[Echo5Echo]

Trying to spoof a cupon code request, would appreciate any resources thrown my way to learn how to get this done. 

https://geekydrop.com/api/coupon/claim

 Here’s the setup:

• The system uses a POST API endpoint for coupon claims
  
• The request requires a Bearer token (JWT) for authorization, which includes basic claims like email and session information.
  
• Coupon codes are alphanumeric, 12 characters long.
  
• The server returns a 500 Internal Server Error for invalid input
  
  but I’d like to test the following:
  • Whether coupon codes are predictable or vulnerable to brute-forcing.
    
  • If the JWT implementation has potential weaknesses (e.g., weak signing secret or algorithm tampering).
    
  • How to identify patterns or potential flaws in the API’s response.
    

What I’ve done so far:

• Decoded the JWT to check its payload and algorithm (HS256).
  
• Tested a few common coupon code patterns manually (e.g.,
  SAVE10 ,DISCOUNT20), but the system hasn’t returned valid responses yet.
  
• Analyzed API responses for hints about how coupon validation is processed.