Uploaded June 2023 | Updated September 2026, 2 weeks ago
Every year Google celebrates the best security issues found in Google Cloud. This year we take a look at the 7 winners to see if we could have found these issues too. Will I regret not having hacked Google last year?
This video is sponsored by Google VRP:
Follow GoogleVRP Twitter: twitter.com/GoogleVRP
LEARN ON HEXTREE (ad)
Learn hacking on Hextree: hextree.io
Join the Hextree Discord: discord.gg/xgQpCQCpvy
The GCP Prize Winners of 2022:
security.googleblog.com/2023/06/google-cloud-awards-313337-in-2022-vrp.html
1. Prize - $133,337: Yuval Avrahami unit42.paloaltonetworks.com/gke-autopilot-vulnerabilities
2. Prize - $73,331: Sivanesh Ashok and Sreeram KL blog.stazot.com/ssh-key-injection-google-cloud
3. Prize - $31,337: Sivanesh Ashok and Sreeram KL blog.stazot.com/auth-bypass-in-google-cloud-workstations
4. Prize - $31,311: Sreeram KL and Sivanesh Ashok blog.geekycat.in/client-side-ssrf-to-google-cloud-project-takeover
5. Prize - $17,311: Yuval Avrahami and Shaul Ben Hai paloaltonetworks.com/resources/whitepapers/kubernetes-privilege-escalation-excessive-permissions-in-popular-platforms Talk: youtube.com/watch?v=PGsJ4QTlKlQ
6. Prize - $13,373: Obmi obmiblog.blogspot.com/2022/12/gcp-2022-few-bugs-in-google-cloud-shell.html
7. Prize - $13,337: Bugra Eskici https://bugra.ninja/posts/cloudshell-command-injection/
Previous Winners:
GCP Prize 2019: youtube.com/watch?v=J2icGMocQds
GCP Prize 2020: youtube.com/watch?v=g-JgA1hvJzA
GCP Prize 2021: youtube.com/watch?v=GvO2Xtx8p9w
CHAPTERS
00:00 - Intro
01:28 - Python Command Injection (Prize 7)
03:01 - XSS, CSRF and NEL Backdoor (Prize 6)
07:04 - Excessive Permissions in k8s DaemonSets (Prize 5)
09:13 - SSRF auth Authorization Token (Prize 4)
10:46 - OAuth Issue (Prize 3)
12:07 - SSH authorized_key Injection (Prize 2)
14:45 - Kubernetes Engine Privilege Escalation (Prize 1)
18:11 - Discussing the Winner
19:25 - What did I learn from the GCP 2022?
20:51 - Outro
SUPPORT
Per video: patreon.com/join/liveoverflow
Per month: youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join
Buy my handwriting font (ad): shop.liveoverflow.com
WATCH, FOLLOW & READ
Second channel: youtube.com/LiveUnderflow
Twitch: twitch.tv/LiveOverflow
Twitter: twitter.com/LiveOverflow
Instagram: instagram.com/LiveOverflow
TikTok: tiktok.com/@liveoverflow_
LiveOverflow blog: liveoverflow.com
Hextree blog (ad): hextree.io/blog
#GoogleCloud #WebSecurity #LiveOverflow
(ad) LiveOverflow YouTube channel is supported by advertisement and product placement.
Every year Google celebrates the best security issues found in Google Cloud. This year we take a look at the 7 winners to see if we could have found these issues too. Will I regret not having hacked Google last year?
This video is sponsored by Google VRP:
Follow GoogleVRP Twitter: twitter.com/GoogleVRP
LEARN ON HEXTREE (ad)
Learn hacking on Hextree: hextree.io
Join the Hextree Discord: discord.gg/xgQpCQCpvy
The GCP Prize Winners of 2022:
security.googleblog.com/2023/06/google-cloud-awards-313337-in-2022-vrp.html
1. Prize - $133,337: Yuval Avrahami unit42.paloaltonetworks.com/gke-autopilot-vulnerabilities
2. Prize - $73,331: Sivanesh Ashok and Sreeram KL blog.stazot.com/ssh-key-injection-google-cloud
3. Prize - $31,337: Sivanesh Ashok and Sreeram KL blog.stazot.com/auth-bypass-in-google-cloud-workstations
4. Prize - $31,311: Sreeram KL and Sivanesh Ashok blog.geekycat.in/client-side-ssrf-to-google-cloud-project-takeover
5. Prize - $17,311: Yuval Avrahami and Shaul Ben Hai paloaltonetworks.com/resources/whitepapers/kubernetes-privilege-escalation-excessive-permissions-in-popular-platforms Talk: youtube.com/watch?v=PGsJ4QTlKlQ
6. Prize - $13,373: Obmi obmiblog.blogspot.com/2022/12/gcp-2022-few-bugs-in-google-cloud-shell.html
7. Prize - $13,337: Bugra Eskici https://bugra.ninja/posts/cloudshell-command-injection/
Previous Winners:
GCP Prize 2019: youtube.com/watch?v=J2icGMocQds
GCP Prize 2020: youtube.com/watch?v=g-JgA1hvJzA
GCP Prize 2021: youtube.com/watch?v=GvO2Xtx8p9w
CHAPTERS
00:00 - Intro
01:28 - Python Command Injection (Prize 7)
03:01 - XSS, CSRF and NEL Backdoor (Prize 6)
07:04 - Excessive Permissions in k8s DaemonSets (Prize 5)
09:13 - SSRF auth Authorization Token (Prize 4)
10:46 - OAuth Issue (Prize 3)
12:07 - SSH authorized_key Injection (Prize 2)
14:45 - Kubernetes Engine Privilege Escalation (Prize 1)
18:11 - Discussing the Winner
19:25 - What did I learn from the GCP 2022?
20:51 - Outro
SUPPORT
Per video: patreon.com/join/liveoverflow
Per month: youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join
Buy my handwriting font (ad): shop.liveoverflow.com
WATCH, FOLLOW & READ
Second channel: youtube.com/LiveUnderflow
Twitch: twitch.tv/LiveOverflow
Twitter: twitter.com/LiveOverflow
Instagram: instagram.com/LiveOverflow
TikTok: tiktok.com/@liveoverflow_
LiveOverflow blog: liveoverflow.com
Hextree blog (ad): hextree.io/blog
#GoogleCloud #WebSecurity #LiveOverflow
(ad) LiveOverflow YouTube channel is supported by advertisement and product placement.
