search

christophetd / CloudFlair

🔎 Find origin servers of websites behind CloudFlare by using Internet-wide scan data from Censys.
https://blog.christophetd.fr/bypassing-cloudflare-using-internet-wide-scan-data/
2.58k stars 358 forks source link

[*] Retrieving Cloudflare IP ranges from https://www.cloudflare.com/ips-v4 #59

Closed fdguyg8 closed 2 years ago

fdguyg8 commented 2 years ago

i enter python cloudflair.py myvulnerable.site [*] Retrieving Cloudflare IP ranges from https://www.cloudflare.com/ips-v4 Traceback (most recent call last): File "/home/iu/cloudflair/cloudflair.py", line 4, in <module> import cloudflare_utils File "/home/iu/cloudflair/cloudflare_utils.py", line 47, in <module> cloudflare_subnets = [ipaddress.ip_network(ip_range) for ip_range in cloudflare_ip_ranges] File "/home/iu/cloudflair/cloudflare_utils.py", line 47, in <listcomp> cloudflare_subnets = [ipaddress.ip_network(ip_range) for ip_range in cloudflare_ip_ranges] File "/usr/lib/python3.9/ipaddress.py", line 83, in ip_network raise ValueError('%r does not appear to be an IPv4 or IPv6 network' % ValueError: '<!DOCTYPE html>' does not appear to be an IPv4 or IPv6 network

I've already completed pip install -r requirements.txt

christophetd commented 2 years ago

I just tried it, seems to be working for me:

$ python cloudflair.py medium.com
[*] Retrieving Cloudflare IP ranges from https://www.cloudflare.com/ips-v4
[*] The target appears to be behind CloudFlare.
[*] Looking for certificates matching "medium.com" using Censys
[*] 17 certificates matching "medium.com" found.
[*] Looking for IPv4 hosts presenting these certificates...
[*] 23 IPv4 hosts presenting a certificate issued to "medium.com" were found.

Is it possible CloudFlaire blocked your IP when requesting the list of IPs? Can you try this and let me know what you get?

curl -v https://www.cloudflare.com/ips-v4
fdguyg8 commented 2 years ago

i run commands with ip tor here's what gave me `* Trying 104.16.124.96:443...

Please Wait... | Cloudflare 
<script>
//<![CDATA[
(function(){
  window._cf_chl_opt={
    cvId: "2",
    cType: "managed",
    cNounce: "6455",
    cRay: "6ff81a8d3eeb6904",
    cHash: "96ba0f721f1e540",
    cUPMDTk: "\/ips-v4?__cf_chl_tk=jVb3PaFlxy5Z4jOxB40iK96CWXY9IkKZnyiTMmKg.pI-1650564912-0-gaNycGzNB1E",
    cFPWv: "g",
    cTTimeMs: "1000",
    cLt: "n",
    cRq: {
      ru: "aHR0cHM6Ly93d3cuY2xvdWRmbGFyZS5jb20vaXBzLXY0",
      ra: "Y3VybC83LjgxLjA=",
      rm: "R0VU",
      d: "XiAv6l1MNllV2F8SHiJoTJn+qwvMn4GMDZrTG5qHyShpgECd+Wvrz1H5kxEp9hhhnsXAgWcRovYCUidFpV5NONfmz6RAcpv/a3NkfgVICJrPNWL7EHzkuTmWTJfOeCLBFh2M4+vBPkkWjVCr6dNrJflZhAljLaOW7/eTLbEiNcuNhGDyXYz5tIFfjoD2X+9j+iKge9pRhX9iYjtYWRVTvjAqIUVccngmQBrPH4qJkha+2oHOwV6yXuRHlujh7pFC1TwcwBKf0qzNPO3apsQAEX4guNywkpVmcz2s90JSvzKmm3Hxi//TOhM9uiBcV938TPi7QaA7R7DwmRfL5xIF0Cklu8l1MbrIESjwFkTDxBgvfg5hu4v3ePBj2rW4y9V10/p1RJ5kf2dpwCyctWQXdOeOaY2zZ13yUzPjh+njJ0Zfr55Twz2zESmHItL5XpH7pW9OLDwCCwFIkeKoy8gOaGrNv3bh4u/tTQSIm9ppS9w6cWmCzZu9tot5fUBo3gmg0hnvnCDzpL3kHqMoJQxf5c/DYqWsHXhbw1ieQ3UtpdWz/xq0tp7BT50fwH9rIqQQqig26vaP+/Tj+6hmaYNZkg==",
      t: "MTY1MDU2NDkxMi4yMTMwMDA=",
      m: "qXADJ4mWqGGlH6Ol69BIFdiIeRHYQ17SLHK8ZiwkxcQ=",
      i1: "3dS+bKxS9A69F46+dZACVA==",
      i2: "ecUZdUzDaj2dguQN6eleYg==",
      zh: "WknVD3gDHQEGTLPKhwAHV9fbqA3BzTCoGSgrSa52xC0=",
      uh: "XtPohTwN9ruoNwJrCbocmA5soW1XPnkxU/yVFmBLOQo=",
      hh: "o2CsT6J8k5XABFTKG8Pc+kjAUTbm0LrSlAwXOrIi85c=",
    }
  };
}());
//]]>
</script>

Please wait...

We are checking your browser... www.cloudflare.com

Please stand by, while we are checking your browser...

Why do I have to complete a CAPTCHA?

Completing the CAPTCHA proves you are a human and gives you temporary access to the web property.

What can I do to prevent this in the future?

If you are on a personal connection, like at home, you can run an anti-virus scan on your device to make sure it is not infected with malware.

If you are at an office or shared network, you can ask the network administrator to run a scan across the network looking for misconfigured or infected devices.

Cloudflare Ray ID: 6ff81a8d3eeb6904 • Your IP: 109.70.100.23 • Performance & security by Cloudflare

christophetd commented 2 years ago

CloudFlare is blocking your IPs, so you can't retrieve its list of IPs.

I recommend either using another IP, or copy-pasting:

173.245.48.0/20
103.21.244.0/22
103.22.200.0/22
103.31.4.0/22
141.101.64.0/18
108.162.192.0/18
190.93.240.0/20
188.114.96.0/20
197.234.240.0/22
198.41.128.0/17
162.158.0.0/15
104.16.0.0/13
104.24.0.0/14
172.64.0.0/13
131.0.72.0/22

Instead of this function call: https://github.com/christophetd/CloudFlair/blob/dce0488f2fe5a82334e0d7fbf26c580430aae1e5/cloudflare_utils.py#L42

fdguyg8 commented 2 years ago

changed ip all worked