hakoriginfinder: Find Origin Hosts Behind Reverse Proxies

Overview

hakoriginfinder tests whether IP addresses may host the origin server behind a reverse proxy. It requests a baseline response from a hostname, then sends requests to the supplied IPs with the original host in the Host header and compares response similarity using Levenshtein distance.

It is intended for security practitioners investigating their own infrastructure or conducting authorized assessments. A match is a lead for further verification, not proof that an IP is the origin.

Key Features

• Reads candidate IP addresses from standard input.
• Uses a specified hostname or URL as the baseline.
• Tests HTTP and HTTPS ports 80 and 443 by default, with configurable ports.
• Sets the original host in requests to candidate IP addresses.
• Scores response similarity with the Levenshtein algorithm and a configurable threshold.
• Supports concurrent requests, with a default of 32 threads.
• Prints a match status, tested URL, and distance score for each result.

Use Cases

• A penetration tester can check authorized candidate IP ranges for an application protected by a reverse proxy or WAF.
• A security team can investigate whether a publicly reachable origin server may be bypassing its intended proxy controls.
• An infrastructure operator can validate that known backend addresses return the expected site response when addressed with the production hostname.
• A researcher can triage candidate hosts during scoped web reconnaissance, then manually verify any reported matches.

Project Facts

• Language: Go
• Stars: 1.1k
• Forks: 141
• Archived: No

Getting Started

Install with Go:

go install github.com/hakluke/hakoriginfinder@latest

Provide candidate IPs on standard input and set the target hostname with -h. See the README for options and examples.

Considerations

• Use only against systems you own or are explicitly authorized to assess. Identifying an origin can undermine proxy or WAF protections.
• Response similarity is heuristic: dynamic pages, redirects, error pages, and differing content can affect results. Validate findings independently.
• Candidate IPs must be supplied by the user. The tool does not discover address ranges itself.
• The README documents HTTP and HTTPS requests, default ports, a similarity threshold, and a thread count; plan for network access and potentially many requests when scanning large input lists.
• No license is specified in the provided repository metadata.