Skip to content

Commit

Permalink
Create Lock Mode Bypass v2
Browse files Browse the repository at this point in the history
  • Loading branch information
v4pl authored Dec 6, 2024
1 parent f88eec1 commit 0dca6aa
Showing 1 changed file with 19 additions and 0 deletions.
19 changes: 19 additions & 0 deletions Exploits/Lock Mode Bypass v2
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
Another Google Forms Locked Mode Bypass
This is for educational purposes only, use only on forms that you own
How does this work?
So, you want to know how the genie does his tricks, eh? Well, I'll tell you.
Google is dumb
They forgor to add any checks to make sure locked mode is actually enabled 💀
All that happens when you open a locked Google Form is that it submits a form via POST request that responds with the test (which would usually be locked, but we skipped the part where it tells Chrome to lock itself)
The token sent with the POST request is easily scraped from the form login page

What potential is there for issues by using this?
Every time you make the POST request after the first time, Google emails the owner of the form
The form object on the page gets deleted when the "visibilitychanged" event is fired
2a. The "visibilitychanged" event is only fired by complete obfuscation, not partial or loss of focus.
You're screwed if you don't follow the directions to the T

Link:
https://tinyurl.com/LockedModeBypass2023c

Credits: V4PL

0 comments on commit 0dca6aa

Please sign in to comment.