ip-rotation

name	ip-rotation
description	Use IP rotation proxies (flareprox and fireprox) to bypass rate limiting, IP bans, and geo-blocking during web security testing. Use only when IPROTATE_ENABLED is set and the target is blocking normal requests. Triggers on "rate limited", "IP banned", "blocked by WAF", "429", "403", "geo-blocked", "rotate IP", "IP rotation", "flareprox", "fireprox".

IP Rotation

Activation gate: Only use this skill when the environment variable IPROTATE_ENABLED is set (any value). If unset, do not suggest, reference, or offer IP rotation. Do not ask the user to enable it.

The web-security runtime provides two IP rotation backends:

• flareprox — self-contained Cloudflare Workers proxy (built-in tool, no external install)
• fireprox — AWS API Gateway proxy (installed at ~/git/fireprox/fire.py)

When to Use

Use IP rotation when normal testing hits anti-automation defenses:

• Rate limiting: repeated 429 Too Many Requests
• IP ban: sudden 403 Forbidden or connection drops after sustained testing
• WAF block: Cloudflare/Akamai/Imperva challenges on automated requests
• Geo-blocking: target restricts access to specific regions
• High-volume fuzzing: content discovery that needs IP diversity

Do NOT use for:

• Routine requests that succeed normally
• CORS-sensitive tests (proxies may modify response headers)
• Tests that require exact source-IP attribution

Backend Selection

Backend	Use When	Cost	Target Binding	Notes
flareprox	Unauthenticated recon, fuzzing, scraping, multi-target	Free (100K/day)	Dynamic per request	Built-in flareprox_* tools
fireprox	Authenticated testing, session/cookie-based exploits	~$3.50/1M req	Static: one proxy per target URL	Use ~/git/fireprox/fire.py CLI

Decision:

• Need cookies/sessions preserved? Use fireprox.
• Need dynamic multi-target rotation? Use flareprox.
• Unsure? Start with flareprox.

flareprox (Cloudflare Workers)

Built into the capability. No external install required.

Prerequisites: CF_API_TOKEN and CF_ACCOUNT_ID.

Lifecycle:

flareprox_status
flareprox_create --count 3
flareprox_request --url https://target.com/api/endpoint --method GET
flareprox_cleanup

See the tool descriptions for full argument lists.

fireprox (AWS API Gateway)

Installed in the runtime at ~/git/fireprox/fire.py. Requires AWS credentials at runtime.

Prerequisites

Set one of:

• AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY
• Or mount ~/.aws/credentials in the runtime

CLI Reference

Tool path: python3 ~/git/fireprox/fire.py

python3 ~/git/fireprox/fire.py --command create --url https://target.com --region us-east-1
python3 ~/git/fireprox/fire.py --command list
python3 ~/git/fireprox/fire.py --command delete --api_id <api-id>

Lifecycle

# 1. Create a proxy for a specific target
python3 ~/git/fireprox/fire.py --command create --url https://target.com --region us-east-1

# 2. Note the proxy URL from the output, then use it
PROXY="https://<api-id>.execute-api.us-east-1.amazonaws.com/fireprox/"
curl -x http://localhost:8080 -k "${PROXY}api/endpoint"

# 3. Clean up when done to avoid AWS charges
python3 ~/git/fireprox/fire.py --command delete --api_id <api-id>

fireprox creates one API Gateway per target URL. The proxy URL prefix is static for that target; AWS rotates the egress IP automatically.

Important Constraints

• Always clean up fireprox proxies after sessions to avoid AWS charges.
• Do not use for CORS tests — proxies may add response headers.
• Cloud IPs are fingerprintable — sophisticated bot detection may still block known AWS/Cloudflare IP ranges.
• fireprox = one proxy per target URL — create a new proxy for each target.
• flareprox state persists at ~/.flareprox/workers.json.

Integration with Caido/Burp

If Caido or Burp is available, chain traffic through them for evidence capture:

your client → Caido/Burp → flareprox/fireprox → target

For fireprox:

curl -x http://localhost:8080 -k \
  -H "Cookie: session=abc123" \
  "https://<api-id>.execute-api.<region>.amazonaws.com/fireprox/api/endpoint"

For flareprox, use flareprox_request or set X-Target-URL when using a worker URL manually.