100 Days of Bug Bounty — Day 9 🐞

Spent the day on the APIs, fuzzing a handful of endpoints to see what would shake loose. Didn't get far, the target is sitting behind a WAF, and most of the interesting payloads got blocked before they even reached the application logic.

Tried a few different angles to see if anything would slip through. Nothing did.

Some days are just about hitting a wall and noting it down. Didn't want to burn more hours forcing it, so called it a day early.

Next up: figuring out what the WAF is actually filtering, and looking for gaps around it rather than through it.

Day 9 complete.

91 days to go.