Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Bug Bounty – The $5k Error Page

slashcrypto.org

Post reply on HN
Print view View original

21–30 of 144 posts

Re: Google Bug Bounty – The $5k Error Page

#22

Post by to3m »

nodesocket wrote: post #10
ensiferum wrote: post #4

I'm surprised that anyone at the big Corp actually bothered to even reply to this guy reporting the bug much less actually give him a bounty!

Where is this resentment and skepticism coming from? The facts say otherwise. Google is known to be receptive to bounties and payout.

Most of their consumer-facing services are not, shall we say, famous for being high-touch...

But presumably different people look after the security side of things.

Re: Google Bug Bounty – The $5k Error Page

#23

Post by rprime »

terminalcommand wrote: post #7
rprime wrote: post #2

I discovered the same error/bug a few weeks ago when a co-worker linked "this weird page" to me, I just looked around and thought it's pretty cool too see that part of Google and didn't thought too much of it, closed the tab and went back to my Terminal. :)

I am a bit jealous :). I also did a subdomain search on google a few weeks ago. I stumbled upon a lot of login sites. A subdomain search leaded to 95 subdomains under corp.google.com. There is some strange javascript in those pages, there is a function called riskMi. I don't want to get sucked into it, I'm also closing the tab and going back to my terminal :).

Indeed, or sometimes I want to try certain attack vendors and the next second I am thinking I am fooling myself, they're smarter than me, they wouldn't leave such bugs in, queue a few weeks later, someone gets a few $k because they let themselves sucked into it :D.

I guess it's as much mindset as it's skill.

Re: Google Bug Bounty – The $5k Error Page

#24

Post by ArlenBales »

> 10/02/2017 – Google already fixed the issue but forgot to tell me … I contacted them asking for an update

> 19/02/2017 – Got a response, they implemented a short-term fix and forgot to sent my report to the VRP panel …

I hope Google forgetting to follow up on bug bounties and needing to be reminded isn't a common occurrence.

Re: Google Bug Bounty – The $5k Error Page

#27

Post by komali2 »

Macuyiko wrote: post #5

So I was thinking recently... with Google (amongst others, of course) themselves pushing towards AI applications, it seems to me that many of these less-advanced* bounty hunts might perhaps be able to be automated with a fuzzer+scraper+AI based approach. The fact that bug bounties are still being awarded does suggest that this is not that trivial, however, but might still be fun to explore nonetheless. I.e. can one t…

I'm similarly surprised we haven't heard of a AI augmented fuzzer that's been unleashed on random domains to just "try shit out." Seems like a good way to find weird little bugs. Then again, the scope of the "problem" is so massive, and the "rewards" (shit to flag as "yea check this out more") so vague, I don't even know how you'd begin.

Re: Google Bug Bounty – The $5k Error Page

#28

Post by Ajedi32 »

rprime wrote: post #23
terminalcommand wrote: post #7

Earlier quoted context omitted.

I am a bit jealous :). I also did a subdomain search on google a few weeks ago. I stumbled upon a lot of login sites. A subdomain search leaded to 95 subdomains under corp.google.com. There is some strange javascript in those pages, there is a function called riskMi. I don't want to get sucked into it, I'm also closing the tab and going back to my terminal :).

Indeed, or sometimes I want to try certain attack vendors and the next second I am thinking I am fooling myself, they're smarter than me, they wouldn't leave such bugs in, queue a few weeks later, someone gets a few $k because they let themselves sucked into it :D. I guess it's as much mindset as it's skill.

I got a bug bounty once because I reported a bug in Chrome that someone else was complaining about in the comments section of a tech blog.

If instead of just complaining that commenter had taken the time to fill out a bug report they could have easily gotten the bounty instead.

Sometimes it just takes a tiny bit of extra effort to go from noticing something's amiss to actually doing something to get it fixed.

Re: Google Bug Bounty – The $5k Error Page

#29

Post by derefr »

komali2 wrote: post #25

Offtopic: What's with the hyper narrow width on this page? Looks like this on a 1440p monitor (ubuntu, chrome) http://i.imgur.com/m9YWcNj.png

Looks like a mobile layout that is "responsive" in higher resolutions only by adding some extra elements to surround the fixed-width central container.

Re: Google Bug Bounty – The $5k Error Page

#30

Post by eslaught »

komali2 wrote: post #25

Offtopic: What's with the hyper narrow width on this page? Looks like this on a 1440p monitor (ubuntu, chrome) http://i.imgur.com/m9YWcNj.png

The page appears to have about 70 characters on a line:

    >>> len("which is nothing more than a simple login page (seems to be for Google")
    70
This is within the generally accepted guidelines for line length:

https://www.google.com/#q=characters+per+line

The bigger issue is, I think, font size. I could imagine that on certain displays this font might look rather small.

Post reply on HN