September 25, 2026
100 Days of Bug Bounty — Day 4 🐞
Day 4 turned out to be one of those days where I spent hours digging but had almost nothing to show for it.
By Zubair Ahmed
I continued with JavaScript analysis, going through different files, looking for hidden endpoints, parameters, API routes, and anything that could lead to an interesting attack surface. The problem was that I kept digging deeper without finding anything particularly useful. At some point, it honestly started feeling like I was wasting too much time in one place.
So I decided to change direction and try some cloud reconnaissance.
I started with AWS bucket enumeration and managed to discover four buckets. Unfortunately, they were all private, so there wasn't much to investigate further.
I then moved on to DigitalOcean buckets. This time, I found one that initially appeared to have read access. That got me interested for a moment, but after manually verifying it, I realized it was another false positive.
No vulnerability today.
But I think these are actually useful days in bug bounty. You learn that reconnaissance isn't always about finding something exciting. Sometimes it's about following a lead, verifying it properly, realizing it's nothing, and moving on.
Day 4 complete.
96 days to go.