+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [Release] CloudFlare IP Resolver [PHP] (/showthread.php?tid=2660401)
[Release] CloudFlare IP Resolver [PHP] - Phizo - Jul 8, 2012
I recently came across a thread where ๖ۣۜDan was speaking of his "Cloudflare > Real IP" program he created in Python. I had a look at it and thought of creating my own in PHP, with some minor improvements.
๖ۣۜDan's version can be found here if you're interested in checking it out: https://hackforums.net/showthread.php?tid=2564147
My version is also intended to be ran from the console, if you wish to modify it and use it for the web you may do so yourself. I can't be bothered making two versions of it even if it only requires a small amount of modifications.
This also isn't a guaranteed way of resolving an IP address protected by CloudFlare, but it will attempt to do so.
Requirements:
- PHP ~ http://php.net/downloads.php
- Ability to read.
Screenshots:
Spoiler (Click to View)
Code:
PHP Code
<?php
# CloudFlare IP Resolver
# Coded By Phizo
# https://hackforums.net/member.php?action=profile&uid=42381
function is_ipv4($ip)
{
return filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) ? $ip : '(Null)';
}
$me = $argv[0];
$url = @$argv[1];
if(!isset($url))
die("\n[+] Usage: php {$me} <url>\n[+] Example: php {$me} http://www.imgur.com\n");
if(!preg_match('/^(https?):\/\/(w{3}|w3)\./i', $url))
die("\nURL is invalid.\nURL must be formatted as: http(s)://www." . preg_replace('/^(https?):\/\//', '', $url) . "\n(for compatibility reasons)\n");
$headers = get_headers($url, 1);
$server = $headers['Server'];
$subs = array('cpanel.', 'ftp.', 'mail.', 'webmail.', 'direct.', 'direct-connect.', 'record.', 'ssl.', 'dns.', 'help.', 'blog.', 'forum.');
$count = count($subs);
if(preg_match('/^(https?):\/\/(w{3}|w3)\./i', $url, $matches))
{
if($matches[2] != 'www')
{
$url = preg_replace('/^(https?):\/\//', '', $url);
}
else
{
$url = explode($matches[0], $url);
$url = $url[1];
}
}
if(is_array($server))
$server = $server[0];
if(preg_match('/cloudflare/i', $server))
echo "\n[+] CloudFlare detected: {$server}\n";
else
echo "\n[+] CloudFlare wasn't detected, proceeding anyway.\n";
echo '[+] IP: ' . is_ipv4(gethostbyname($url)) . "\n\n";
echo "[+] Searching for more IP addresses.\n\n";
for($x = 0; $x < $count; $x++)
{
$site = $subs[$x] . $url;
$ip = is_ipv4(gethostbyname($site));
echo "Trying {$site}: {$ip}\n";
}
echo "\n[+] Finished.\n";
?>* - Oats - Jul 8, 2012
Looks nice man! Congratulations, will definitly try it out later.
-Oats
* - Modify - Jul 8, 2012
Wouldn't surprise me at all if the next wave of booter sources included this as a feature on top of basic domain>IP resolving. Very helpful, thank you for the share.
* - uBurn - Jul 8, 2012
Make it retard proof so people don't copy and paste it :3
* - n31ght0 - Jul 9, 2012
reserved for update.
i will change it and host it on server so it can use public. can i do that bro ??
* - Phizo - Jul 9, 2012
(Jul 9, 2012 12:13 AM)n31ght0 Wrote: reserved for update.
i will change it and host it on server so it can use public. can i do that bro ??
Sure, do what you like.
Feel free to post it here if you like, I'll put it in the thread under your name.
* - einbrettholz - Jul 9, 2012
lol, this scrpit found my real server ip in less than one second Oo wtf.
phizo, what do you think about LeRes finder script?
source: https://leresearcher.wordpress.com/2012/06/15/hello-mr-dns-do-you-know-where-website-x-hides/
Code
#!/usr/bin/python
from ipaddr import IPv4Network
import socket
import threading
import Queue
import sys
from subprocess import call
class Spider(threading.Thread):
def __init__ (self,queue):
threading.Thread.__init__(self)
self.queue = queue
def run(self):
while True:
self.ip = self.queue.get()
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
result = s.connect_ex((str(self.ip), 53))
if(result == 0):
dig = "@%s"% str(self.ip)
call(["dig",dig,"ugnazi.com", "+short"])
s.close()
self.queue.task_done()
if __name__ == "__main__":
queue = Queue.Queue()
net = IPv4Network('69.42.219.0/24')
socket.setdefaulttimeout(.3)
for host in net.iterhosts():
queue.put(host)
for i in xrange(100):
t = Spider(queue)
t.setDaemon(True)
t.start()
queue.join()
print "Scan done"
sys.exit(1)* - Phizo - Jul 9, 2012
(Jul 9, 2012 12:37 AM)einbrettholz Wrote: lol, this scrpit found my real server ip in less than one second Oo wtf.
phizo, what do you think about LeRes finder script?
source: https://leresearcher.wordpress.com/2012/06/15/hello-mr-dns-do-you-know-where-website-x-hides/
Code#!/usr/bin/python
from ipaddr import IPv4Network
import socket
import threading
import Queue
import sys
from subprocess import call
class Spider(threading.Thread):
def __init__ (self,queue):
threading.Thread.__init__(self)
self.queue = queue
def run(self):
while True:
self.ip = self.queue.get()
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
result = s.connect_ex((str(self.ip), 53))
if(result == 0):
dig = "@%s"% str(self.ip)
call(["dig",dig,"balloons.com", "+short"])
s.close()
self.queue.task_done()
if __name__ == "__main__":
queue = Queue.Queue()
net = IPv4Network('69.42.219.0/24')
socket.setdefaulttimeout(.3)
for host in net.iterhosts():
queue.put(host)
for i in xrange(100):
t = Spider(queue)
t.setDaemon(True)
t.start()
queue.join()
print "Scan done"
sys.exit(1)
That's good, it means it's working perfectly then.
As for that script, I believe it wouldn't work on Windows as the "dig" command isn't valid in Windows. My script is somewhat the same except instead of asking the DNS I looked at DNS reports myself for the most popular websites out there and then I included the subdomains that seemed to be used a lot. Mine doesn't search for other websites on the server either since it was created to attempt to resolve IP's that are being masked by CloudFlare. It's a good idea though.
* - Prominent - Jul 9, 2012
You never stop impressing me. Good job :3 <3
* - Prx3R0 - Jul 9, 2012
So that the cloudflare.php i saw LOL!
Nice bro, keep up the good work! :D
* - Hooded Robin - Jul 9, 2012
NIce work Phizo, thanks for the share
* - Phizo - Jul 9, 2012
Thanks for the feedback :3
Every thanks is greatly appreciated.
* - deiski - Jul 9, 2012
Thank's for the program. It will become useful.
* - n31ght0 - Jul 9, 2012
sorry bro why it not working with url that not contain www ??
ex http://w3.tbd.my/
and i get this error
Code
URL is invalid.
URL must be formatted as: http(s)://www.http://w3.tbd.my
(for compatibility reasons)* - Phizo - Jul 9, 2012
(Jul 9, 2012 04:04 PM)n31ght0 Wrote: sorry bro why it not working with url that not contain www ??
ex http://w3.tbd.my/
and i get this error
CodeURL is invalid.
URL must be formatted as: http(s)://www.http://w3.tbd.my
(for compatibility reasons)
URLs must be formatted that way for compatibility reasons. A lot of sites require www to be in the URL, generally governmental/educational sites.
Code
C:\Users\Phizo\Desktop>php cloudflare.php http://www.w3.tbd.my
[+] CloudFlare wasn't detected, proceeding anyway.
[+] IP: 199.27.134.58
[+] Searching for more IP addresses.
Trying cpanel.w3.tbd.my: (Null)
Trying ftp.w3.tbd.my: (Null)
Trying mail.w3.tbd.my: (Null)
Trying webmail.w3.tbd.my: 199.101.28.130
Trying direct.w3.tbd.my: (Null)
Trying direct-connect.w3.tbd.my: 199.101.28.130
Trying record.w3.tbd.my: (Null)
Trying ssl.w3.tbd.my: (Null)
Trying dns.w3.tbd.my: (Null)
Trying help.w3.tbd.my: (Null)
Trying blog.w3.tbd.my: 199.101.28.130
Trying forum.w3.tbd.my: 199.101.28.130
[+] Finished.