BlockChainBugz
857 posts

BlockChainBugz
@BlockchainBugz
Proof-Of-Wash!! *Less Bugz and *More Bitcoin (and a few alts).













Ok so.. they left their CDN exposed. If you ping the domain, you get this ip: 151.101.129.49 It turns out this is a fastly.com IP . I had never heard of fastly but it looked to be something similar to vercel, so I figured maybe they had custom deployment links like vercel does. Tried a few different combos and BINGO: btc.day.global.prod.fastly.net This took me to this: d325bmwzjz2yc7.cloudfront.net That’s their CDN bucket on AWS. They currently have it setup so that any invalid endpoints redirect back to index.html I went on a hunch and figured that they’d probably already have their production app stored somewhere in the CDN ready for deployment I used SECLISTs (github.com/danielmiessler… )and ffuf to try out over 20k different combinations on this URL. After some sleuthing, BINGO!! I found these two files: > live.html > .DS_STORE The important one here that immediately caught my eye was “live.html”. That sounded like a prod deployment. And sure enough, it was! This is what the btc.day site will look like on the day the faucet goes live: d325bmwzjz2yc7.cloudfront.net/live.html d325bmwzjz2yc7.cloudfront.net/bitkey.html It turns out the entire faucet will be revealed to just be a promotion scheme to get you to buy a bitkey and use cash app. There is no faucet - at least in the sense most were expecting.





The bitcoin faucet is back. 04.06.26 btc.day






The bitcoin faucet is back. 04.06.26 btc.day






guess a number between 1 and 1,000 $100 to first correct guess












