List Misconfiguration Findings

Retrieve infrastructure misconfiguration findings discovered during asset enumeration. Currently detects AWS dangling DNS (Elastic IPs that no longer exist) and Cloudflare origin IP exposure.

GET /v1/asset/enumerate/misconfiguration

List Misconfiguration Findings

cURL

curl --request GET \
  --url https://api.projectdiscovery.io/v1/asset/enumerate/misconfiguration \
  --header 'X-API-Key: <api-key>'

import requests

url = "https://api.projectdiscovery.io/v1/asset/enumerate/misconfiguration"

headers = {"X-API-Key": "<api-key>"}

response = requests.get(url, headers=headers)

print(response.text)

const options = {method: 'GET', headers: {'X-API-Key': '<api-key>'}};

fetch('https://api.projectdiscovery.io/v1/asset/enumerate/misconfiguration', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.projectdiscovery.io/v1/asset/enumerate/misconfiguration",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "X-API-Key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.projectdiscovery.io/v1/asset/enumerate/misconfiguration"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("X-API-Key", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.get("https://api.projectdiscovery.io/v1/asset/enumerate/misconfiguration")
  .header("X-API-Key", "<api-key>")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.projectdiscovery.io/v1/asset/enumerate/misconfiguration")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["X-API-Key"] = '<api-key>'

response = http.request(request)
puts response.read_body

200

{
  "message": "<string>",
  "total_pages": 123,
  "total_results": 123,
  "current_page": 123,
  "data": [
    {
      "id": "<string>",
      "enumeration_id": "<string>",
      "host": "<string>",
      "event": {},
      "created_at": "2023-12-25",
      "updated_at": "2023-12-25"
    }
  ]
}

{
  "message": "<string>",
  "kind": "<string>",
  "code": "<string>",
  "error": "<string>",
  "error_id": "<string>",
  "param": "<string>",
  "status": 123
}

{
  "message": "<string>",
  "kind": "<string>",
  "code": "<string>",
  "error": "<string>",
  "error_id": "<string>",
  "param": "<string>",
  "status": 123
}

{
  "message": "<string>",
  "kind": "<string>",
  "code": "<string>",
  "error": "<string>",
  "error_id": "<string>",
  "param": "<string>",
  "status": 123
}

{
  "message": "<string>",
  "kind": "<string>",
  "code": "<string>",
  "error": "<string>",
  "error_id": "<string>",
  "param": "<string>",
  "status": 123
}

{
  "message": "<string>",
  "kind": "<string>",
  "code": "<string>",
  "error": "<string>",
  "error_id": "<string>",
  "param": "<string>",
  "status": 123
}

Finding Types

Type	Description
dangling_dns	AWS Elastic IPs that no longer exist, leaving DNS records vulnerable to subdomain takeover
origin_exposure	Cloudflare-proxied origin IPs independently discoverable through other hostnames

AWS Dangling DNS

A dangling DNS finding is reported when a DNS record points to an AWS Elastic IP that no longer exists, making it potentially vulnerable to subdomain takeover. Requires an AWS cloud integration.

Cloudflare Origin IP Exposure

When a domain is proxied through Cloudflare, its origin server IP is hidden behind Cloudflare’s network. An origin exposure finding indicates that this origin IP is independently discoverable through another hostname that resolves to it directly, without going through Cloudflare.

This finding requires two things:

1. A Cloudflare cloud integration — This allows us to read your DNS records and identify which hostnames are proxied and what origin IPs they point to.

2. Asset inventory — Hostnames and their resolved IPs from your attack surface discovery. The check runs against your entire inventory, excluding assets sourced from cloud integrations.

When a hostname from your inventory resolves to the same IP as the origin behind one of your proxied Cloudflare records, it is flagged as an origin exposure finding.

Event Details by Finding Type

The event object contains type-specific details:

dangling_dns

Field	Description
host	The vulnerable hostname
ip	The dangling IP address
provider	Cloud provider (e.g., AWS)

origin_exposure

Field	Description
origin_ip	The exposed origin server IP
provider	CDN provider (e.g., Cloudflare)
leaking_hosts	The hostnames from your inventory that resolve directly to the origin IP

Example Requests

List all misconfigurations

curl -X GET "https://api.projectdiscovery.io/v1/asset/enumerate/misconfiguration?limit=50" \
  -H "X-Api-Key: YOUR_API_KEY"

Filter by finding type

curl -X GET "https://api.projectdiscovery.io/v1/asset/enumerate/misconfiguration?finding_type=dangling_dns" \
  -H "X-Api-Key: YOUR_API_KEY"

Search by host

curl -X GET "https://api.projectdiscovery.io/v1/asset/enumerate/misconfiguration?search=staging.example.com" \
  -H "X-Api-Key: YOUR_API_KEY"

Authorizations

X-API-Key · string · header · required

Headers

X-Team-Id · string

Retrieve the Team ID from: https://cloud.projectdiscovery.io/settings/team

Query Parameters

limit · integer

The numbers of items to return

offset · integer

The number of items to skip before starting to collect the result set

search · string

Case-insensitive substring search on the host field

finding_type · enum<string>

Filter by finding type

Available options: dangling_dns, origin_exposure

Response

200

application/json

OK

message · string

total_pages · integer

total_results · integer

current_page · integer

data · MisconfigurationResponse · object[]

Show child attributes