B'ad Samurai 🐐<p>sites.google[.]com is so much more bananas than I realized.</p><p>Observed URL Formats:</p><ul><li>Free: <code>sites.google.com/view/</code></li><li>Workspace: <code>sites.google.com/{domain}</code></li><li>Legacy funk: <code>{subdomain}.sites.google.com</code></li><li>Draft access: <code>sites.google.com/d/{uid}/p/{uid2}/edit</code></li><li>Draft redirect: <code>sites.google.com/u/{digit}/d/{uid}/preview</code></li></ul><p>The <code>/view</code> and <code>/{domain}</code> are publicly accessible. But <code>/edit</code> and <code>/preview</code> in the longer format require a Google login. So more like <em>public, but with a Google account</em> even without explicit access.</p><p>The latter are interesting because SEGs and sandboxes can't get beyond the link without a Google account. So this is effectively sandbox evasion for an org using Google or one that allows Google logins. </p><p>In one of my workspaces that blocks Site App usage, it blocked access to the longer formats (because it's <em>draft</em> access). So <em>some</em> protection can be enabled at the Google tenant level.</p><p>But where did a user get this link? Web search? Sponsored links? Or email?</p><p>Choose your own adventure but I see a lot of <em>low regret</em> options, especially from email.</p><p>Not quite sure how I'll add these to the geoshitties list yet. Google may get its own list.</p><p><a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infosec</span></a> <a href="https://infosec.exchange/tags/googlesites" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>googlesites</span></a> <a href="https://infosec.exchange/tags/phishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>phishing</span></a> <a href="https://infosec.exchange/tags/blockthis" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>blockthis</span></a></p>