gossan-origin 0.3.3

Discovers the true origin IP of web assets behind CDNs/WAFs, part of the security research ecosystem
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110

# HTTP headers that commonly leak origin server information.
#
# These headers are set by reverse proxies, load balancers, and CDNs
# and often inadvertently disclose the backend server IP, hostname,
# or internal infrastructure details.
#
# Confidence scores indicate how likely the header value is to contain
# actionable origin information (higher = more reliable).
#
# Users can extend this list by creating a custom TOML file.

[[header]]
name = "x-served-by"
confidence = 85
description = "CDN backend identifier"

[[header]]
name = "x-backend-server"
confidence = 90
description = "Direct backend server name"

[[header]]
name = "x-backend"
confidence = 90
description = "Backend identifier"

[[header]]
name = "x-host"
confidence = 80
description = "Original host header"

[[header]]
name = "x-forwarded-server"
confidence = 80
description = "Forwarded server identifier"

[[header]]
name = "x-real-ip"
confidence = 85
description = "Original client IP (may leak upstream)"

[[header]]
name = "x-origin-server"
confidence = 90
description = "Origin server identifier"

[[header]]
name = "x-server"
confidence = 70
description = "Server identifier"

[[header]]
name = "via"
confidence = 50
description = "Proxy chain information"

[[header]]
name = "x-powered-by-plesk"
confidence = 60
description = "Plesk hosting panel identifier"

[[header]]
name = "x-amz-cf-id"
confidence = 40
description = "CloudFront request ID"

[[header]]
name = "x-azure-ref"
confidence = 40
description = "Azure reference identifier"

[[header]]
name = "cf-ray"
confidence = 30
description = "Cloudflare ray ID"

[[header]]
name = "server"
confidence = 50
description = "Server software banner"

[[header]]
name = "x-forwarded-for"
confidence = 85
description = "Forwarded chain of client/proxy IPs"

[[header]]
name = "x-originating-ip"
confidence = 85
description = "Originating client IP"

[[header]]
name = "true-client-ip"
confidence = 85
description = "True client IP from CDN"

[[header]]
name = "x-client-ip"
confidence = 85
description = "Client IP from upstream"

[[header]]
name = "x-cluster-client-ip"
confidence = 85
description = "Cluster client IP"

[[header]]
name = "cf-connecting-ip"
confidence = 85
description = "Cloudflare connecting client IP"