September 23, 2026
100 Days of Bug Bounty — Day 2 🐞
Day 2 was mostly about going deeper with reconnaissance.
By Zubair Ahmed
I started with further subdomain enumeration and then moved on to gathering historical and passive URLs using tools like gau, Wayback, and URLFinder. The goal was to understand the attack surface better and find endpoints that might not be visible from the main application.
Later, I decided to check for subdomain takeover possibilities using Subzy.
It flagged two subdomains pointing towards Mailgun. I registered a Mailgun account and tried to verify whether the subdomains could actually be claimed.
The takeover didn't work.
After looking into it further, it seemed that this was most likely a false positive from Subzy, possibly because Mailgun has changed or patched the way this takeover condition works.
No report today, but I still learned something useful.
Not every tool finding is a vulnerability. Manual verification is what matters.
Day 2 complete.
98 days to go.