How To Find The Origin IP Behind A CDN Or WAF

Want to find the origin IP?

Find a subdomain without WAF – Use tools like amass, subfinder, or `crt.sh` to enumerate subdomains. Then, test for WAF protection using curl, httpx, or wafw00f.
Extract the ASN – Use `whois domain.com` or `ipinfo.io` to find the ASN (Autonomous System Number).
Check on bgp.he.net – Look up the ASN to find associated IP ranges.
Verify live IPs – Use `nmap -sn ` to ping sweep for active hosts. Confirm with `httpx` or curl.

This method helps bypass Cloudflare or other CDNs, exposing the real origin IP.

You Should Know:

1. Enumerate Subdomains:

Amass:
```
amass enum -d example.com
```
Subfinder:
```
subfinder -d example.com
```
crt.sh:
Visit crt.sh and search for the domain.

2. Check for WAF Protection:

curl:
```
curl -I https://example.com
```

httpx:

httpx -silent -status-code -title -tech-detect -u https://example.com

wafw00f:
```
wafw00f https://example.com
```

3. Extract ASN:

whois:
```
whois example.com
```
ipinfo.io:
Visit ipinfo.io and enter the domain.

4. Check ASN on bgp.he.net:

Visit bgp.he.net and search for the ASN.

5. Verify Live IPs:

nmap:
```
nmap -sn 192.168.1.0/24
```

httpx:

httpx -silent -status-code -title -tech-detect -u http://192.168.1.1

curl:
```
curl -I http://192.168.1.1
```

What Undercode Say:

Finding the origin IP behind a CDN or WAF is a crucial skill for penetration testers and bug bounty hunters. By using tools like amass, subfinder, crt.sh, whois, ipinfo.io, bgp.he.net, nmap, httpx, and curl, you can effectively bypass CDNs and WAFs to uncover the real IP address. Always ensure you have proper authorization before performing these actions, as unauthorized scanning can lead to legal consequences. Practice these commands and techniques in a controlled environment to enhance your skills in cybersecurity.

Useful URLs:

References:

Reported By: Sabber Hossen – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

Join Our Cyber World:

💬 Whatsapp | 💬 Telegram

Listen to this Post