Access Hardware - Another SerenityOS Exploit
2021-02-05Does Hacking Require Programming Skills?
2021-01-22Reading Kernel Source Code - Analysis of an Exploit
2021-01-10Kernel Root Exploit via a ptrace() and execve() Race Condition
2020-12-24IT Security Career Advice
2020-12-01My Life in Short/Shirt Stories - The Time I Learned PenSpinning (~2007-2009) - Shirt Stories #1
2020-11-26Solving Nintendo HireMe!!! with "Basic" Math
2020-11-19Nintendo Hire me!!!!!!!!


Tags:
Live Overflow
liveoverflow
hacking tutorial
how to hack
exploit tutorial
google
bns address
gslb
google cloud platform
app engine
deployment manager
type provider
google cloud
gcloud
appengine
dogfood
bug bounty
bugbounty
1337
google vrp
vulnerability reward