用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/uphiago/recon-skills --skill origin-ip-discovery命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | origin-ip-discovery |
| description | Discover origin IPs behind CDN/WAF via favicon hash, DNS history, and SSL certs. |
| version | 1.1.0 |
| revision_date | "2026-07-25T00:00:00.000Z" |
| license | MIT |
| platforms | ["linux"] |
| compatibility | Requires curl, dnsx, python3, subfinder |
| tags | ["recon","origin-ip","CDN","WAF","bypass","Cloudflare","favicon","DNS"] |
| category | recon |
| related_skills | ["subdomain-enumeration","vhost-enumeration","port-mass-scan"] |
Discover the real server IP behind CDN/WAF protections (Cloudflare, Akamai, Fastly). When the origin IP is found, the raw server is exposed without firewall rules, rate limiting, or application-layer filtering. Techniques include favicon hash fingerprinting across Shodan, historical DNS records from passive sources, SSL certificate SAN field matching, and Google Analytics ID cross-referencing.
terminal with curl, python3, and shodan CLI.shodan init <KEY>.# Check Cloudflare presence
curl --max-time 30 --connect-timeout 10 -sI "https://target.com" | grep -i "cf-ray\|server: cloudflare"
# If Cloudflare detected, check for common origin leaks
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/cdn-cgi/trace" | grep -E "ip=|colo="
# Get favicon hash
FAVICON_URL="https://target.com/favicon.ico"
curl --max-time 30 --connect-timeout 10 -sk "$FAVICON_URL" -o favicon_target.ico
# Calculate hash
python3 -c "
import hashlib, base64
with open('favicon_target.ico', 'rb') as f:
hash_bytes = base64.b64encode(hashlib.md5(f.read()).digest())
print(f'favicon hash: {hash_bytes.decode()}')
"
# Search Shodan for IPs serving this favicon
HASH=$(python3 -c "
import hashlib, base64
with open('favicon_target.ico','rb') as f:
print(base64.b64encode(hashlib.md5(f.read()).digest()).decode())
")
shodan search "http.favicon.hash:$HASH" --fields ip_str,port,org,hostnames
# Automatedtools
python3 favUp.py -ff favicon_target.ico --shodan-cli
python3 favUp.py --web target.com -sc
# SecurityTrails — DNS history
curl --max-time 30 --connect-timeout 10 -s "https://securitytrails.com/domain/target.com/history/a" \
-H "APIKEY: $SECURITYTRAILS_KEY" \
| jq '.records[].values[].ip' | sort -u
# AlienVault OTX — passive DNS
curl --max-time 30 --connect-timeout 10 -s "https://otx.alienvault.com/api/v1/indicators/domain/target.com/passive_dns" \
| jq '.passive_dns[].address' | sort -u
# Automatedtools
echo "target.com" | originiphunter
cat domains.txt | originiphunter
# crt.sh — find all certs for the domain, extract unique IPs from SAN fields
curl --max-time 30 --connect-timeout 10 -s "https://crt.sh/?q=%25.target.com&output=json" \
| jq -r '.[].name_value' | tr ',' '\n' | sort -u > cert_domains.txt
# Censys — search by parsed names
# Web: https://search.censys.io — query: parsed.names: target.com
# Shodan — search by SSL subject CN
shodan search "ssl.cert.subject.cn:target.com" --fields ip_str,port,org
# Netlas — deep infrastructure search
# Web: https://netlas.io — query: domain:*.target.com
# Extract Analytics ID from target pages
curl --max-time 30 --connect-timeout 10 -s "https://target.com" | grep -Eo '(?:UA-|G-|GTM-)[A-Z0-9]+'
# Find all domains sharing the same GA ID
curl --max-time 30 --connect-timeout 10 -s "https://api.hackertarget.com/analyticslookup/?q=UA-XXXXXXXX-X"
curl --max-time 30 --connect-timeout 10 -s "https://builtwith.com/relationships/target.com"
# Automated
cat subdomains.txt | analyticsrelationships
# Direct IP in page source
curl --max-time 30 --connect-timeout 10 -sk "https://target.com" | grep -Eo '\b(?:\d{1,3}\.){3}\d{1,3}\b' | sort -u
# DNS CNAME chain — may expose origin
dig target.com ANY +noall +answer
dig www.target.com CNAME +short
# MX records — mail server often shares infrastructure
dig target.com MX +short
# SPF records — may contain non-CDN IPs
dig target.com TXT +short | grep -Eo '\b(?:\d{1,3}\.){3}\d{1,3}\b'
# Subdomain with different IP pattern
subfinder -d target.com -silent | dnsx -silent -a -resp-only | sort -u > all_ips.txt
# Filter out Cloudflare IPs (104.x, 172.64-71.x)
grep -vE '^104\.(1[6-9]|2[0-9]|3[0-1])\.|^172\.(6[4-9]|7[0-1])\.' all_ips.txt > non_cf_ips.txt
# Probe each for the target's content
for ip in $(cat non_cf_ips.txt); do
curl --max-time 30 -sk --connect-timeout 5 "https://$ip" -H "Host: target.com" -o /dev/null -w "%{http_code} $ip\n"
done | grep -v "^403\|^000"
# Check if IP serves the target's content
curl --max-time 30 --connect-timeout 10 -sk "https://ORIGIN_IP" -H "Host: target.com" | grep -o '<title>[^<]*</title>'
# Verify favicon matches
curl --max-time 30 --connect-timeout 10 -sk "https://ORIGIN_IP/favicon.ico" -H "Host: target.com" -o favicon_origin.ico
md5sum favicon_target.ico favicon_origin.ico # should match
# Probe ports directly on origin
naabu -host ORIGIN_IP -p - -rate 2000
Host: target.com returns the same page content.subdomain-enumeration — Generate the subdomain list needed for IP deduplication.vhost-enumeration — Once origin IP is found, enumerate virtual hosts.port-mass-scan — Scan origin IP for exposed services.