cdn-peek

Scope & authorization

Only run against hosts the user owns or is contractually engaged to test. This is origin discovery for defensive hardening (confirming the edge actually hides the origin), not for attacking third parties. If the target isn't clearly the user's or in-scope, ask before probing.

This skill is deliberately dependency-free: every step is a plain dig, curl, openssl, whois, or nc one-liner. It covers origin reachability, not WAF signature evasion (payload encoding / rule bypass) - that is a separate discipline. Techniques that need API keys or heavy tooling (favicon-hash pivots on Shodan/Censys/ZoomEye/FOFA, historical-DNS via SecurityTrails, passive-source or brute-force subdomain enumeration, app-callback/SSRF leaks) are intentionally out of scope here; note them as unrun if the target warrants a deeper pass.

Step 0 - identify the edge

Match the host's IPs/NS/CNAME against known edge fingerprints, then load that provider's client-IP header. Everything after is provider-agnostic; only the IP ranges and the client-IP header name differ.

Methodology (run in order; each step is a check with a done/result state)

1. Confirm fronted. dig A/AAAA/NS/CNAME, match IPs against the edge ranges from Step 0. If not fronted, stop - there's nothing to bypass.
2. DNS record sweep. dig A/AAAA/CNAME/TXT/MX/SOA/SRV/CAA and _dmarc. SPF ip4:/include:, MX, and autodiscover records frequently name a non-fronted origin or mail IP.
3. CT lookup (free, no key, no brute). One curl to crt.sh and certspotter for *.domain: enumerates subdomains and the host's own cert history. Flag any subdomain resolving to a non-edge IP; a Let's Encrypt / self-issued cert scoped to just the target host (not the edge's shared cert) is a pivotable leak.
4. Fingerprint every non-edge IP. dig -x (reverse DNS), whois (ASN/hosting org), curl banner, openssl s_client cert CN/SAN/issuer. Reveals the hosting footprint even when the box isn't the origin.
5. Host-confusion. curl --resolve target:443:<IP> with the target Host + SNI against each non-edge IP; compare title/body/length to the real fronted response. Same content = origin bypass; different (default vhost) = not the origin.
6. Response-header & error-page leak. curl -I the target and a bogus path; inspect Via, X-Cache, X-Served-By, X-Backend-Server, Server, X-Powered-By, redirect Location, and verbose error bodies for internal hostnames or RFC1918/origin IPs.
7. Client-IP header trust. Send X-Forwarded-For, X-Real-IP, and the edge's own client-IP header (Step 0) = 127.0.0.1; compare responses. Bypasses IP allowlist/geo/rate-limit logic - not the origin. A hardened edge rejects a client-supplied copy of its own header (Cloudflare answers 403 error code: 1000); if the app instead trusts it, that is the finding.
8. Edge header tricks. X-Forwarded-Host, X-Original-URL, blank/mismatched Host - test for cache/redirect poisoning, routing bypass, and header reflection in links.
9. Confirm candidate origin. For any candidate IP from steps 2/3/4: curl -skI --resolve target:443:<IP>. If it returns the target app and isn't firewalled to the edge ranges, it's a full bypass.
10. Port check on a confirmed origin. nc -z the non-HTTP services the edge never proxies (SSH/22, k8s API/6443, kubelet/10250, DB/admin ports).
11. Shared-egress re-front (origin firewalled to the edge is still reachable). When step 9's direct fetch is refused because the origin's firewall/SG only admits the edge's IP ranges, that lock is necessary but not sufficient on a shared-egress CDN - those ranges are shared by every tenant of the provider. Stand up your own zone on the SAME provider (e.g. a free Cloudflare account: a proxied A record -> the target's origin IP, SSL mode Full), and send traffic through it: it now exits the shared edge IPs and passes the firewall, skipping the victim's WAF, rate limits, bot rules, and geo - all of which lived on their edge config, not yours. If the origin answers, the edge-range allowlist is bypassed and only origin authentication closes it. Needs a known origin IP (steps 2-4). This is a distinct bug class ("CDN origin-trust bypass"): the control authenticated a network position, not the request.