Evaluating Googles Internal CSP - Base-URI - Noticing Localhost's and :x000 ports


content-security-policy: base-uri 'self'; connect-src 'self'; default-src 'none'; font-src https://fonts.googleapis.com https://fonts.gstatic.com; frame-ancestors https://*.google.com http://*.google.com https://*.proxy.preview.kintaro.goog http://*.proxy.preview.kintaro.goog http://*.c.googlers.com:8082 http://*.c.googlers.com:8080 http://localhost:8082 https://cloud.google.com https://*.proxy.googleprod.com https://*.proxy.googlers.com http://localhost:3000 https://workspace-staging-static-dot-gteam-gsuite-staging.appspot.com https://workspace-staging-static-dot-gteam-gsuite-staging.uc.r.appspot.com; frame-src https://www.google.com/; img-src 'self' https://www.google.com/favicon.ico https://www.gstatic.com/brandstudio/etochat/ https://gweb-eto-chatbot-staging.appspot.com.storage.googleapis.com/ https://ssl.gstatic.com/ ; media-src 'self'; 


Hackertips.today
Screenshot: Evaluate for localhost domains and related ports



content-security-policy: 

  • base-uri 'self'; 
  • connect-src 'self'; 
  • default-src 'none'; 
  • font-src 
    • https://fonts.googleapis.com 
    • https://fonts.gstatic.com; 
  • frame-ancestors:
    • https://*.google.com 
    • http://*.google.com 
    • https://*.proxy.preview.kintaro.goog
    • http://*.proxy.preview.kintaro.goog 
    • Submitted URL: http://proxy.preview.kintaro.goog/
      Effective URL: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fue.appengine.google.com%2F_ah%2Fconflogin%3Fstate%3D...
    • http://*.c.googlers.com:8082
    • http://*.c.googlers.com:8080
    • http://localhost:8082
    • https://cloud.google.com
    • https://*.proxy.googleprod.com
    • https://*.proxy.googlers.com
    • http://localhost:3000
    • https://workspace-staging-static-dot-gteam-gsuite-staging.appspot.com
    • https://workspace-staging-static-dot-gteam-gsuite-staging.uc.r.appspot.com
  • frame-src
    • https://www.google.com/; 
  • img-src 'self' 
    • https://www.google.com/favicon.ico 
    • https://www.gstatic.com/brandstudio/etochat/ 
    • https://gweb-eto-chatbot-staging.appspot.com.storage.googleapis.com/
    • https://ssl.gstatic.com/
  • media-src 'self'; 
  • report-uri /api/v1/csp; 
  • script-src 
    • 'nonce-v3EpWv0eHT'
    • 'strict-dynamic' 
    • 'unsafe-inline' 
    • https: 
    • http:; 
  • style-src 
    • 'self' 
    • 'unsafe-inline' 
    • https://fonts.googleapis.com



host workspace-staging-static-dot-gteam-gsuite-staging.uc.r.appspot.com
workspace-staging-static-dot-gteam-gsuite-staging.uc.r.appspot.com has address 142.250.185.212

Reverse DNS:  142.250.185.212

212.185.250.142.in-addr.arpa domain name pointer fra16s52-in-f20.1e100.net


workspace-staging-static-dot-gteam-gsuite-staging.uc.r.appspot.com has IPv6 address 2a00:1450:4001:812::2014

workspace-staging-static-dot-gteam-gsuite-staging.uc.r.appspot.com mail is handled by 5 gmr-smtp-in.l.google.com
workspace-staging-static-dot-gteam-gsuite-staging.uc.r.appspot.com mail is handled by 40 alt4.gmr-smtp-in.l.google.com
workspace-staging-static-dot-gteam-gsuite-staging.uc.r.appspot.com mail is handled by 10 alt1.gmr-smtp-in.l.google.com
workspace-staging-static-dot-gteam-gsuite-staging.uc.r.appspot.com mail is handled by 30 alt3.gmr-smtp-in.l.google.com
workspace-staging-static-dot-gteam-gsuite-staging.uc.r.appspot.com mail is handled by 20 alt2.gmr-smtp-in.l.google.com


-

 host workspace-staging-static-dot-gteam-gsuite-staging.appspot.com

workspace-staging-static-dot-gteam-gsuite-staging.appspot.com has address 142.250.184.244

workspace-staging-static-dot-gteam-gsuite-staging.appspot.com has IPv6 address 2a00:1450:4001:831::2014

workspace-staging-static-dot-gteam-gsuite-staging.appspot.com mail is handled by 20 alt2.gmr-smtp-in.l.google.com.

workspace-staging-static-dot-gteam-gsuite-staging.appspot.com mail is handled by 5 gmr-smtp-in.l.google.com.

workspace-staging-static-dot-gteam-gsuite-staging.appspot.com mail is handled by 40 alt4.gmr-smtp-in.l.google.com.

workspace-staging-static-dot-gteam-gsuite-staging.appspot.com mail is handled by 10 alt1.gmr-smtp-in.l.google.com.

workspace-staging-static-dot-gteam-gsuite-staging.appspot.com mail is handled by 30 alt3.gmr-smtp-in.l.google.com.


reverse DNS: 142.250.184.244
244.184.250.142.in-addr.arpa domain name pointer fra24s12-in-f20.1e100.net.




Comments

Post a Comment

Please feel free to sign up and join the discussion or start one

Popular posts from this blog

Repost from LI - New WAF Bypass Discovered - Akamai & Cloudflare

Image
Just found this on LinkedIn - Props goes to Amit for the post AMIT BHAKAR AMIT BHAKAR   • 2nd Verified • 2nd Cyber Security Researcher || Bug Bounty Hunter || Penetration Tester || Ethical Hacker|| Cyber Security Researcher || Bug Bounty Hunter || Penetration Tester || Ethical Hacker|| 1d • 1 day ago • Visible to anyone on or off LinkedIn Pending You have already invited AMIT BHAKAR Bug Bounty tips 👀 New WAF Bypass Discovered - Akamai & Cloudflare 🔥 Original Post Link: https://www.linkedin.com/feed/update/urn:li:activity:7364263906405441537/ A fresh technique has been spotted that successfully bypasses WAFs like Akamai and Cloudflare. Payload -  <address onscrollsnapchange=window['ev'+'a'+(['l','b','c'][0])](window['a'+'to'+(['b','c','d'][0])]('YWxlcnQob3JpZ2luKQ==')); style=overflow-y:hidden;scroll-snap-type:x><div style=scroll-snap-align:center>1337</div></address...
Read more

Analyze Object - Attempt prototype pollution - console / inspect .js code

 // Usage examples: // analyzeObject(window.ga, { name: 'ga' }); // analyzeObject(appState, { name: 'appState', maxDepth: 3, tryPollute: true }); (function () { const SUSPICIOUS_NAME_RE = /(csrf|xsrf|token|auth|secret|session|jwt|apikey|api[-_]?key|bearer|cookie|hdr|header)/i; function analyzeObject(target, { name = '(anonymous)', maxDepth = 2, tryPollute = false, // off by default; if true, adds & removes a probe on the prototype showValues = false // keep false to avoid dumping sensitive values to the console } = {}) { if (target == null || (typeof target !== 'object' && typeof target !== 'function')) { console.warn(`[X] Target '${name}' is not an object/function or is null/undefined.`); return; } console.group(`[?] Analyzing '${name}'`); const ownProps = Object.getOwnPropertyNames(target); console.log(`[^] Own properties (${ownProps.length}):`, ownProps); // Classify const types = ownProps.reduce((ac...
Read more

Optimizing the TCP and Kernel of [Ubuntu/kali/Debian]? Here is some optimizations for you (I did not write them / Props to the original author)

# ------------------------------------------------------------------------------------------ Desc: TCPIP Tweaks for Ubuntu / most linux distress Note: This likely will improve your throughput.  I have had no problems with these settings  +    :  #------------------------------------------------------------------------------------------| # INTERFACE SETTINGS # ================== # Please understand these before changing them. # Check out Documentation/networking/ip-sysctl.txt in your kernel source for more details. #---[ FULL CREDIT IS GIVEN TO THE ORIGINAL POSTER ]---# |--------------------------------------------------------------------------------------| #load irc and ftp conntrack helpers if they exist /sbin/modprobe ip_conntrack_irc &>/dev/null /sbin/modprobe ip_conntrack_ftp &>/dev/null #ip fowarding (these must be 1 to be able to forward packets between interfaces!) echo 1 > /proc/sys/net/ipv4/ip_forward echo 1 > /proc/sys/net/ipv4/conf...
Read more