GCP - App Engine Unauthenticated Enum

{% hint style="success" %} Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

Check the subscription plans!
Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

{% endhint %}

App Engine

For more information about App Engine check:

{% content-ref url="../gcp-services/gcp-app-engine-enum.md" %} gcp-app-engine-enum.md {% endcontent-ref %}

Brute Force Subdomains

As mentioned the URL assigned to App Engine web pages is <project-uniq-name>.appspot.com and if a service name is used it'll be: <servicename>-dot-<project-uniq-name>.appspot.com.

As the project-uniq-name can be set by the person creating the project, they might be not that random and brute-forcing them could find App Engine web apps exposed by companies.

You could use tools like the ones indicated in:

{% content-ref url="./" %} . {% endcontent-ref %}