Collected research
$10k host header
Sending a request to Google App Engine's public front end with the Host header set to an internal googleplex.com hostname made it serve that internal application, sidestepping the single sign-on proxy that normally gates it. The researcher reached Google's confidential internal question-and-answer site this way and was paid 10,000 dollars.
Record
- Researcher
- Ezequiel Pereira
- Published by
- Blogger
- Date
- Topic
- HTTP
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Ezequiel Pereira, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .