Google’s ‘Sorry’ Page Mystery: Harmless Text Injection Discovered (No XSS)
The “sorry” page on Google says “Our systems have detected unusual traffic” when using Tor or a VPN. By tweaking the ?q parameter, you can add text to this page. However, don’t get too excited—no XSS is possible. It’s like customizing a 404 page, only less useful.
Hot Take:
Get ready, Google users! There’s a new way to say “sorry” when you accidentally trigger Google’s suspicious activity alarm. But don’t worry, it won’t send you flowers or chocolates—just some nonsensical bytes and a side of HTML-escaped gibberish.
Key Points:
- Google’s “Sorry” page now includes a mysterious string of bytes.
- The bytes are derived from the ?q parameter, but no XSS is possible.
- Base64 encoding and Protobuf varints play a starring role.
- HTML escaping prevents malicious content injection.
- Phishing-style plaintext URLs might still spook users.
Already a member? Log in here