Post

Some security controls, such as auth checks, rate limiting, WAF rules, and IP allowlisting are often implemented with a gateway. If you're able to discover the origin host and it accepts requests directly, you can bypass all of that by sending your requests straight to the origin.

So how do we find the origin server? Let's say that the gateway is at api.targetx[.]com

Then check records that may outlive the change: - DNS history (SecurityTrails, ViewDNS). If the gateway was put in front of an existing app, the old A record still points at the origin - Certificate Transparency (crt.sh) for hostnames they issued certs for but never linked - Shodan/Censys

If that doesn't work, there's active recon. There are two ways to do this: via subdomains or via IP addresses with vhosts. To check subdomains, just do your usual subdomain enumeration and then check each subdomain to see if any of them respond the same as the gateway.

To check IP address spaces, you can use hakoriginfinder. It fetches the gateway first, then requests each IP with the Host header set, and scores the responses with Levenshtein distance. prips x.x.x.x/24 | hakoriginfinder -h