Today we will learn what is Cloudflare, how it works and how we can bypass it.
You can read this article if you don’t know about DDOS.
First of all lets see what Wikipedia has to say about Cloudflare:
Cloudflare, Inc. is a U.S. company that provides a content delivery network, Internet security services and distributed domain name server services, sitting between the visitor and the Cloudflare user’s hosting provider, acting as a reverse proxy for websites.
Satisfied? Nope. No one is and that’s why a noob like me is writing this article.
Well there was a time when there was no protection from DDOS attacks, Crawling bots, Spamming etc.
A guy was tired of getting DDOSed and he had only one thing in mind “I have to avoid direct contact from visitors to handle spam requests”.
That wise guy got an idea!
He managed to setup a more powerful server to act as a proxy (not really), he copied all his static files (files of his site that he didn’t used to change) to that ‘new server’.
Now he made all the traffic for his website (server) to come through the new server first.
So every time when a visitor tried to access the site, the new server will serve the visitor (Provide resources)
And after a week his new server got DDOSed.
He thought WTF?
Why I didn’t think about it?
My new server has no protection at all so it won’t work. I am so stupid!
But he was determined! He thought I must find a way to block multiple requests from a visitor.
He coded a program that could block an IP address (visitor) if it tries to send multiple requests in short time.
He deployed that program in his new server.
A DDOSer tried to ddos his site and his new program and server came into play. That program blocked the requests and the IP of DDOSer.
He was really happy and satisfied.
Then he added features like caching and blocking on the basis of IP reputation etc. He named this setup “Cloudflare”
Now that Guy has 79 such servers across the world and provides services to everyone who pays for it (it has a free version too)
They help to accelerate the website response, for example
Whenever a user from Russia tries to access the site, Cloudflare contacts the nearest server (i.e. in Russia) and tells it to serve him and hence the user gets a faster response.
Why are we reading about it? Why do we need to bypass it?
First of all as I told you that Cloudflare was mainly designed to prevent DDOS so it is clearly a problem for a hacker who is trying to DDOS the website using Cloudflare.
Secondly, when you try to connect to the website, you connect to the cloudflare servers.
So if you need IP Address of a website, you enter ping xyz.com and you get the IP Address like:
Thats simple right?
But when you ping a website which is using Cloudflare then you get response from Cloudflare and hence you get the wrong IP Address.
Similarly you can’t perform a port scan because you don’t have the IP Address of the real server. In short, you can’t do anything to the server as long as that Cloudflare is there.
So we have to bypass it and that’s what we are going to do. Keep Reading.
How To Bypass Cloudflare?
The easiest method which works most of the time is Pinging the subdomains of the target website.
For example I want know IP Address of a website example.com which is protected by Clouflare then I will enter the following in terminal
And one of these “arguments” should give you the real IP Address of the website.
If you are using Linux then you can install a tool named DNSMap which has a good list of subdomains and tries to ping them and gives you results. DNSMap is preinstalled in Kali Linux.
Thats all for now! We may talk about other bypass methods later.
I hope you guys enjoyed it!