4 ms·

Can someone explain what's going on? Is this a domain hack to get Google's captcha working under an nsa.gov hostname, presumably so that it's usable on whitelis

Can someone explain what's going on? Is this a domain hack to get Google's captcha working under an nsa.gov hostname, presumably so that it's usable on whitelist firewalls? I'm surprised Google serves a homepage to the domain, and that it doesn't only respond to requests to google.com (etc.)

ryanlol 7y ago
>I'm surprised Google serves a homepage to the domain Google doesn’t, the reverse proxy just rewrites the Host header.
njetten 7y ago
Seems to be on purpose, unless someone really misconfigured their Akamai setup. Your purpose sounds viable
bndw 7y ago
Is this more than a reverse proxy to google.com? Seems like the real question is _why_.
captainmuon 7y ago
My guess: a custom version of Google that allows NSA analysts to do "Google dorking" - searching for vulnerable hosts with Google - without triggering a captcha. Somebody on twitter mentioned they could not get a captcha with strings that usually reliably cause one. Maybe this is just a fake front page that calls to the Google search API and pretends to be Google proper. Either it is for agents in the field to inconspicuously use google or they misconfigured it to be public?
- FDSGSG 7y ago
  Your guess is wrong. This isn't a custom version of google. It's just a regular akamai reverse proxy setup. > Either it is for agents in the field to inconspicuously use google By visiting a nsa.gov subdomain served by akamai? Yeah right. I feel like heading to www.google.com would be far less conspicuous.
  - captainmuon 7y ago
    You can do that? I would expect Google to flag connections to the search page that don't terminate on a residential/commercial IP as suspicious and show you the near "unsolvable" captcha. At least that is my experience with proxying google services (e.g. silly setup for accessing them from China). Datacenter IPs or SSL "MitM" connections reliably trigger it.
    - FDSGSG 7y ago
      Depends very much on which datacenter you're using. I'd imagine google doesn't get much (any) bot traffic from Akamai, so I'm not surprised that their ranges aren't flagged yet.
      - jjeaff 7y ago
        But all it takes is a few dozen queries in fast succession and google will start showing a captcha. At least, that is how it seemed to be a few years ago.
        tempestn 7y ago
        I wonder how many people are currently submitting queries via that page...
        ryanlol 7y ago
        Akamai rotates their source IPs a lot so you wouldn’t get a captcha very fast.
    - VectorLock 7y ago
      I'd love to know what the distribution of tries on the "unsolvable" captcha is when served to real people operating in good faith.
    - penagwin 7y ago
      Anecdotal, and I'm guessing it's because I was logged in (to my long standing personal Google account) - but I didn't have any issues when I was VPN'd through a Vultr vps of mine when I was in my dorm. Again I'm guessing it's because I was logged in, from google chrome.
cm2187 7y ago
If the NSA rids the web of google captchas, it will have fully deserved its budget and all past mistakes will be forgiven!
- dessant 7y ago
  Until then, you can use my browser extension to solve them: https://github.com/dessant/buster https://github.com/dessant/buster
  - morrbo 7y ago
    Huge fan of your work. Use it daily with no problems. Just wanted to say, from the bottom of my heart, thanks.
    - dessant 7y ago
      You're sweet, thanks a lot!
  - matheusmoreira 7y ago
    Thank you so much for creating this.
- dredmorbius 7y ago
  https://mastodon.cloud/@dredmorbius/102054627041751386 https://mastodon.cloud/@dredmorbius/102054627041751386 This is working far faster now than when first posted.

ryanlol 7y ago

>I'm surprised Google serves a homepage to the domain Google doesn’t, the reverse proxy just rewrites the Host header.

njetten 7y ago

Seems to be on purpose, unless someone really misconfigured their Akamai setup. Your purpose sounds viable

bndw 7y ago

Is this more than a reverse proxy to google.com? Seems like the real question is _why_.

captainmuon 7y ago

My guess: a custom version of Google that allows NSA analysts to do "Google dorking" - searching for vulnerable hosts with Google - without triggering a captcha. Somebody on twitter mentioned they could not get a captcha with strings that usually reliably cause one. Maybe this is just a fake front page that calls to the Google search API and pretends to be Google proper. Either it is for agents in the field to inconspicuously use google or they misconfigured it to be public?

FDSGSG 7y ago
Your guess is wrong. This isn't a custom version of google. It's just a regular akamai reverse proxy setup. > Either it is for agents in the field to inconspicuously use google By visiting a nsa.gov subdomain served by akamai? Yeah right. I feel like heading to www.google.com would be far less conspicuous.
- captainmuon 7y ago
  You can do that? I would expect Google to flag connections to the search page that don't terminate on a residential/commercial IP as suspicious and show you the near "unsolvable" captcha. At least that is my experience with proxying google services (e.g. silly setup for accessing them from China). Datacenter IPs or SSL "MitM" connections reliably trigger it.
  - FDSGSG 7y ago
    Depends very much on which datacenter you're using. I'd imagine google doesn't get much (any) bot traffic from Akamai, so I'm not surprised that their ranges aren't flagged yet.
    - jjeaff 7y ago
      But all it takes is a few dozen queries in fast succession and google will start showing a captcha. At least, that is how it seemed to be a few years ago.
      - tempestn 7y ago
        I wonder how many people are currently submitting queries via that page...
      - ryanlol 7y ago
        Akamai rotates their source IPs a lot so you wouldn’t get a captcha very fast.
  - VectorLock 7y ago
    I'd love to know what the distribution of tries on the "unsolvable" captcha is when served to real people operating in good faith.
  - penagwin 7y ago
    Anecdotal, and I'm guessing it's because I was logged in (to my long standing personal Google account) - but I didn't have any issues when I was VPN'd through a Vultr vps of mine when I was in my dorm. Again I'm guessing it's because I was logged in, from google chrome.

cm2187 7y ago

If the NSA rids the web of google captchas, it will have fully deserved its budget and all past mistakes will be forgiven!

dessant 7y ago
Until then, you can use my browser extension to solve them: https://github.com/dessant/buster https://github.com/dessant/buster
- morrbo 7y ago
  Huge fan of your work. Use it daily with no problems. Just wanted to say, from the bottom of my heart, thanks.
  - dessant 7y ago
    You're sweet, thanks a lot!
- matheusmoreira 7y ago
  Thank you so much for creating this.
dredmorbius 7y ago
https://mastodon.cloud/@dredmorbius/102054627041751386 https://mastodon.cloud/@dredmorbius/102054627041751386 This is working far faster now than when first posted.