cdn_bypass.sh

#!/usr/bin/env bash

# cdn_bypass.sh
# Usage: ./cdn_bypass.sh <domain> <match_string>
# Example: ./cdn_bypass.sh example.com "Example Domain"

DOMAIN="$1"
MATCHSTRING="$2"

# Show usage if arguments are missing
if [[ -z "$DOMAIN" || -z "$MATCHSTRING" ]]; then
	echo "Usage: $0 <domain> <match_string>"
	echo "Example: $0 example.com 1494302000"
	exit 1
fi

echo "[+] Enumerating subdomains with subfinder..."
subfinder -d "$DOMAIN" -silent -o subdomains.txt

echo "[+] Resolving subdomains to A-record IPs using dnsx..."
dnsx -l subdomains.txt -a -resp-only -silent -o subdomains_ips.txt

echo "[+] Expanding each IP to /24 range..."
cat subdomains_ips.txt |
	awk -F '.' '{print $1 "." $2 "." $3 ".0/24"}' |
	sort -u >subdomains_ip_cidrs.txt

echo "[+] Scanning /24 subnets on ports 80,443 with naabu..."
naabu -l subdomains_ip_cidrs.txt -p 80,443 -silent -o naabu_results.txt

echo "[+] Using httpx with custom Host header to detect real origins..."
cat naabu_results.txt |
	httpx \
		-silent \
		-H "Host: $DOMAIN" \
		-match-string "$MATCHSTRING" \
		-json \
		-o httpx_results.json

echo "[+] Done! Results saved to:"
echo "    subdomains.txt          -> enumerated subdomains"
echo "    subdomains_ips.txt      -> resolved A-record IPs"
echo "    subdomains_ip_cidrs.txt -> expanded /24 CIDRs"
echo "    naabu_results.txt       -> open hosts:ports"
echo "    httpx_results.json      -> final HTTP probe results"