[Phizo]

I recently came across a thread where ๖ۣۜDan was speaking of his "Cloudflare > Real IP" program he created in Python. I had a look at it and thought of creating my own in PHP, with some minor improvements.
๖ۣۜDan's version can be found here if you're interested in checking it out: https://hackforums.net/showthread.php?tid=2564147

My version is also intended to be ran from the console, if you wish to modify it and use it for the web you may do so yourself. I can't be bothered making two versions of it even if it only requires a small amount of modifications.
This also isn't a guaranteed way of resolving an IP address protected by CloudFlare, but it will attempt to do so.

Requirements:

• PHP ~ http://php.net/downloads.php
  


• Ability to read.
  

Screenshots:
Spoiler (Click to View)
[img]http://i.imm.io/vMdK.png[/img]

[img]http://i.imm.io/vMeG.png[/img]


Code:

PHP Code


<?php

# CloudFlare IP Resolver

# Coded By Phizo
# https://hackforums.net/member.php?action=profile&uid=42381

function is_ipv4($ip)
{
    return filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) ? $ip : '(Null)';
}

$me = $argv[0];
$url = @$argv[1];

if(!isset($url))
    die("\n[+] Usage: php {$me} <url>\n[+] Example: php {$me} http://www.imgur.com\n");

if(!preg_match('/^(https?):\/\/(w{3}|w3)\./i', $url))
    die("\nURL is invalid.\nURL must be formatted as: http(s)://www." . preg_replace('/^(https?):\/\//', '', $url) . "\n(for compatibility reasons)\n");

$headers = get_headers($url, 1);
$server = $headers['Server'];

$subs = array('cpanel.', 'ftp.', 'mail.', 'webmail.', 'direct.', 'direct-connect.', 'record.', 'ssl.', 'dns.', 'help.', 'blog.', 'forum.');
$count = count($subs);

if(preg_match('/^(https?):\/\/(w{3}|w3)\./i', $url, $matches))
{
    if($matches[2] != 'www')
    {
     $url = preg_replace('/^(https?):\/\//', '', $url);
    }
    else
    {
     $url = explode($matches[0], $url);
     $url = $url[1];
    }
}

if(is_array($server))
    $server = $server[0];

if(preg_match('/cloudflare/i', $server))
    echo "\n[+] CloudFlare detected: {$server}\n";
else
    echo "\n[+] CloudFlare wasn't detected, proceeding anyway.\n";

echo '[+] IP: ' . is_ipv4(gethostbyname($url)) . "\n\n";
echo "[+] Searching for more IP addresses.\n\n";

for($x = 0; $x < $count; $x++)
{
    $site = $subs[$x] . $url;
    $ip = is_ipv4(gethostbyname($site));

    echo "Trying {$site}: {$ip}\n";
}

echo "\n[+] Finished.\n";

?>

[Oats‌‌‌]

Looks nice man! Congratulations, will definitly try it out later.

-Oats

[Modify]

Wouldn't surprise me at all if the next wave of booter sources included this as a feature on top of basic domain>IP resolving. Very helpful, thank you for the share.

[uBurn]

Make it retard proof so people don't copy and paste it :3

[n31ght0]

reserved for update.
i will change it and host it on server so it can use public. can i do that bro ??

[Phizo]

reserved for update.
i will change it and host it on server so it can use public. can i do that bro ??

Sure, do what you like.
Feel free to post it here if you like, I'll put it in the thread under your name.

[einbrettholz]

lol, this scrpit found my real server ip in less than one second Oo wtf.

phizo, what do you think about LeRes finder script?
source: https://leresearcher.wordpress.com/2012/...e-x-hides/

Code

#!/usr/bin/python
from ipaddr import IPv4Network
import socket
import threading
import Queue
import sys
from subprocess import call

class Spider(threading.Thread):    
    def __init__ (self,queue):
        threading.Thread.__init__(self)
        self.queue = queue

    def run(self):
        while True:          
            self.ip = self.queue.get()
            s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            result = s.connect_ex((str(self.ip), 53))
            if(result == 0):
                dig = "@%s"% str(self.ip)            
                call(["dig",dig,"ugnazi.com", "+short"])
            s.close()
            self.queue.task_done()

if __name__ == "__main__":

    queue = Queue.Queue()
    net = IPv4Network('69.42.219.0/24')
    socket.setdefaulttimeout(.3)

    for host in net.iterhosts():
        queue.put(host)

    for i in xrange(100):
        t = Spider(queue)
        t.setDaemon(True)
        t.start()

    queue.join()

    print "Scan done"
    sys.exit(1)

[Phizo]

lol, this scrpit found my real server ip in less than one second Oo wtf.

phizo, what do you think about LeRes finder script?
source: https://leresearcher.wordpress.com/2012/...e-x-hides/

Code

#!/usr/bin/python
from ipaddr import IPv4Network
import socket
import threading
import Queue
import sys
from subprocess import call

class Spider(threading.Thread):    
    def __init__ (self,queue):
        threading.Thread.__init__(self)
        self.queue = queue

    def run(self):
        while True:          
            self.ip = self.queue.get()
            s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            result = s.connect_ex((str(self.ip), 53))
            if(result == 0):
                dig = "@%s"% str(self.ip)            
                call(["dig",dig,"balloons.com", "+short"])
            s.close()
            self.queue.task_done()

if __name__ == "__main__":

    queue = Queue.Queue()
    net = IPv4Network('69.42.219.0/24')
    socket.setdefaulttimeout(.3)

    for host in net.iterhosts():
        queue.put(host)

    for i in xrange(100):
        t = Spider(queue)
        t.setDaemon(True)
        t.start()

    queue.join()

    print "Scan done"
    sys.exit(1)

That's good, it means it's working perfectly then.

As for that script, I believe it wouldn't work on Windows as the "dig" command isn't valid in Windows. My script is somewhat the same except instead of asking the DNS I looked at DNS reports myself for the most popular websites out there and then I included the subdomains that seemed to be used a lot. Mine doesn't search for other websites on the server either since it was created to attempt to resolve IP's that are being masked by CloudFlare. It's a good idea though.

[Prominent]

You never stop impressing me. Good job :3 <3

[Prx3R0]

So that the cloudflare.php i saw LOL!
Nice bro, keep up the good work! :D

[Hooded Robin]

NIce work Phizo, thanks for the share

[Phizo]

Thanks for the feedback :3
Every thanks is greatly appreciated.

[deiski]

Thank's for the program. It will become useful.

[n31ght0]

sorry bro why it not working with url that not contain www ??
ex http://w3.tbd.my/
and i get this error

Code

URL is invalid.
URL must be formatted as: http(s)://www.http://w3.tbd.my
(for compatibility reasons)

[Phizo]

sorry bro why it not working with url that not contain www ??
ex http://w3.tbd.my/
and i get this error

Code

URL is invalid.
URL must be formatted as: http(s)://www.http://w3.tbd.my
(for compatibility reasons)

URLs must be formatted that way for compatibility reasons. A lot of sites require www to be in the URL, generally governmental/educational sites.

Code

C:\Users\Phizo\Desktop>php cloudflare.php http://www.w3.tbd.my

[+] CloudFlare wasn't detected, proceeding anyway.
[+] IP: 199.27.134.58

[+] Searching for more IP addresses.

Trying cpanel.w3.tbd.my: (Null)
Trying ftp.w3.tbd.my: (Null)
Trying mail.w3.tbd.my: (Null)
Trying webmail.w3.tbd.my: 199.101.28.130
Trying direct.w3.tbd.my: (Null)
Trying direct-connect.w3.tbd.my: 199.101.28.130
Trying record.w3.tbd.my: (Null)
Trying ssl.w3.tbd.my: (Null)
Trying dns.w3.tbd.my: (Null)
Trying help.w3.tbd.my: (Null)
Trying blog.w3.tbd.my: 199.101.28.130
Trying forum.w3.tbd.my: 199.101.28.130

[+] Finished.