{"id":13841921,"url":"https://github.com/hakluke/hakoriginfinder","last_synced_at":"2025-04-12T15:39:45.919Z","repository":{"id":37047899,"uuid":"488022040","full_name":"hakluke/hakoriginfinder","owner":"hakluke","description":"Tool for discovering the origin host behind a reverse proxy. Useful for bypassing cloud WAFs!","archived":false,"fork":false,"pushed_at":"2024-01-12T11:56:34.000Z","size":35,"stargazers_count":863,"open_issues_count":1,"forks_count":109,"subscribers_count":9,"default_branch":"main","last_synced_at":"2025-04-03T15:12:24.077Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/hakluke.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-05-02T23:37:27.000Z","updated_at":"2025-04-02T14:58:44.000Z","dependencies_parsed_at":"2024-01-12T15:56:01.705Z","dependency_job_id":null,"html_url":"https://github.com/hakluke/hakoriginfinder","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hakluke%2Fhakoriginfinder","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hakluke%2Fhakoriginfinder/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hakluke%2Fhakoriginfinder/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hakluke%2Fhakoriginfinder/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/hakluke","download_url":"https://codeload.github.com/hakluke/hakoriginfinder/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248590694,"owners_count":21129875,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-04T17:01:24.142Z","updated_at":"2025-04-12T15:39:45.875Z","avatar_url":"https://github.com/hakluke.png","language":"Go","funding_links":[],"categories":["Miscellaneous","Go"],"sub_categories":["Origin IP"],"readme":"# hakoriginfinder\n\nTool for discovering the origin host behind a reverse proxy. Useful for bypassing WAFs and other reverse proxies.\n\n## How does it work?\n\nThis tool will first make a HTTP request to the hostname/URL that you provide and store the response, then it will make a request to every IP address that you provide via HTTP (80) and HTTPS (443) by default (more ports can be given via option), with the `Host` header set to the original host(:port). Each response is then compared to the original using the Levenshtein algorithm to determine similarity. If the response is similar, it will be deemed a match.\n\n## Usage\n\nProvide the list of IP addresses via stdin, and the original hostname via the -h option. For example:\n\n```\nprips 93.184.216.0/24 | hakoriginfinder -h https://example.com:443/foo\n```\n\nYou may set the Levenshtein distance threshold with `-l`. The lower the number, the more similar the matches need to be for it to be considered a match, the default is 5.\n\nThe number of threads may be set with `-t`, default is 32.\n\nThe hostname is set with `-h`, there is no default.\n\nThe ports to use for the IP addresses supplied via stdin is set with `-p`, the default is 80,443.\n\n## Output\n\nThe output is 3 columns, separated by spaces. The first column is either \"MATCH\" or \"NOMATCH\" depending on whether the Levenshtein threshold was reached or not. The second column is the URL being tested, and the third column is the Levenshtein score.\n\n### Output example\n\n```\n$ prips 1.1.1.0/24 | hakoriginfinder -h http://one.one.one.one:80/index.html -p 80,443,8080,8443\nRedirect 301 to: https://one.one.one.one/index.html\nRedirect 308 to: https://one.one.one.one/\nNOMATCH http://1.1.1.31:443/ 56290\nNOMATCH http://1.1.1.17:443/ 56290\nNOMATCH http://1.1.1.4:443/ 56290\nNOMATCH http://1.1.1.0:443/ 56290\nNOMATCH http://1.1.1.27:443/ 56290\nNOMATCH http://1.1.1.1:443/ 56290\nNOMATCH http://1.1.1.11:443/ 56290\nNOMATCH http://1.1.1.3:443/ 56290\nNOMATCH http://1.1.1.25:443/ 56290\nNOMATCH http://1.1.1.5:443/ 56290\nNOMATCH http://1.1.1.24:443/ 56290\n... snipped for brevity ...\nNOMATCH http://1.1.1.185:8443/ 56290\nNOMATCH http://1.1.1.183:8443/ 56290\nMATCH https://1.1.1.1:443/ 0\n... snipped for brevity ...\nNOMATCH http://1.1.1.253:8443/ 56290\nNOMATCH http://1.1.1.252:8443/ 56290\nMATCH https://1.1.1.1:8443/ 0\n```\n\n## Installation\n\nInstall golang, then run:\n\n```\ngo install github.com/hakluke/hakoriginfinder@latest\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhakluke%2Fhakoriginfinder","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fhakluke%2Fhakoriginfinder","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhakluke%2Fhakoriginfinder/lists"}