| name | cloudflare-bypass |
| description | How to uncover and bypass Cloudflare protection to find origin server IPs or scrape protected websites. Use this skill whenever the user mentions Cloudflare bypass, origin IP discovery, WAF bypass, scraping protected sites, or needs to find real server IPs behind CDN protection. Trigger for any pentesting task involving Cloudflare, CDN bypass, or web scraping challenges with bot protection. |
Cloudflare Bypass & Origin Discovery
A skill for uncovering origin server IPs behind Cloudflare protection and bypassing Cloudflare's anti-bot measures for legitimate security testing and web scraping.
When to Use This Skill
Use this skill when:
- You need to find the real origin IP of a website protected by Cloudflare
- You're performing security testing and need to bypass WAF protection
- You're scraping websites with Cloudflare bot protection
- You encounter Cloudflare challenges during reconnaissance
- You need to enumerate infrastructure behind CDN protection
Quick Start
python scripts/cloudflare_recon.sh <target-domain>
python scripts/scan_aws_cloudflare.py <target-domain>
python scripts/bypass_cloudflare_scrape.py <target-url>
Technique 1: Historical DNS & Certificate Analysis
Historical DNS Records
Check if the domain previously resolved to different IPs:
Historical SSL Certificates
Search certificate transparency logs for origin IPs:
curl -s "https://search.censys.io/api/v1/certificates/search?q=subject.dns_names:*.<target-domain>" | jq '.results[] | .parsed.subject.dns_names'
Subdomain Enumeration
Other subdomains might point directly to origin IPs:
subfinder -d <target-domain> | while read sub; do
dig +short $sub | grep -E '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$'
done
Technique 2: SSRF Exploitation
If you find an SSRF vulnerability in the application:
curl -X POST http://<vulnerable-endpoint> -d "url=http://169.254.169.254/latest/meta-data/"
Technique 3: Fingerprint Matching
Shodan Search
Search for unique strings from the website:
curl -s https://<target-domain> | grep -oP '<title>.*?</title>'
Favicon Hash Search
Use tools to match favicon hashes:
git clone https://github.com/karma9874/CloudFlare-IP
cd CloudFlare-IP && python3 cloudflare.py <target-domain>
git clone https://github.com/pielco11/fav-up
cd fav-up && python3 fav_up.py <target-domain>
Technique 4: Dedicated Cloudflare Bypass Tools
CF-Hero
Comprehensive multi-source reconnaissance:
pip install cf-hero
cf-hero <target-domain>
CloudFlair
Searches Censys certificates for origin IPs:
git clone https://github.com/christophetd/CloudFlair
cd CloudFlair && pip install -r requirements.txt
python3 cloudflair.py <target-domain>
CloakQuest3r
Python tool for Cloudflare bypass:
git clone https://github.com/spyboy-productions/CloakQuest3r
cd CloakQuest3r && pip install -r requirements.txt
python3 CloakQuest3r.py <target-domain>
CrimeFlare & Leaked.site
Check these databases:
CloudPeler
Uses CrimeFlare API:
git clone https://github.com/zidansec/CloudPeler
cd CloudPeler && python3 cloudpeler.py <target-domain>
Technique 5: AWS Infrastructure Scanning
For targets hosted on AWS, scan EC2 IP ranges:
python scripts/scan_aws_cloudflare.py <target-domain> [region]
DOMAIN=<target-domain>
for ir in $(curl https://ip-ranges.amazonaws.com/ip-ranges.json | jq -r '.prefixes[] | select(.service=="EC2") | select(.region|test("^us")) | .ip_prefix'); do
echo "Checking $ir"
prips $ir | hakoriginfinder -h "$DOMAIN"
done
Technique 6: Cloudflare Configuration Bypasses
Authenticated Origin Pulls (mTLS)
If the target uses Cloudflare's certificate for origin authentication:
- Set up your own domain in Cloudflare
- Point it to the victim's origin IP
- Cloudflare will accept the connection (same certificate)
- Attack through your domain without protection
IP Allowlist Bypass
If the target only allows Cloudflare IPs:
- Set up your domain in Cloudflare
- Point to victim's origin IP
- Your requests come from Cloudflare IPs
- Bypass the allowlist
Technique 7: Scraping Bypass Methods
Cache Services
For simple content retrieval:
https://webcache.googleusercontent.com/search?q=cache:<target-url>
https://archive.org/web/<target-url>
Cloudflare Solvers
docker run -p 8191:8191 flaresolverr/flaresolverr:latest
pip install cloudscraper
python -c "import cloudscraper; s = cloudscraper.create_scraper(); print(s.get('<target-url>').text)"
pip install cloudflare-scrape
cloudflare-scrape -u <target-url>
Headless Browsers with Stealth
npm install puppeteer puppeteer-extra puppeteer-extra-plugin-stealth
npm install playwright playwright-stealth
pip install seleniumbase
seleniumbase --uc <target-url>
Smart Proxies
Use proxy services with built-in Cloudflare bypass:
Bundled Scripts
cloudflare_recon.sh
Wrapper script for running multiple Cloudflare recon tools:
./scripts/cloudflare_recon.sh <target-domain>
scan_aws_cloudflare.py
Scans AWS IP ranges for origin servers:
python scripts/scan_aws_cloudflare.py <target-domain> [region]
bypass_cloudflare_scrape.py
Attempts various scraping bypass methods:
python scripts/bypass_cloudflare_scrape.py <target-url>
Workflow Recommendations
- Start with automated tools: Run CF-Hero or CloudFlair first
- Check historical data: DNS history and certificate logs
- Try SSRF: If you have application access, test for SSRF
- Scan cloud infrastructure: If you know the provider (AWS, GCP, Azure)
- Use fingerprinting: Shodan and favicon matching
- For scraping: Try cache first, then solvers, then headless browsers
Legal & Ethical Considerations
- Only use these techniques on systems you have authorization to test
- Cloudflare bypass for scraping may violate ToS
- Document your authorization before performing any bypass
- Respect rate limits and don't cause service disruption
References
