Discovery
Locate the origin host behind a reverse proxy
Discover the origin host behind a reverse proxy, useful when a cloud WAF hides the backend.
overview
What carlospolop-hakoriginfinder does
When a site fronts its origin with Cloudflare or another reverse proxy, probes hit the edge, not the backend. hakoriginfinder looks for the real host by comparing candidate IP responses to the public site.
Set the hostname with -h, point a candidate URL or IP file at the node, and optionally enable -s for HTTPS and -p for the listen port. A Levenshtein score against threshold -l decides what counts as a match; -t and -T control threads and timeout.
cdncheck only asks whether a host sits behind a CDN. favup matches favicon hashes. hakoriginfinder scores full response similarity across an address set from asnmap or mapcidr. Trickest runs it as a managed Discovery node that writes a file and a folder.
use cases
Where carlospolop-hakoriginfinder fits
Reach past a cloud WAF to the origin
Find the backend IP behind Cloudflare or a similar proxy so testing hits the application directly instead of the protective layer in front of it.
Match an origin across a netblock
Request the target hostname against every IP in a candidate range and let response comparison reveal which address serves the real site.
Tune matching with a threshold
Adjust the Levenshtein threshold so near-identical backend responses still match while unrelated hosts are rejected, cutting false origins.
Test origins over SSL on custom ports
Set the listen port and SSL flag so the comparison works against backends that serve HTTPS on a nonstandard port behind the proxy.
reference
carlospolop-hakoriginfinder inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| urls-file | FILE | · | File of candidate target URLs or IPs to test as the origin. |
| hostname | STRING | -h | Hostname of the site, for example www.example.com. |
| threshold | STRING | -l | Levenshtein threshold; higher is more lenient (default 5). |
| port | STRING | -p | Port the original hostname listens on. |
| ssl | BOOLEAN | -s | Treat the original hostname as served over SSL (default false). |
| threads | STRING | -t | Number of threads (default 32). |
| timeout | STRING | -T | Timeout in seconds (default 5). |
| debug | BOOLEAN | -d | Show the web server responses used for comparison. |
Showing key inputs. carlospolop-hakoriginfinder exposes 8 inputs in total.
example
Run carlospolop-hakoriginfinder
# carlospolop-hakoriginfinder: compare candidates to www.example.com over HTTPShakoriginfinder -h www.example.com -s -p 443 -l 5 -t 32 -T 5 < candidates.txt[*] Fetching baseline for www.example.com[*] Testing 48 candidate IPs[+] 198.51.100.42 distance=2 MATCH[+] 198.51.100.43 distance=2 MATCH[-] 203.0.113.10 distance=84[-] 203.0.113.11 distance=91[+] likely origin: 198.51.100.42guidance
Choosing carlospolop-hakoriginfinder
Use hakoriginfinder when a target sits behind a reverse proxy or WAF and you want the origin IP. Feed candidate ranges from asnmap or mapcidr plus the hostname via -h. Confirm a hit with httpx before treating it as the live origin.
cdncheck
Detects whether a host is behind a CDN or WAF. hakoriginfinder goes further and tries to find the origin behind it.
favup
Finds origins by matching favicon hashes through Shodan. hakoriginfinder matches full response content across IPs.
httpx
Probes hosts for liveness and tech. hakoriginfinder uses similar requests to pick the origin out of a candidate set.
faq
carlospolop-hakoriginfinder questions
related
More Discovery tools
apkurlgrep
Extract URLs and endpoints from Android APK files.
cariddi
Crawl a domain list and scan responses for endpoints, secrets, tokens, and juicy files.
crawlergo
Browser-driven crawler that harvests requests for downstream scanners.
dirsearch
Web path scanner.
fallparams
Crawl pages, harvest potential parameters, write a custom wordlist.
feroxbuster
Recursive content discovery with smart defaults and rich response filters.
Run carlospolop-hakoriginfinder yourself
asnmap expands a domain into candidate IP ranges, then hakoriginfinder compares each address against the public site and writes the matching origin host as a queryable output.
Facts on this page come from the live Trickest tool library.