Ever wondered what makes a CTF challenge good? I've asked myself that many times. I wrote this to help me answer that question based on discussions with others in the community
Hey folks. You know, on
@GoogleVRP
we actually want to pay you xD. If we tell you something is not meeting the bar, it's a dupe or so, it's because we want to be consistent and fair. The rewards don't come out of our salaries, and we have no quotas to fill. Budget is not an issue
Anyone knows someone called Singh? They found an XSS, but we don't know who to pay for it! If this was you, respond to this tweet with the address you used to verify your identity!
Open source needs everyones help. Starting today Google will be issuing rewards to OSS contributors that help with vulnerability response. Even for bugs found by Google. Read more:
Calling all CTF Authors!
Do you love building CTF tasks? New competition to find the best CTF Tasks, both original (never seen before) and of the past year (Hall of Fame)
Pro tip: if you send an email with ${jndi:dns://foo.com} and you get a DNS callback to - consider that maybe (just maybe), the thing that did the DNS resolution is checking the domain for SPAM.
For those that might have missed it.
@Google
issues monetary payments to the top Google bug hunters, even when no vulnerabilities are found (and before research is started). You can apply for Google's Vulnerability Research Grants here:
Wow, just discovered this great writing resource :-). For those that do bug hunting, a well written report is 10x faster to triage than a poorly written one. If you feel you are often misunderstood and ignored, take a look! I just went through it now.
For those that might need this, but didn't know, Google has been sponsoring CTFs this year (see ). 21 CTFs sponsored so far this year, we are aiming to sponsor 52 by EOY.
One of the best things about CTFs are unintended solutions 😁.
The Google CTF this year had a web task with an HTTP Desync, another one with a race condition, and a third one with a unexpected prototype pollution. IMHO, they were more interesting than the intended bugs!
New video! I'm talking with the bug bounty hunter
@wtm_offensi
about a vulnerability he found in Google Cloud Shell.
And the funny part is, Google even sponsored the video :D
One of the few unsolved tasks in
#GoogleCTF
was (mainly an excuse for me to play Beat Saber :-) but also revealed that PNaCl as an XSS vector is not very well known!
1. new version of so it's as cool as bug hunters deserve
2. new version of so it's more friendly to frequent bug hunters
3. Research Grants every week
4. Meet more bug hunters in person
5. Receive more bugs!
My favorite one was, a colleague found a uXSS in Internet Explorer, reported it, and Microsoft fixed it. Then overnight a significant portion of Google broke because, it turned out part of the behavior of the uXSS was used in a lot of JS apps
@__apf__
I once (unknowingly) broke everything that used Closure JavaScript back in its heyday at Google. Quickly became very popular on chat and got a cool badge for "breaking a significant portion of google3".
Hi!
I would like to release the new version of Tamper Chrome. It's a HTTP Request/Response interception tool.
It's very simple for now. If you have time, please help me test it to uncover embarrassing bugs!
Fixed the old bugs.
New version of Tamper Chrome under development. Looking for testers :)
Known Bugs:
- Deleting headers doesn't delete them
- You have to scroll to see new requests below
Missing Features:
- Response interception
- Repeating requests
Dear Bug Hunters:
While we appreciate you adding music to your videos (please always do that), if you don't choose a royalty-free song (), you'll add Ads to your video.
That said, I would rather watch a video with Ads than a video without music!
Reversing Zenbleed was super fun!
One of my favorite moments was when we confirmed that the speculation rollback of the FPU was the culprit because we had an experiment where you could see the *correct* value of ymm0 (with the upper bits zero as they are supposed to be) changing
Overcoming same-origin policy on same-site-but-cross-origins by setting `document.domain`, will be no longer possible from Chrome 106. Take action now ➡️ // Chrome will disable modifying `document.domain` to relax the same-origin policy
We will give 32 rewards to the best write-ups for GoogleCTF challenges. If you solved a challenge on the quals, submit a write-up before June 30! We have only received 25 so far, easy money!
This is what it looks like when you get caught by Google SRE :)
@epereiralopez
and me finally dropped a shell in a, less significant than hoped, system. Suddenly a greetings.txt appeared :) Kudo's to the kind people of SRE!
#Google
#GoogleVRP
I just pwned Google's Container-Optimized OS again together with
@Markak_
. This time, we used a 0day + cross cache attack. And this makes our second success this month and also my late Christmas present :D
Interesting tweet (and replies). But our team
@Google
has a lot of (seasoned) CTF players, but that's (maybe) just because our interview process optimizes for folks with CTF experience. We test a lot for tech/vuln/exploit knowledge+problem solving under pressure in several areas.
My unsolicited advice to young hackers: don’t get stuck for too long with CTFs, don’t be afraid to move to real-world stuff. It’s more fulfilling and interesting than you think.
Chances are that real-world challenges are even easier than CTFs (for some definitions of “easier”).
New version of Tamper Chrome under development. Looking for testers :)
Known Bugs:
- Deleting headers doesn't delete them
- You have to scroll to see new requests below
Missing Features:
- Response interception
- Repeating requests
just wanted to say, I'm very happy that the CSS attacks are getting so much publicity now a days! We lost a lot of cool tricks like these when died, but I hope a read only version will come back one day.
@RSnake
If you ever wanted to learn about Ethereum vulnerability research, take a look at the security audits from
@AugurProject
(they are launching a bug bounty program next week!)
Regarding the
#GoogleCTF
crypto-reality task: We are truly sorry it was so guessy! We didn't include the source code by accident, and when we noticed, some teams had already solved it, so we felt it wasn't fair to those teams to change the task. We'll be more careful next time 🙇
New: Facebook helped the FBI hack a child predator and sextortionist.
The social media giant paid a cybersecurity firm six figures to develop a zero-day exploit to help the FBI unmask a serial child predator that was using Facebook to terrorize girls.
I needed a new nickname, I like cats. BlackCat sounded too feminine, so I added Sir. Then I found Sir Francis Drake, and I wanted to make it similar so changed it to Sir Dark Cat. That said, I failed at spelling and wrote SirDarckCat instead. Noticed the typo years later.
Anyone up to a small challenge? Here is a 100 year old Mexican ciphertext. Apparently the Mexican president (Venustiano Carranza) used to communicate by telegram, and relied solely on the secrecy of his monosubstitution cipher.
Had a blast this past weekend at
@h2hconference
talking about the basics of CPU vulns and about my experience analyzing a couple vulns from
@taviso
- you can check my slides at (they are not just about Reptar though!) and PoCs:
Psst. this is still a work in progress, but has had a little upgrade.
Less intrusive capture - Capture DOM nodeName/className/id
Auto reporting through /.well-known/security.txt
Payload Generation - Not quite finished
Support for Webex Teams
Tempted to make a public version of the training I did for my team about security@-response 😛. Not sure where I would present it, though.. It's more process/management focused more than technical. Any suggestions?