Post

Some security controls, such as auth checks, rate limiting, WAF rules, and IP allowlisting are often implemented with a gateway. If you're able to discover the origin host and it accepts requests directly, you can bypass all of that by sending your requests straight to the origin.

First, try searching for it throughout the app. Some common places it pops up: - Error messages - JS source - CORS headers - Cloud storage

Then check records that may outlive the change: - DNS history (SecurityTrails, ViewDNS). If the gateway was put in front of an existing app, the old A record still points at the origin - Certificate Transparency (crt.sh) for hostnames they issued certs for but never linked - Shodan/Censys

If that doesn't work, there's active recon. There are two ways to do this: via subdomains or via IP addresses with vhosts. To check subdomains, just do your usual subdomain enumeration and then check each subdomain to see if any of them respond the same as the gateway.