mirror of
https://github.com/yogeshojha/rengine.git
synced 2026-10-21 07:41:28 +02:00
Yogesh OjhaandClaude Opus 5
b2ada19752
Every HTTP service already carries five identities — TLS certificate, body hash, favicon hash, header hash and JARM — and they were only ever used to cluster hostnames. Pointed at ip:port instead, one index answers the question pentesters ask first: which of these addresses answers directly as well as behind the CDN? A new origin_probe stage requests each address by IP with no hostname, so the default virtual host is captured with the same fingerprinting as everything else; screenshot moved to the level after it so both sides of the comparison have an image. The correlation joins fingerprints across the CDN boundary and reports the address, the hostnames it fronts for and what matched. The noise filter is the whole trick, as it was for related domains. A fingerprint's discriminating power falls off with its reach: a body hash on two hosts identifies an application, a wildcard certificate on eighteen only identifies the organisation, so weight drops with the number of hostnames sharing it and the label says so. Error and near-empty bodies are excluded, one weak signal is never a finding, and the sample shown as proof is the one sharing the most identity rather than an arbitrary member of the group — which is what makes the two screenshots line up. Found on existing scan data with no re-scan: labs-prod-origin-<redacted-suffix> answering on an AWS address with the same certificate, body and favicon as eighteen CloudFront-fronted hostnames. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BnC2xMMzV6WQnpDp5zcXoU