Yaswanth Mangalagiri

Bug discovered on:  1st May 2017       Research time: 10:30 a.m to 11:00 a.m The Google Document is having Google Keep for make notes. It is accessble through Tools menu's   Keep notepad   ,  which opens up Google Keep on the right hand side of the window. The notes could be deleted between clicks by tricking the user. May 1st 2017 : Bug reported. May 2nd 2017: Bug Triaged. May 5th 2017 : Bug filed for panel's evaluation. May 12th 2017:  $500 reward issued ! The vulnerability is now fixed by removing the Delete   and  Add to document  options if the document is embedded in any site and making it work only in docs.google.com.

Bug discovered on: 19th March 2017       Research time: 4:30 p.m to 7:00 p.m Earn more by display ads on blog with  Lithific Ads The security flaw in this post is a combination of the first two Google Bugs which I posted on this blog.  4 months ago...   I was actually trying to find the encrypted ID of the Google drive file where all the form responses are recorded and bypass "Limit to 1 response". In the end, I couldn't find the ID and ended up with the other. The vulnerabilities are: 1.) Leaking of the ID of file in Google Drive containing the form responses. 2.) Obtaining the email-id of the user with just 2 clicks. The vulnerabilities are tested on my test account. Here's how I found out... https://www.iconfinder.com/yaswanth-mangalagiri Want to get icons for app Development Here  it's  https://www.iconfinder.com/iconsets/movie-53 https://www.iconfinder.com/iconsets/office-504 https://www.iconfinder.com/iconsets/security-...

Missing x-frame protection              Discovered on: 22nd, January 2017.            Research Time: 10:00 p.m to 12:00 a.m. Earn more by display ads on blog with  Lithific Ads          Well-placed clicks can make you do unintended actions like DELETING your comments if there is no X-frame protection for any web page because it could be embedded in a frame of evil 😈websites. The attackers can place few clickable elements on the page and make the users perform sensitive actions. I was testing on Yahoo! for vulnerabilities on 21st January and thought to check for Clickjacking vulnerability if other attacks couldn't succeed. I was successful in finding clickjacking vulnerability in one of the end points of  finance.yahoo.com . I thought of submitting the bug to Yahoo! but unfortunately , this type of vulnerability was out of scope😑. Later I thought of testing Google! becaus...

Bug discovered: 26th December 2016.                Research time: 8:30 p.m - 10:00 p.m                          Earn more by display ads on blog with  Lithific Ads CSRF is an  abbreviation for Cross-site Request Forgery.  Web applications issue anti-CSRF tokens when a user requests for actions like Submitting a form , so that the request originates exclusively from that domain. This vulnerability comes into play when the server is not validating the anti-CSRF tokens, through this vulnerability you can make a user perform some actions even though he/she didn't intend to do that. Want to get icons for app Development Here  it's  https://www.iconfinder.com/yaswanth-mangalagiri https://www.iconfinder.com/iconsets/movie-53 https://www.iconfinder.com/iconsets/office-504 https://www.iconfinder.com/iconsets/security-259 I wrote a HTML code for submitting ...

  G o o g l e ! Bug : Circumventing "Limit to 1 response" of  Google forms  ( Parameter Injection )        Discovered on: 30th, November 2016.            Research Time: 2:00 p.m to 9:30 p.m. Earn more by display ads on blog with  Lithific Ads The setting is "Limit to 1 response" which means only one response per user. Once you filled the form there will be no chance to edit the responses or again fill a new form. If you open the form to fill again, the response would be like the image below. There is no way to edit or fill another form (Hurdle 1). I created a test form and checked "Edit after submit". Once this test form is filled I can change the previous response.  I clicked on the "Edit your  response"and intercepted the request.  I changed the form id and forwarded the request. I was able to see the form that was submitted. When I edited the form and submitted, a blank form ...

It was most awaited thing to see the app running on the emulator of Eclipse (worked from 6pm and I could resolve the errors and see the app running at 2:53 am ). I used Android Studio initially for the developing. It is very easy to work with as it involves dragging of the widgets when it comes to front-end development. Later I switched to Eclipse.In Android Studio when you click on RUN button it runs the emulator without running the app even though your code may contain errors. But in Eclipse it is opposite it runs the app on the emulator only when the errors are fixed.                                                            Most common complaint : " R cannot be resolved to a variable " Here are couple of things to do to get rid of this annoying error: i)   You must right click on your project name ii) ...