[Mr evil]

how to bypass cloud-flare and find the real ip of the website ?

[Charger]

The only way is if you check the Whois history from when they were not using cloudflare.

[Hecate]

You can try use simple script in .bat format. 🎉
Spoiler (Click to View)

If you got text: Tracing route to yourhostname [ 1.1.1.1 ]
That 1.1.1.1 is your resolved cf ip address

Code

@echo off

:start
cls
title CloudFlare exploit
color 02
echo.
echo                                                    CloudFlare resolver !
echo                                                Dorks list updated  3/23/2017
echo.
echo                                           Enter hostname without "  http: // www "
set /P host=:                                                        

cls
echo.
title Run exploit on %host%
color 02
echo                                        Searching ip leaks from:  %host%

echo.
tracert -h 1 -d -h 1 -d ftp.%host%
echo.
tracert -h 1 -d mail.%host%
echo.
tracert -h 1 -d direct.%host%
echo.
tracert -h 1 -d direct-connect.%host%
echo.
tracert -h 1 -d cpanel.%host%
echo.
tracert -h 1 -d admin.%host%
echo.
tracert -h 1 -d pop.%host%
echo.
tracert -h 1 -d imap.%host%
echo.
tracert -h 1 -d forum.%host%
echo.
tracert -h 1 -d beta.%host%
echo.
tracert -h 1 -d portal.%host%
echo.
pause
goto:start

[Mr evil]

yes i try CloudFlare resolver but it did not work lol

[Charger]

yes i try CloudFlare resolver but it did not work lol

All you can do is check the whois or see what dns records they have.

[Hecate]

yes i try CloudFlare resolver but it did not work lol

If you check the Whois history from when they were not using cloudflare, and using resolver did not find ip address soo you will not get much out of nowhere.

[Mr evil]

darm so what you would do in this situation ? lol

[Hecate]

darm so what you would do in this situation ? lol

As I understand it, you want to get the IP address from the website.
And you will use the IP addresses for attacking website using layer4 attacking methods.
If yes, The last option is use layer7 methods.

[alqtri]

try this site

http://www.crimeflare.com/

:)

[a horse]

ignoring the skids above
1) attempt to look for dns leakage - request all dns entries, then bf sub-domains (specifically services that CF doesn't cover)
2) if the website is dynamic, attempt out-of-bounds info leak, meaning cause the service to phone back to you. For example, sending a confirm email from the server using the server's SMTP service will obviously reveal the IP in the headers

[lalapwn]

ignoring the skids above
1) attempt to look for dns leakage - request all dns entries, then bf sub-domains (specifically services that CF doesn't cover)
2) if the website is dynamic, attempt out-of-bounds info leak, meaning cause the service to phone back to you. For example, sending a confirm email from the server using the server's SMTP service will obviously reveal the IP in the headers

2) will not work if the site owner is using external SMTP.

@OP, you best bet is to check the historic DNS entries.

[Mr evil]

This cloud-flare thingy really sucks the evil eyez

[Mr evil]

fierce is the alternative to find the ip

[godjustice555]

ok, there are more ways.
what didn't discuss above is the SSL way. previously, u need to know how to use the right query to find it in censys. now, just head to crt.sh and from the cert it will link to censys, and from censys u can look for the ipv4 machine that uses the cert.

as of tools, u can use cloudflair to achieve the above.

and there's another way that is a tweak of the above. i've proven it to work but it requires huge amount of resources. (think brute forcing)
and i'm sure i can find the real ip of any sites with my algorithm.

[13R20]

GitHub - s0md3v/Striker: Striker is an offensive information and vulnerability scanner.
The World's Largest Repository of Historical DNS data