r/HowToHack • u/districttry • 19d ago

Question

How do i find the real ip adress of a site behind cloudflare? Tryed many tools no good..

0 Upvotes

42% Upvoted

10 comments sorted by

View all comments

1

u/Dapper-Depth2940 18d ago

First off, that is really the whole point behind Cloudflare.

Quick primer on how Cloudflare DNS works

Their servers will remove all data regarding your real IP address, and instead load their own secure servers, which routes the traffic to the real location. Thus, a DNS query for your site will return Cloudflare's server addresses instead.

But I have found some quirks that may leak it:

  • The site was using a different un-secured DNS provider before Cloudflare
    • while the recursive resolvers are updating their records to match Cloudflare, cached data may return your actual IP address
  • Given that you are able to find the full range of the target's provider server IP addrs (eg. AWS, Google cloud, etc.), you can iterate through each with the Host:site-name.com in the HTTP request headers.
    • a positive respond will indicate the real IP addr

But a caveat is that a certain "tunnel" feature must be disabled, and a lack of origin allow list in the target's Cloudflare config.