Decoding Google: Converting a Black Box to a White Box
a day ago
- Convert Google's attack surface from black box to white box by finding all endpoints and hidden parameters.
- Discovery documents for private Google APIs are accessible without authentication for some, but require API keys or spatula headers for others.
- Web authentication uses X-Goog-Api-Key and SAPISIDHASH; Android uses bearer tokens from refresh tokens with app-specific context.
- Visibility labels (e.g., 'PANTHEON') can reveal hidden API endpoints when provided in discovery requests.
- Android refresh tokens can be obtained via accounts.google.com/EmbeddedSetup and exchanged for bearer tokens with specific scopes and app signatures.
- X-Goog-Spatula header provides keyless authentication for Android app contexts and can fetch discovery documents.
- Error messages leak parameter types and full protobuf definitions when sending invalid JSON or ProtoJson arrays.
- Tools like req2proto automate reconstruction of request protos by brute-forcing field indices.