# How I could have stolen your photos from Google

Google Photos partner-sharing request parameter was base64 with a trailing dot instead of '=', letting an attacker craft a link that silently shares victim's photos with them.

- Payout: $3,134
- Severity: high
- Program: Google
- Credited: Gergő Turcsányi
- Disclosed: 2018-12-11
- Write-up quality: 7/10
- Original: https://avatao.com/blog-how-i-could-have-stolen-your-photos-from-google-my-first-3-bug-bounty-writeups/
- Library page: https://bugbountylibrary.com/r/blog%3Aavatao-com-blog-how-i-could-have-stolen-your-photos-from-google-my-first-3-bug-bounty-writeups
- Tags: domain:web impact:data-leak impact:pii-leak kind:bounty platform:blog sev:high tech:rest technique:source-review vuln:access-control vuln:idor

**Target:** photos.google.com/initps request parameter (base64-encoded)
**Root cause:** The 'request' parameter in the partner-sharing flow is base64-encoded but uses a trailing '.' instead of '=' padding; the server trusts the embedded email without verifying the victim intended to share with that account.
**Steps:**
1. Observe partner-sharing popup URL: `https://accounts.google.com/signin/v2/sl/pwd?...&continue=https%3A%2F%2Fphotos.google.com%2Finitps%3Frequest%3D<base64>.`
2. Notice the request value ends with a '.' — replace it with '=' and base64-decode to get `[[null,"12587427591239"],null,"e-mail@example.com",null,[2,null,"..."]]`
3. Change the embedded email to attacker's address, base64-encode, replace trailing '=' with '.'
4. Send crafted `https://photos.google.com/initps?request=<payload>` to victim; victim logs in and photos are shared with attacker with no notification
**How found:** Manual DevTools network-tab review of Google products; noticed the partner-sharing popup URL had a base64-looking 'request' param ending in a '.' instead of '=', decoded it, and hypothesized the embedded email could be swapped.
**Exploitation:** Attacker crafts a photos.google.com/initps URL with the victim's request blob but attacker's email substituted, sends it to the victim; when the victim authenticates, the partner-sharing completes silently, granting the attacker access to the victim's photo library.
**Insight:** When a token/param looks like base64 but has an odd trailing character, try substituting '=' padding and decoding — encoded blobs often carry trusted fields (like recipient email) that the server fails to bind to the session.