CloakQuest3r: Check for Exposed Origin IP Addresses

Overview

CloakQuest3r helps security professionals and website administrators assess whether a site's origin server IP may be discoverable despite a reverse proxy or CDN. It looks for exposure indicators through subdomains and passive sources rather than guaranteeing discovery of an origin address.

Use it for an authorized infrastructure review when you want to identify possible DNS, historical-record, or certificate-related clues and then investigate them manually. It is a proof of concept, so results are best treated as leads for defensive validation, not definitive findings.

Key Features

• Checks whether a target domain uses Cloudflare and offers to continue if it does not.
• Enumerates and scans subdomains for IP addresses that may point to the origin server.
• Retrieves historical IP information through ViewDNS and, optionally, SecurityTrails with an API key.
• Analyzes SSL certificates for information that may help assess hosting infrastructure.
• Uses threaded scanning to process subdomains more efficiently.
• Reports scan totals, duration, and any candidate IP addresses found.

Use Cases

• Penetration testers can review a client-authorized domain for possible origin exposure as part of an infrastructure assessment.
• Web administrators can investigate whether legacy DNS records or exposed subdomains undermine proxy protections.
• Defenders can use historical IP and certificate clues to guide follow-up checks and hardening work.
• Security learners can explore proof-of-concept techniques for passive analysis in a controlled, permitted environment.

Getting Started

git clone https://github.com/spyboy-productions/CloakQuest3r.git
cd CloakQuest3r
pip3 install -r requirements.txt
python cloakquest3r.py example.com

Replace example.com with a domain you are authorized to assess. See the README for configuration details, including the optional SecurityTrails API key.

Alternatives

• hakoriginfinder: hakoriginfinder tests supplied IPs against a hostname, while CloakQuest3r combines subdomain, historical IP, and certificate analysis to find exposed origins.

Considerations

• The project describes itself as a proof of concept. It may miss exposed IPs, return outdated information, or produce clues that do not identify the primary host.
• Subdomain records do not necessarily point to the target's origin, and some subdomains may also be protected by a proxy.
• Python and the dependencies in requirements.txt are needed. The README notes a separate python-cryptography package option for Termux users who have installation trouble.
• Use only with written permission from the relevant domain owner. Findings should be verified independently before making security decisions.