[Money-]

Just wondering , do you guys got anymore methods for this attack vector?
What's the latest methodology for it now at the moment?

[kayla_90]

There is no way around it, you lucky if they left a service out of the cloudfare.

[Blazin]

There is no method, you hope they didn't put all sub domains on cloudflare.
You check if email server leaks IPS,

or lastly you check whois records and see if they leak the info.

[Sekhmet]

There is no method, you hope they didn't put all sub domains on cloudflare.
You check if email server leaks IPS,

or lastly you check whois records and see if they leak the info.

+200 for this but also i have found a well known and widely used scripts that expose the real ip behind cloudflare if it's installed on the server ofc this is not " method " or even vulnerability it's just how this scripts work

Tip : look for misconfigured files

[Brief]

+200 for this but also i have found a well known and widely used scripts that expose the real ip behind cloudflare if it's installed on the server ofc this is not " method " or even vulnerability it's just how this scripts work

Tip : look for misconfigured files

Speaking of scripts, there might be some tools. I have seen a scanner report about a web application that has the real IP of the web application, even though the site was behind cloudfare.