Spot redirect parameters, read status codes, bypass filters. Lesson rule: follow the parameter, then attack the filter — never the payload list.