| name | ip-rotation |
| description | Use IP rotation proxies (flareprox and fireprox) to bypass rate limiting, IP bans, and geo-blocking during web security testing. Use only when IPROTATE_ENABLED is set and the target is blocking normal requests. Triggers on "rate limited", "IP banned", "blocked by WAF", "429", "403", "geo-blocked", "rotate IP", "IP rotation", "flareprox", "fireprox". |
IP Rotation
Activation gate: Only use this skill when the environment variable IPROTATE_ENABLED is set (any value). If unset, do not suggest, reference, or offer IP rotation. Do not ask the user to enable it.
The web-security runtime provides two IP rotation backends:
- flareprox — self-contained Cloudflare Workers proxy (built-in tool, no external install)
- fireprox — AWS API Gateway proxy (installed at
~/git/fireprox/fire.py)
When to Use
Use IP rotation when normal testing hits anti-automation defenses:
- Rate limiting: repeated
429 Too Many Requests
- IP ban: sudden
403 Forbidden or connection drops after sustained testing
- WAF block: Cloudflare/Akamai/Imperva challenges on automated requests
- Geo-blocking: target restricts access to specific regions
- High-volume fuzzing: content discovery that needs IP diversity
Do NOT use for:
- Routine requests that succeed normally
- CORS-sensitive tests (proxies may modify response headers)
- Tests that require exact source-IP attribution
Backend Selection
| Backend | Use When | Cost | Target Binding | Notes |
|---|
| flareprox | Unauthenticated recon, fuzzing, scraping, multi-target | Free (100K/day) | Dynamic per request | Built-in flareprox_* tools |
| fireprox | Authenticated testing, session/cookie-based exploits | ~$3.50/1M req | Static: one proxy per target URL | Use ~/git/fireprox/fire.py CLI |
Decision:
- Need cookies/sessions preserved? Use fireprox.
- Need dynamic multi-target rotation? Use flareprox.
- Unsure? Start with flareprox.
flareprox (Cloudflare Workers)
Built into the capability. No external install required.
Prerequisites: CF_API_TOKEN and CF_ACCOUNT_ID.
Lifecycle:
flareprox_status
flareprox_create --count 3
flareprox_request --url https://target.com/api/endpoint --method GET
flareprox_cleanup
See the tool descriptions for full argument lists.
fireprox (AWS API Gateway)
Installed in the runtime at ~/git/fireprox/fire.py. Requires AWS credentials at runtime.
Prerequisites
Set one of:
AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY- Or mount
~/.aws/credentials in the runtime
CLI Reference
Tool path: python3 ~/git/fireprox/fire.py
python3 ~/git/fireprox/fire.py --command create --url https://target.com --region us-east-1
python3 ~/git/fireprox/fire.py --command list
python3 ~/git/fireprox/fire.py --command delete --api_id <api-id>
Lifecycle
python3 ~/git/fireprox/fire.py --command create --url https://target.com --region us-east-1
PROXY="https://<api-id>.execute-api.us-east-1.amazonaws.com/fireprox/"
curl -x http://localhost:8080 -k "${PROXY}api/endpoint"
python3 ~/git/fireprox/fire.py --command delete --api_id <api-id>
fireprox creates one API Gateway per target URL. The proxy URL prefix is static for that target; AWS rotates the egress IP automatically.
Important Constraints
- Always clean up fireprox proxies after sessions to avoid AWS charges.
- Do not use for CORS tests — proxies may add response headers.
- Cloud IPs are fingerprintable — sophisticated bot detection may still block known AWS/Cloudflare IP ranges.
- fireprox = one proxy per target URL — create a new proxy for each target.
- flareprox state persists at
~/.flareprox/workers.json.
Integration with Caido/Burp
If Caido or Burp is available, chain traffic through them for evidence capture:
your client → Caido/Burp → flareprox/fireprox → target
For fireprox:
curl -x http://localhost:8080 -k \
-H "Cookie: session=abc123" \
"https://<api-id>.execute-api.<region>.amazonaws.com/fireprox/api/endpoint"
For flareprox, use flareprox_request or set X-Target-URL when using a worker URL manually.
