- Origin Domains
	- Content Delivery Networks (CDNs) are used to deliver website content/traffic more efficiently and reduce server load.
	- CDNs are *not* proxies for the real webserver--the real webserver is the origin.
	- Oftentimes, CDNs will block security testing payloads. Find the origin server and bypass the filtering/CDN.
	- Examples (for Akamai):
		- `origin-sub.domain.com`
		- `origin.sub.domain.com`
		- Try sending `Pragma: akamai-x-get-true-cache-key` - key often has origin in it
- Things to look for:
	- Logins
	- Defaultcontent
	- Bypass domains (dev, qa, ww1,ww2,)  
	- 302’s
	- Basic Auth
	- Old looking frameworks
	- Outdated Priv Pol / Trademark
- Favicon analysis
	- Useful when you have a *ton* of webservers to analyze - fingerprint by the favicon
	- [FavFreak](https://github.com/devanshbatham/FavFreak)
- Reporting guidelines:
	- Detailed enough to reproduce
	- Record your proof in case the issue gets fixed before your submission is triaged
	- Some orgs are more mature than others, it may take time – ask your triager
	- Autogenerated / autosubmitted reports are obvious especially if they lack any good information
	- Prove impact. Take it further if you can. Example: An XSS with a simple “alert(1)” could get you $50-100, but can you prove it’s more impactful? We love to see it!