CloudFlair

CloudFlair

Important note: As of late 2024, Censys does not provide API access to free accounts anymore. This means CloudFlair does not work with free Censys accounts anymore.

CloudFlair is a tool to find origin servers of websites protected by CloudFlare (or CloudFront) which are publicly exposed and don't appropriately restrict network access to the relevant CDN IP ranges.

The tool uses Internet-wide scan data from Censys to find exposed IPv4 hosts presenting an SSL certificate associated with the target's domain name. API keys are required and can be retrieved from your Censys account.

For more detail about this common misconfiguration and how CloudFlair works, refer to the companion blog post at https://blog.christophetd.fr/bypassing-cloudflare-using-internet-wide-scan-data/.

Here's what CloudFlair looks like in action.

…

(The IP addresses in this example have been obfuscated and replaced by randomly generated IPs)

Setup

1. Register an account (free) on https://search.censys.io/register
2. Browse to https://search.censys.io/account/api, and set two environment variables with your API ID and API secret

$ export CENSYS_API_ID=...
$ export CENSYS_API_SECRET=...

1. Clone the repository

$ git clone https://github.com/christophetd/CloudFlair.git

1. Create a virtual env and install the dependencies

cd CloudFlair
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt

1. Run CloudFlair (see Usage below for more detail)

python cloudflair.py myvulnerable.site

or for CloudFront

python cloudflair.py myvulnerable.site --cloudfront

Usage

…

Docker image

A lightweight Docker image of CloudFlair (christophetd/cloudflair) is provided. A scan can easily be instantiated using the following command.

$ docker run --rm -e CENSYS_API_ID=your-id -e CENSYS_API_SECRET=your-secret christophetd/cloudflair myvulnerable.site

You can also create a file containing the definition of the environment variables, and use the Docker--env-file option.

$ cat censys.env
CENSYS_API_ID=your-id
CENSYS_API_SECRET=your-secret

$ docker run --rm --env-file=censys.env christophetd/cloudflair myvulnerable.site

Compatibility

Tested on Python 3.6. Feel free to open an issue if you have bug reports or questions.