Skip to content
attack.paths
Connexion
← RegistryDossier · 6 steps · 5 edges

Origin IP bypass → direct attack on backend

Find the real origin IP behind the CDN via CT logs / DNS history / SSL fingerprinting. Connect directly to origin, bypassing WAF + caching + rate-limit; run noisy attacks (SQLi / RCE) that the edge would have blocked.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: target uses a CDN / WAF (Cloudflare / Akamai / Imperva) without strict origin allowlisting (origin firewall doesn't restrict to CDN IP ranges).

§ Steps

  1. 01
    Bulk exfil before detectionExfiltration
    T1041— Exfiltration Over C2 Channel
  2. 02
    DNS history (SecurityTrails / Shodan)Reconnaissance
    W-RECON-SUBDOMAIN— Subdomain Enumeration
  3. 03
    TLS cert hash on Shodan → origin IPsReconnaissance
    W-RECON-FINGERPRINT— Tech Stack Fingerprinting
  4. 04
    Run noisy SQLi / RCE bypassing WAFCollection
    W-SQLI-UNION— SQL Injection — UNION-Based
  5. 05
    Connect directly to originDefense Evasion
    CDN-ORIGIN-BYPASS— CDN Origin Bypass
  6. 06
    Search CT logs for origin SANReconnaissance
    PKI-CT-MONITOR— Certificate Transparency Monitoring

§ References

§ Frequently asked

What is the "Origin IP bypass → direct attack on backend" attack path?
Find the real origin IP behind the CDN via CT logs / DNS history / SSL fingerprinting. Connect directly to origin, bypassing WAF + caching + rate-limit; run noisy attacks (SQLi / RCE) that the edge would have blocked. It chains 6 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Bulk exfil before detection (T1041) — a exfiltration primitive. Assumed environment: target uses a CDN / WAF (Cloudflare / Akamai / Imperva) without strict origin allowlisting (origin firewall doesn't restrict to CDN IP ranges).
What is the final impact of this kill-chain?
The final step lands on Search CT logs for origin SAN (PKI-CT-MONITOR), which falls under Reconnaissance. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers