100 Days of Bug Bounty — Day 5 🐞

I started by looking at WAF and CDN behavior, comparing DNS resolutions across different hostnames and checking whether they were consistently pointing through the expected CDN infrastructure.

While doing this, I came across a bunch of seemingly random or "noise" subdomains. At first, they looked like ordinary dead endpoints. Most of them were returning simple Nginx 404 responses, but something didn't quite add up.

These hostnames were resolving to a different IP address from the rest of the infrastructure.

Initially, I thought I had discovered the actual origin server. The Nginx response made it look like I had reached some underlying server directly, so I spent quite a bit of time investigating it.

After carefully comparing the DNS records, responses, headers, and overall behavior, I realized it wasn't that straightforward. The infrastructure appeared to be using these hosts as a separate layer, potentially acting as a decoy, fallback, routing, or sink server for traffic that isn't meant to reach the main application.

In other words, what initially looked like an exposed origin turned out to be much more nuanced. It was a good reminder that a different IP doesn't automatically mean you've found the origin server.

I also continued testing WAF behavior using different HTTP versions, methods, encoding variations, and path representations, followed by a review of security headers such as CSP, HSTS, X-Frame-Options, and the various cross-origin policies.

During the header testing, I found a few sites that appeared to be vulnerable to clickjacking. However, I couldn't demonstrate a meaningful sensitive action, and most bounty programs don't consider a basic clickjacking issue sufficient on its own.

So, no report today.

But Day 5 taught me something important: infrastructure can be deceptive. What looks like an exposed origin might simply be another layer in the architecture. Understanding why something behaves the way it does is just as important as finding it in the first place.

Day 5 complete.

95 days to go.