Documentation

Welcome to the official CDN BUG HUNTER ENGINE documentation. This guide will help you understand how to use the engine for advanced edge reconnaissance.

1. Getting Started

CDN BUG HUNTER is designed to analyze Content Delivery Networks (CDNs) and extract intelligence that is often hidden. To start, simply enter a hostname (e.g., microsoft.com) into the main analyzer.

2. SNI Candidate Extraction

The "SNI Candidates" section extracts Subject Alternative Names (SANs) from the target's SSL certificate. These are often subdomains or related infrastructures that share the same edge entry point.

  • Click any candidate to instantly re-analyze the engine against that specific SNI.
  • This is useful for finding "Cloudfront-to-Origin" or "Cloudflare-to-Origin" bypasses.

3. Path Discovery (Sitemap)

The sitemap module automatically probes for common sensitive paths. It looks for:

  • Configuration files (.env, config.json)
  • Development artifacts (.git, phpinfo.php)
  • Documentation & API schemas (swagger.json, robots.txt)

4. Understanding the Bug Score

The Bug Hunter Score is an algorithmic rating (0-100) based on the vulnerability potential of the host:

  • High (70+): Host has valid injectable SNIs, no WAF detected, and multiple open ports.
  • Medium (40-69): Host is behind a CDN but shows signs of misconfiguration or exposed metadata.
  • Low (0-39): Host has strong WAF protection and a closed handshake policy.