skills.rest
uphiago
uphiagoCOMMUNITY
Explore all skills by this author →
Website𝕏@uphiagoGitHub

origin-ip-discovery

Discover origin server IPs hidden behind CDN or WAF protections.

1.1k|191|Updated Jun 24, 2026
Search Tags:#waf-bypass#passive-dns#origin-ip-discovery#cdn-bypass#cloudflare-recon#favicon-hashing#ssl-certificate-enum
One-click install
npx skills add https://github.com/uphiago/recon-skills --skill origin-ip-discovery
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: origin-ip-discovery
Source: https://github.com/uphiago/recon-skills/tree/main/recon/origin-ip-discovery
Command: npx skills add https://github.com/uphiago/recon-skills --skill origin-ip-discovery

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill solves the critical reconnaissance challenge of accessing the real origin server IP when a target is protected by CDN or WAF services like Cloudflare, Akamai, or Fastly, which block direct access and hide the underlying infrastructure from standard scanning and vulnerability assessment.

Core Features & Use Cases

  • Multi-vector origin discovery: Leverages favicon hash fingerprinting via Shodan, passive DNS historical records, SSL certificate SAN field matching, Google Analytics ID cross-referencing, and common origin leak checks to identify hidden IPs.
  • Use case: Authorized penetration testers targeting CDN-protected web applications can use this Skill to bypass WAF rules and access unfiltered origin servers for comprehensive vulnerability testing.

Quick Start

Use the origin-ip-discovery skill to locate the real origin server IP for target.com that is currently hidden behind Cloudflare protection.

Frequently Asked Questions about origin-ip-discovery

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find the real origin IP address behind Cloudflare or other CDN protections?▼

Origin IP discovery uses multi-vector techniques like favicon hash fingerprinting, passive DNS historical records, and SSL certificate SAN field matching to uncover the real server IP hidden behind Cloudflare or other CDN protections.

What methods help bypass WAF protections during authorized penetration testing?▼

Bypassing WAF rules involves identifying exposed origin IPs via Google Analytics ID cross-referencing and common origin leak vector checks, enabling direct access to unfiltered origin servers for vulnerability testing.

Do I need a Shodan API key for passive DNS and favicon hash fingerprinting?▼

Yes, a Shodan API key is required for full functionality to perform favicon hash fingerprinting and SSL certificate enumeration when discovering hidden origin server IP addresses behind CDN or WAF services.

Can I use SSL certificate SAN field matching to discover hidden origin infrastructure?▼

Yes, SSL certificate SAN field matching identifies hidden origin infrastructure by cross-referencing certificate Subject Alternative Names with target domains to expose unfiltered origin server IP addresses.

What tools are required to perform origin leak vector checks and CDN bypass?▼

Origin leak vector checks and CDN bypass require curl, python3, and a Shodan API key to execute favicon hashing, passive DNS analysis, and Google Analytics ID cross-referencing for origin IP discovery.

Related Skills

Explore More Software Engineering Skills→
zebbernzebbern
4.5k

Shodan Reconnaissance and Pentesting

Query Shodan hosts, ports, banners, and vulnerabilities via CLI and API.

Community
Intermediate
davpatel605-beepdavpatel605-beep

web-pentest

Perform authorized web application penetration testing with structured vulnerability classification and reporting.

Community
Advanced
AeonDaveAeonDave
15

subfinder

Enumerate subdomains for a target domain using passive OSINT sources.

Community
Intermediate
ArianHobson333ArianHobson333
7

reconnaissance

Identify subdomains, ports, endpoints, APIs, and attack surfaces.

Community
Advanced