loading
Loading content
loading
Discovery
Discover the origin host behind a reverse proxy, useful when a cloud WAF hides the backend.
overview
When a site fronts its origin with Cloudflare or another reverse proxy, probes hit the edge, not the backend. hakoriginfinder looks for the real host by comparing candidate IP responses to the public site.
Set the hostname with -h, point a candidate URL or IP file at the node, and optionally enable -s for HTTPS and -p for the listen port. A Levenshtein score against threshold -l decides what counts as a match; -t and -T control threads and timeout.
cdncheck only asks whether a host sits behind a CDN. favup matches favicon hashes. hakoriginfinder scores full response similarity across an address set from asnmap or mapcidr. Trickest runs it as a managed Discovery node that writes a file and a folder.
use cases
Find the backend IP behind Cloudflare or a similar proxy so testing hits the application directly instead of the protective layer in front of it.
Request the target hostname against every IP in a candidate range and let response comparison reveal which address serves the real site.
Adjust the Levenshtein threshold so near-identical backend responses still match while unrelated hosts are rejected, cutting false origins.
Set the listen port and SSL flag so the comparison works against backends that serve HTTPS on a nonstandard port behind the proxy.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| urls-file | FILE | · | File of candidate target URLs or IPs to test as the origin. |
| hostname | STRING | -h | Hostname of the site, for example www.example.com. |
| threshold | STRING | -l | Levenshtein threshold; higher is more lenient (default 5). |
| port | STRING | -p | Port the original hostname listens on. |
| ssl | BOOLEAN | -s | Treat the original hostname as served over SSL (default false). |
| threads | STRING | -t | Number of threads (default 32). |
| timeout | STRING | -T | Timeout in seconds (default 5). |
| debug | BOOLEAN | -d | Show the web server responses used for comparison. |
Showing key inputs. carlospolop-hakoriginfinder exposes 8 inputs in total.
example
# carlospolop-hakoriginfinder: compare candidates to www.example.com over HTTPShakoriginfinder -h www.example.com -s -p 443 -l 5 -t 32 -T 5 < candidates.txt[*] Fetching baseline for www.example.com[*] Testing 48 candidate IPs[+] 198.51.100.42 distance=2 MATCH[+] 198.51.100.43 distance=2 MATCH[-] 203.0.113.10 distance=84[-] 203.0.113.11 distance=91[+] likely origin: 198.51.100.42guidance
Use hakoriginfinder when a target sits behind a reverse proxy or WAF and you want the origin IP. Feed candidate ranges from asnmap or mapcidr plus the hostname via -h. Confirm a hit with httpx before treating it as the live origin.
Detects whether a host is behind a CDN or WAF. hakoriginfinder goes further and tries to find the origin behind it.
Finds origins by matching favicon hashes through Shodan. hakoriginfinder matches full response content across IPs.
Probes hosts for liveness and tech. hakoriginfinder uses similar requests to pick the origin out of a candidate set.
faq
related
Extract URLs and endpoints from Android APK files.
Web path scanner.
Crawl pages, harvest potential parameters, write a custom wordlist.
Recursive content discovery with smart defaults and rich response filters.
Maintained gau fork for passive archive URL collection.
Extract JavaScript file URLs from a page or URL list.
asnmap expands a domain into candidate IP ranges, then hakoriginfinder compares each address against the public site and writes the matching origin host as a queryable output.
Facts on this page come from the live Trickest tool library.