CF-Hero

CF-Hero

CF-Hero

What's it? • Features • Background • Installation • Usage • Running cf-hero • ZoomEye (Sponsor) • To Do

What's it?

CF-Hero is a comprehensive reconnaissance tool developed to discover the real IP addresses of web applications protected by Cloudflare. It performs multi-source intelligence gathering through various methods.

DNS Reconnaissance

• Current DNS records (A, TXT)
• Historical DNS data analysis
• Associated domain discovery

Intelligence Sources

• ZoomEye search engine
• Censys search engine
• Shodan search engine
• SecurityTrails historical records
• Active DNS enumeration
• Related domain correlation

The tool analyzes data from these sources to identify potential origin IP addresses of Cloudflare-protected targets. It validates findings through response analysis to minimize false positives.

a simple flowchart of the tool

…

Feautures

Features

• DNS Reconnaissance

  • Checks current DNS records (A, TXT)
  • Extracts domains behind Cloudflare
  • Extracts domains not behind Cloudflare
  • User-provided HTML title (in case of CF blocks you)
  • Smart colouring

• Third-party Intelligence

  • ZoomEye integration
  • Censys integration
  • Shodan integration
  • SecurityTrails integration
  • Reverse IP lookup for associated domains

• Advanced Features

  • Custom JA3 fingerprint support
  • Concurrent scanning capabilities
  • Standard input support (piping)
  • HTML title comparison for validation
  • Proxy support
  • Custom User-Agent configuration

Background

Current DNS Records

Let's take look at some use-case with misconfigured DNS settings.

As you can see, a regular DNS query returns the IP address of the domain. For example, musana.net is behind Cloudflare (CF), but sometimes the domain has multiple A records, and some of them may not correspond to IP addresses associated with CF. (This DNS output is merely an illustrative example and may not represent the exact DNS answer for musana.net.)

;; ANSWER SECTION:
musana.net.	300	IN	A	104.16.42.102
musana.net.	300	IN	A	104.16.43.102
musana.net.	300	IN	A	123.45.67.89 (Real IP exposed)
musana.net.	300	IN	A	123.45.76.98 (Real IP exposed)

The another case is related to TXT records. Sometimes domain is behind of CF but real IP of the domain may used in TXT records. CF-Hero check all TXT records then extract all IP address finally it try to connect IP which it found via HTTP.

Let's say we have like DNS TXT records. As seen in the TXT records, there is SPF record. Some company can host own mail server and TXT records may contain IP which points to target domain.

As you can see in the following DNS answer SPF record has some IP addresses. Cf-Hero also checks these.

…

OSINT

OSINT is another technique to find real IP of any domain which is behind of CF. There are lots of special search engine for special purpose. Shodan and Censys are two of these. They provide more detail and technical information. These search engine scan whole internet continously and discover new assets or monitor and log changing in assets. When a domain which is not behind of CF get up, bot of these engine can log Real IP of the domain. After a while if the domain will take behind of cloudflare, their IP can be found using these search engine.

CF-Hero checks censys and shodan too. (Note that when you use these services you have some limit due to API quota.)

(Sub)Domains

The other trick way is (sub)domain technique. Actually It doesn't have to be a subdomain It can be domain as well. The key point is here; domains should belong to same company.

Let's say we have 2 domain. One of them is behind of CF but the otner is not. In this case, you connect to the domain which is not behind of CF then you change host header with domain which is behind of CF. If you get response of application's which is behind of CF, congruculations you bypassed CF. You can access web application from IP directly anymore. (and of course that's also depends on the configuration)

Let's take look at closer

…

Historical DNS Records

Historical DNS records services try to discover all domains on the Internet and record changes in the DNS records of these domains.The best known of these services is securitytrails. If a domain is published on internet with its real IP address these service's bot can log it's real IP address after then if the domain is taken behind of cloudflare, the real IP addresses can find out using these services. Thus, we can find the real ip address of a domain that has broadcast over the real ip address in the past.

It uses the security trails service for historical DNS records. You can perform this scan using the -securitytrails parameter after entering the API key in the cf-hero.yaml file.

Installation Instructions

cf-hero requires go1.18 to install successfully. Run the following command to install.

go install -v github.com/musana/cf-hero/cmd/cf-hero@latest

Usage

…

Running CF-Hero

The most basic running command. It checks A and TXT records by default.

# cat domains.txt | cf-hero

or you can pass "f" parameter to it.

# cf-hero -f domains.txt

Use the zoomeye parameter to include ZoomEye in the scan

# cat domain.txt | cf-hero -zoomeye

Use the censys parameter to include Censys in the scan

# cat domain.txt | cf-hero -censys

Use the shodan parameter to include Shodan in the scan

# cat domain.txt | cf-hero -shodan

Use the securitytrails parameter to include SecurityTrails in the scan

# cat domain.txt | cf-hero -securitytrails

Use the -td and -dl parameters to attempt to find the target domain's IP address by utilizing a list of domains or subdomains that are not behind Cloudflare. By specifying the IP addresses in the blocks where you have identified live IP addresses used by the target's cloud or on-premises infrastructure with the -dl parameter, you can find the real IP address of the target domain

# cf-hero -td https://musana.net -dl sub_domainlist.txt

to get domains behind of CF

# cf-hero -f domains.txt -cf

to get domains not behind of CF

# cf-hero -f domains.txt -non-cf

other options (custom ja3, proxy, worker, user agent)

# cf-hero -d https://musana.net -ua "Mozilla" -w 32 -ja3 "771,22..." -px "http://127.0.0.1:8080"

create cf-hero.yaml file under $HOME/.config/ directory to set the APIs key

# touch ~/.config/cf-hero.yaml

// content of YAML file should be like;

zoomeye:
  - "api_key_here"           # ZoomEye API v2 key (sent in the API-KEY header)
securitytrails:
  - "api_key_here"
shodan:
  - "api_key_here"           # standard Shodan API key (the /dns/domain endpoint requires a paid Membership)
censys:
  - "censys_pat_here"        # Censys Platform Personal Access Token (PAT)
  - "organization_id_here"   # optional: Censys Organization ID, required for paid plans

Note on Censys: CF-Hero now uses the Censys Platform API (the legacy search.censys.io API is being sunset in 2026). Generate a Personal Access Token (PAT) from the Censys Platform console and put it as the first censys entry. If your account is on a paid plan, add your Organization ID (shown on the API Access page) as the second entry — without it, the API returns Free-tier permissions and may yield no results (HTTP 403).

SS

• Smart coloring: Yellow highlights indicate non-Cloudflare IPs, which will only be subject to checks.
• The title parameter can be set if the first request is blocked by Cloudflare.(The title would be 'Just a moment...') If the title parameter is not set, the HTML title is automatically retrieved.

Sponsorship

This project is proudly supported by ZoomEye.

To Do

• favicon search
• viewdns integration