GCP - App Engine Unauthenticated Enum
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
App Engine
For more information about App Engine check:
GCP - App Engine EnumBrute Force Subdomains
As mentioned the URL assigned to App Engine web pages is <project-uniq-name>.appspot.com
and if a service name is used it'll be: <servicename>-dot-<project-uniq-name>.appspot.com
.
As the project-uniq-name
can be set by the person creating the project, they might be not that random and brute-forcing them could find App Engine web apps exposed by companies.
You could use tools like the ones indicated in:
GCP - Unauthenticated Enum & AccessLearn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Last updated