As a Xoogler who misses the debug stack, this was some fun nostalgia. Good catch!
Can you tell what SFFE means? GFE is the Google Front End but I can't find much about SFFE.
Google Bug Bounty – The $5k Error Page
11–20 of 144 posts
Re: Google Bug Bounty – The $5k Error Page
#12We do supply high quality medical marijuana (indoors and Outdoors) with great Sativa and Indica strong THC and CBD strains, Our products are of the grade A quality type
Such as
White widow
Purple haze
Afghan kush
Durban poison
And lot more Contact: hackjam600@gmail.com
Re: Google Bug Bounty – The $5k Error Page
#13Re: Google Bug Bounty – The $5k Error Page
#14I discovered the same error/bug a few weeks ago when a co-worker linked "this weird page" to me, I just looked around and thought it's pretty cool too see that part of Google and didn't thought too much of it, closed the tab and went back to my Terminal. :)
I am a bit jealous :). I also did a subdomain search on google a few weeks ago. I stumbled upon a lot of login sites. A subdomain search leaded to 95 subdomains under corp.google.com. There is some strange javascript in those pages, there is a function called riskMi. I don't want to get sucked into it, I'm also closing the tab and going back to my terminal :).
How did you subdomain search? Was it a brute force / dict search?
Re: Google Bug Bounty – The $5k Error Page
#15Earlier quoted context omitted.
I am a bit jealous :). I also did a subdomain search on google a few weeks ago. I stumbled upon a lot of login sites. A subdomain search leaded to 95 subdomains under corp.google.com. There is some strange javascript in those pages, there is a function called riskMi. I don't want to get sucked into it, I'm also closing the tab and going back to my terminal :).
How did you subdomain search? Was it a brute force / dict search?
DNS recon tool should be able to do it. If you look around for DNS online tool couple dozens of Google subdmains will be revealed. With Certificate Transparency this kind of information is not as secret as it used to be. Last year there was a vulnerability I forgot which it was quite big has something to do with a legacy software and it led me to look at what domains are using my company's cert. Qualy's made a tool out of this.
Re: Google Bug Bounty – The $5k Error Page
#16As a Xoogler who misses the debug stack, this was some fun nostalgia. Good catch!
Can you tell what SFFE means? GFE is the Google Front End but I can't find much about SFFE.
fairly sure it just stands for "staticfile frontend".. nothing too exciting.
edit: some support for that at https://bugs.chromium.org/p/chromium/issues/detail?id=548688...
/bns/pe/borg/pe/bns/static-on-bigtable/staticfile.frontend.sffe/93Re: Google Bug Bounty – The $5k Error Page
#17Re: Google Bug Bounty – The $5k Error Page
#18Earlier quoted context omitted.
Can you tell what SFFE means? GFE is the Google Front End but I can't find much about SFFE.
Would be very interesting to know what SFFE means ;)
I'm pretty certain it's a server name.
It's a similar convention as some of their other names such as GRFE (Groups), bsfe (Blog Search Front-End).
https://googlesystem.blogspot.com/2007/09/googles-server-nam...
Re: Google Bug Bounty – The $5k Error Page
#19Nice catch. A long time ago the services on the backend were killed by a special URL. And someone found it, and it wasn't filtered by the front end. And of course someone tried to use it, but it never returns since it kills the service, but their client retried ... it was a lot of "what the heck is happening" going on until SRE figured it out and then they immediately patched the front end and the anomalies stopped. It is too bad the person who caused it didn't file for a bug bounty like this person did, they probably would have had something to show for their efforts besides "hey look at this funny thing you can do, oh wait it doesn't do it any more."