[PatientStudent]

Hey guys,

talking about web apps, unlike the machines on HackTheBox or whatever, in real world people hosting websites host them on secure enterprise servers.

For example - if we go through about 20 scam sites, they all are on CloudFlare, M 247, Powerhouse Inc. or whatever.

Getting through to these fraudulent websites means getting through the host's infrastructure.

Is this a known blocker for getting these websites down?

What's the point of nmaping the website's IP if it's CloudFlare's IP or whatever?

[DramaKing]

Hey guys,

talking about web apps, unlike the machines on HackTheBox or whatever, in real world people hosting websites host them on secure enterprise servers.

For example - if we go through about 20 scam sites, they all are on CloudFlare, M 247, Powerhouse Inc. or whatever.

Getting through to these fraudulent websites means getting through the host's infrastructure.

Is this a known blocker for getting these websites down?

What's the point of nmaping the website's IP if it's CloudFlare's IP or whatever?

None. But will you exploit an open SMTP or POP3 port? These vulnerabilities are specific to web apps but beware of WAFs.

1. Injection
   
2. Broken Authentication and Session Management
   
3. Cross-Site Scripting (XSS)
   
4. Broken Access Control
   
5. Security Misconfiguration
   
6. Insecure Cryptographic Storage
   
7. Insufficient Transport Layer Protection
   
8. Sensitive Data Exposure
   
9. XML External Entities (XXE)
   
10. Insecure Deserialization
    

[Money-]

There's ways to bypass cloudflare. You need to obtain the Origin IP hosting behind cloudflare. They are several known methods and unique and private ones obviously. But yea.