Published 18 years 5 months ago • Last updated March 22, 2025 • ⏱️ < 1 min read
Google has a cool free service for hosting open source projects which allows you to manage your source code over svn. You can also view the contents anonymously but because some files directly output their contents it's possible to use this service to host malicious server reflected attacks. The lack of any form of CAPTCHA also makes it easy for an attacker to automate this process.
The following proof of concept uses the anonymous feature to include a HTML file which really contains javascript:- Google payload poc
All file types should be forced to download when viewing their contents anonymously