HatCloud

HatCloud - 已停用 HatCloud 使用 Ruby 构建。它用于绕过 CloudFlare 以发现真实 IP。 这在你需要测试服务器和网站时很有用。用于测试你对 DDoS（分布式拒绝服务）或 DoS（拒绝服务）的防护能力。 CloudFlare 是一项提供分布式域名服务器服务的服务，位于访问者和 Cloudflare 用户的主机提供商之间，充当网站的逆向代理。 其网络通过 DNS 变更来保护、加速并提升网站或移动应用的可用性。 版本：1.0 用法： ruby hatcloud.rb -h 或 --help ruby hatcloud.rb -b 你的网站 或 ruby...

evilwaf

EvilWAF es un proxy transparente avanzado de bypass de firewall MITM y un escáner profundo de vulnerabilidades de WAF diseñado para pruebas de seguridad autorizadas. Opera en la capa de transporte: no toca payloads, cookies ni cabeceras de tus herramientas. Funciona con cualquier herramienta como...

CloudUnflare

CloudUnflare...

Cloudflare-Bypass

Cloudflare-Bypass Cloudflare 绕过工具 | PentestCore 这是一个用于绕过 Cloudflare 的工具，可用于获取网站服务器的主 IP。 使用方法 Linux： 在终端中输入以下命令： git clone https://github.com/pentestcore/Cloudflare-Bypass.git cd Cloudflare-Bypass 安装 PHP： apt-get install php 运行： php Cloudflare-Bypass.php 输入网站 URL。 Windows： 在 CMD 中输入以下命令： php.exe...

IG-Detective

IG-Detective 🕵️‍♂️📸 由@shredzwho 创建 | 💖 赞助此项目 IG-Detective 是一款基于 Python 的高性能开源情报（OSINT）工具，专为 Instagram 设计。它提供高级交互式 shell，可对 Instagram 账户进行深度分析、提取位置历史、绘制交互图谱，并生成自动化调查报告。 !WARNING 免责声明 ：此工具仅用于教育和研究目的。请负责任地使用，并遵守 Instagram 的服务条款。作者不对任何滥用行为负责。 ⚡ 功能特性 🛡️ 规避与隐身（高级） TLS 指纹欺骗 ：使用无头 Playwright chromium 浏览器配合...

WarChild

War Child Warchild 是一套拒绝服务测试套件，用于分析你的网站面对不同种类拒绝服务攻击时的强度，这些攻击主要由不法分子组织，旨在对你的网站造成损害。 Alt text 安装 如需安装所需模块，只需在终端中运行以下命令 : pip install -r requirements.txt 使用 python warchild.py 概述 该拒绝服务套件包含以下功能： 1. CloudBust :- Cloudbust（又名 AETHON）是一个 Cloudflare 解析器，用于检查受 Cloudflare 保护的网站是否存在错误的 DNS 配置。 它主要使用...

Cloudcheck

Cloudcheck Cloudcheck 设计为与 CloudFail 放在同一文件夹中使用。使用前请确保本仓库中所有文件都在同一文件夹下。 同时，在 data 文件夹中创建一个名为 none.txt 的空文本文件，这样在测试时就不会进行子域名暴力破解。 Cloudcheck 会自动修改你的 hosts 文件，使用 CloudFail 的条目，并测试指定的字符串，以检测该条目是否可用于绕过 Cloudflare。 如果输出结果为 "True"，则可以在 hosts 文件中使用该 IP 地址来绕过 Cloudflare。（后续将自动化此过程） 示例：...

Exploit for CVE-2026-63030

wp2shell-cf-bypass Independent PoC for the WordPress batch ro...

Exploit for Deserialization of Untrusted Data in Facebook React

⚡ CVE-2025-55182 – Auto Exploit Toolkit Precision Engine...

From Cloudflare Bypass to Credit Card Theft

Introduction On July 6, 2025, a suspicious Python package called 'cloudscrapersafe' was uploaded to the Python Package Index PyPI. Marketed as a utility to evade Cloudflare’s anti-bot protections, this package was a modified version of a widely used 'cloudscraper' library, which is used to automa...

SSRF vulnerability in the vrite

Description This vulnerability can be used to leak remote server information, bypass CDN like cloudflare. Also it can be used to the SSRF attack. Proof of Concept Here we can use it to leak the real IP of the https://app.vrite.io. GET /proxy?url=https://your-vps-ip.nip.io/ HTTP/2 Host: app.vrite....

Yuga Labs: Origin IP Exposed waf bypass

The origin IP address of the website was exposed, allowing bypassing of the anti-DDoS mechanism in place, such as Cloudflare. This could have enabled access to the service without going through the web application firewall, potentially leading to unfiltered payloads being forwarded to the service...

SMTP2GO BBP: Origin IP found, WAF Cloudflare Bypass

Description: I have discovered that the http://172.105.190.180/login/ site exposed it's IP which could allow bypassing of anti-DDoS mechanisms i.e you are using Cloudflare for protection. For Originate IP address which I found from https://search.censys.io/ By using these IP address as a resolver...

Logitech: GET based Open redirect on [streamlabs.com/content-hub/streamlabs-obs/search?query=]

Summary: Description: in the following link, the parameter query is reflecting in multiple places, one of them is in the tag in the head section of the HTML source, the reflection is in the content attribute to be precise check the below image F983200 And i was able to break out of the content...

Razer: Reflected XSS on molpay.com with cloudflare bypass

The tester discovered a reflected XSS vulnerability on molpay.com which could allow an adversary to steal client side information such as a cookie. Razer Fintech thanks the tester for his clear report and PoC. Follow brutelogic for amazing bypass tips. Thank you for bounty @razer 🙏...

Razer: [press.razer.com] Origin IP found, Cloudflare bypassed

The tester discovered that the press.razer.com site exposed its IP which could allow bypassing of anti-DDoS mechanisms. While minor, Razer does appreciate the report and the tester bringing this to our attention...

CloudUnflare - Reconnaissance Real IP Address For Cloudflare Bypass

Reconnaissance Real IP address for Cloudflare Bypass. Preparation: 1. CompleteDNS API Create an account at completedns.com and verify first. Input your email and password on CompleteDNSLogin variable in cloudunflare.bash. 2. Dependencies Needed curl dig whois Debian Based apt-get install curl...

There are Upload file the file name at the time of discovery of the delay injection vulnerability-vulnerability warning-the black bar safety net

! The It is author in invited to test items found in the Upload File name the filename of a time delay blind injection vulnerabilities, this position is relatively rare, Share this in hopes of everyone starting to learn a role. The following is the author of the discovery process. Earlier this...

BillCipher - Information Gathering Tool For A Website Or IP Address

Information Gathering tool for a Website or IP address, use some ideas from Devploit. BillCipher can work in any operating system if they have and support Python 2, Python 3, and Ruby. Features DNS Lookup Whois Lookup GeoIP Lookup Subnet Lookup Port Scanner Page Links Zone Transfer HTTP Header Ho...

Th3Inspector - Tool for Information Gathering

Tool For Information Gathering. Usage Short Form| Long Form| Description ---|---|--- -i| --info| Website Information -n| --number| Phone Number Information -mx| --mailserver| Find IP Address And E-mail Server -w| --whois| Domain Whois Lookup -l| --location| Find Website/IP Address Location -c|...