[Tutorial] Huawei Devices latest EMUI downgrade to bypass Google FRP

Howdy!

This article is a simple tutorial on how to bypass the Google FRP in the latest version of Huawei Devices EMUI. Most common problem that triggers this issue is forgotten Google Account password and forgotten lockscreen password of the device. Based on my research and experience, the latest EMUI of Huawei blocked the old method of the FRP bypass including the Talkback and etc... It is hard to bypass the Google FRP in the latest EMUI due to some harden security patch of it. The only thing to bypass it is to downgrade your latest firmware using some SD Card magic thru it.

I was doing a research on how to bypass this issue in the latest EMUI and the only thing that can make it possible is to downgrade the firmware.

So long story short, here's the steps on how I am able to bypass a Huawei Y9 Prime 2019 Google FRP.

--Things needed--

SD Card (Micro - 4gb up!)
Old Firmware

--Steps--

1. Download old firmware from the internet (In my test I was trying to bypass a Huawei Y9 Prime 2019. So I downloaded the July 2019 update of it)
PS: Just find the firmware on Google.
2. If you have an old SD Card, just backup your important files and reformat it
3. Make a folder and name it "dload" in your SD Card
4. Transfer your downloaded firmware to the dload folder in your SD Card
5. Put the SD Card in your Huawei Device (Make your device was turn off.)
6. Press and hold the Power and Volume Up (+) button of your Huawei Device and wait for the Huawei logo to appear on your screen before you release the power button and keep holding the volume up until the EMUI page will appear then wait for your device to finish the software/firmware update until it will shutdown itself.
7. Press and hold the Power and Volume Up (+) button of your Huawei Device and wait for the Huawei logo to appear on your screen before you release the power button and keep holding the volume up until the EMUI page again. In the EMUI page select "Wipe data/factory reset"
8. Type the word "yes" and select "Wipe data/factory reset" again
9. Select the "Wipe data/factory reset" again. (yes again)
10. After you finish resetting your device, select the "Safe mode" button and wait for your device to reboot
11. After your device finish rebooting for Safe mode, go to the Settings > System > Reset > Reset all settings or you can directly reboot your device again after the Safe mode and done. You can now use Huawei device again.

In my experience, I successfully bypass the Google FRP of the latest EMUI of a Huawei Y9 Prime 2019 device using this method.

Actual picture of the device after the successful bypass.

I hope this article helps you bypass your device.

Cheers and have a great day

Evan!

HTML Injection to XSS bypass in [REDACTED.com]

Howdy!

In this article I will show this simple vulnerability that I found in <redacted.com>. A simple HTML Injection to XSS bypass due to improper sanitation. The web application has a Chat Room feature for their users/customers and due to the improper sanitation, the Room Name become the vulnerable input for the HTML & XSS.

So long story short, here's the report timeline and proof of concept of this issue.

--Proof of Concept--

1. Go to https://<redacted.com>/<redacted>chat
2. Click Create Room
3. Input payload for the room name

Payload: <input/onfocus=prompt(document.domain) autofocus>

4. Click Ok
5. You will notice that the room name will be an input box. now type on that box and see the result.

In result; the payload will make an input box and when a user types any text on the input, the payload will trigger which can results into Cookie Stealing.

Tested in Firefox 56 Windows 10 Platform


--Timeline--

Reported: Nov 12, 2019, 2:04 AM
Fix Confirmation: Nov 25, 2019, 9:52 PM
Bounty: $600

Thanks. I believe it is the largest bounty we have ever paid (we are a very small company), but it was also the most serious/complex vulnerability ever reported. 

So I hope you enjoy this write up and have a great day everyone!