(untitled)

What is the best way to discover origin IPs behind cloudflare? The site I'm looking at is behind cloudlfare and they have rotating proxies. I've discovered their github, I know their mail server and subdomains but I am unsure how to discover the origin IP, any help would be much appreciated. I know there are tools that allow you query data with API keys and I've tried Shodan but their data hasn't been helpful in helping me the origin IP, I even tried looking through historical DNS records and I don't think they're of any help.

>>27546 Didn't you already make this thread? Also: >neurosuggesting your cat is worth >$150 USD

>>27546 There is no "best way" it's not like there is a popular trick that some people know that just work, if it was the case cloudfare would have patched it or cloudfare just, wouldn't be a thing. cloudfare itself is pretty much secure, problem is the configuration issue, where people can make critical mistakes. - cloudfare support only HTTP (except very specific case like spectrum plan), that means you can ping a specific port which cloudfare does not proxies and get the response from the origin server. - If you just set up the domain with cloudfare ONLY THE INBOUND traffic goes through the proxy, so you could check for SSRF vulnerabilities. - As you said DNS history record, but have you checked things like normal current PTR records? - Social engineering, you could literally partially doxx the administrator / guess the hosting service he would use and then contact the hosting service. Sometimes you can literally just ask "what is your favorite hosting service?" but of course you need to create a full set, make a scenario, or just have more information about him. - And finally... web hacking in general? I mean if you find a vulnerability that could allow RCE... Ultimately what you usually end up doing is a mix of these techniques.

tips above are good, also check censys, don't forget to use the host header to verify. > they have rotating proxies you mean fastflux? there's no point in using that with cloudflare.

IIRC CloudFlare provides the name of the hosting provider automatically if a DMCA request is filed. Filing fake reports is probably illegal so I disavow.

More on the exploit side of things, but you might not even need arbitrary RCE to find the outbound IP of a server if you can abuse file upload such that an additional resource is downloaded by the host in question. Think image rehosting, file scanning, perhaps much else.