CloakQuest3r

If you find this GitHub repo useful, please consider giving it a star! ⭐️ CloakQuest3r is a Python-based security research tool designed to analyze and identify potential origin IP exposure of websites protected by Cloudflare and other reverse proxy or CDN services. Websites often rely on...

Cloudflare-Bypass

Cloudflare-Bypass Cloudflare Bypass tools | PentestCore Is a tool for bypassing Cloudflare that you can use to get the master IP of site server. How to use Linux : Enter the below command in the terminal : git clone https://github.com/pentestcore/Cloudflare-Bypass.git cd Cloudflare-Bypass Install...

chaos

chaos chaos is an 'origin' IP scanner developed by RST in collaboration with ChatGPT. It is a niche utility with an intended audience of mostly penetration testers and bug hunters. An origin-IP is a term-of-art expression describing the final public IP destination for websites that are publicly...

Havoc-C2-SSRF-poc

CVE-2024-41570: Havoc-C2-SSRF-poc This vulnerability is exploited by spoofing a demon agent registration and checkins to open a TCP socket on the teamserver and read/write data from it. This allows attackers to leak origin IPs of teamservers and much more. Full analysis:...

chaos

chaos chaos는 RST가 ChatGPT와 협력하여 개발한 'origin' IP 스캐너입니다. 주로 침투 테스터와 버그 헌터를 대상으로 하는 전문 유틸리티입니다. Origin-IP는 타사를 통해 공개적으로 제공되는 웹사이트의 최종 공용 IP 대상을 설명하는 전문 용어입니다. Origin-IP에 관심이 있는 이유를 더 알고 싶다면 블로그 게시물을 확인하세요. chaos는 ChatGPT와의 DevOps 원칙을 사용하여 24시간 이내에 아이디어에서 기능적인 개념 증명까지 신속하게 프로토타이핑되었습니다. usage: chaos....

cloud-buster

Cloudflare Resolver A comprehensive pentest tool that checks Cloudflare enabled sites for origin IP leaks. It's filled with awesome features! scan a wide array of miss-configuration and vulnerabilities search other IP resolution service databases detail origin and related services IPs smart engin...

Exploit for Double Free in Apache Http_Server

☣️ CVE-2026-23918-Elite-Auditor ☣️ Professional Intelligenc...

EUVD-2025-205476

Xspeeder SXZOS through 2025-12-26 allows root remote code execution via base64-encoded Python code in the chkid parameter to vLogin.py. The title and oIP parameters are also used...

Cloudflare Public Bug Bounty: Origin IP address disclosure through Pingora response header

HTTP responses to cached files served by the Pingora proxy revealed Origin IP address information. An attacker could trigger this misbehaviour by crafting a request with a malformed Range header. The attack was successful under conditions where Cloudflare cache was in REVALIDATED state, the...

CVE-2022-2877

The Titan Anti-spam & Security WordPress plugin before 7.3.1 does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to bypass it's block feature by spoofing the headers...

GitLab: Found Origin IP's lead to access to gitlab

@m-narayanan disclosed a known Origin IP / CloudFlare bypass issue, remediation for which was and is being tracked at https://gitlab.com/gitlab-com/gl-infra/reliability/-/issues/9945 The requested disclosure, then later requested it to be made private again...

CVE-2022-1762

The iQ Block Country WordPress plugin before 1.2.20 does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to bypass it's block feature by spoofing the headers...

CVE-2022-1762

The iQ Block Country WordPress plugin before 1.2.20 does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to bypass it's block feature by spoofing the headers...

Design/Logic Flaw

The iQ Block Country WordPress plugin before 1.2.20 does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to bypass it's block feature by spoofing the headers...

PT-2022-14094 · WordPress · Iq Block Country

Name of the Vulnerable Software and Affected Versions: iQ Block Country WordPress plugin versions prior to 1.2.20 Description: The issue allows threat actors to bypass the block feature by spoofing HTTP headers, as the plugin does not properly check these headers to validate the origin IP address...

U.S. Dept Of Defense: Found Origin IP's Lead To Access ████

Discovered that the ██████ site exposed its Non-Cloudflare IP which could allow bypassing of anti-DDoS mechanisms. Your origin servers are not blocking access from non-Cloudflare servers.This way crawlers can find your origin servers' IPs by checking random IPs until they found your origin server...

Sifchain: Origin IP Disclosure Vulnerability

Summary: It is possible to access origin IP servers served by nginx and not cloudflare. Even though these IP's don't serve a functional version of the app it is possible to enable DDoS attacks by bypassing cloudflare protections. Steps To Reproduce: Even though these IP's don't serve a functional...

Design/Logic Flaw

Norton Password Manager, prior to 6.3.0.2082, may be susceptible to an address spoofing issue. This type of issue may allow an attacker to disguise their origin IP address in order to obfuscate the source of network traffic...

Chaturbate: DoS attacks utilizing camo.stream.highwebmedia.com

DoS attacks utilizing camo.stream.highwebmedia.com Summary The asset proxy at camo.stream.highwebmedia.com used to embed external images linked by users fails to enforce 1. a timeout on slow responses if a little data is sent every 10 seconds a kind of "reverse-slowloris" attack 1. a size limit o...

bypass-firewalls-by-DNS-history - Firewall Bypass Script Based On DNS History Records

This script will try to find: the direct IP address of a server behind a firewall like Cloudflare, Incapsula, SUCURI ... an old server which still running the same inactive and unmaintained website, not receiving active traffic because the A DNS record is not pointing towards it. Because it's an...