CF-Hero

CF-Hero CF-Hero What's it? • Features • Background • Installation • Usage • Running cf-hero • ZoomEye Sponsor • To Do What's it? CF-Hero は、Cloudflare によって保護された Web アプリケーションの実 IP アドレスを発見するために開発された、包括的な偵察ツールです。複数の情報源から多角的なインテリジェンス収集を行います。 DNS Reconnaissance 現在の DNS レコード（A、TXT） 履歴 DNS データの分析 関連ドメインの...

cloudbunny

CloudBunny CloudBunnyは、WAFをプロキシまたは保護として使用しているオリジンサーバーを特定するツールです。 ツールの詳細はこちらをご覧ください: https://tinyurl.com/y8p48wb3 動作の仕組み このツールでは、ドメイン情報を検索するために3つの検索エンジン（Shodan、Censys、ZoomEye）を使用しています。これらのツールを使用するにはAPIキーが必要です。以下のリンクから取得できます。 Shodan - https://account.shodan.io/ Censys - https://censys.io/account/ap...

CloudFlair

CloudFlair 重要なお知らせ：2024年後半以降、Censysは無料アカウントへのAPIアクセスを提供しなくなりました。つまり、CloudFlairは無料のCensysアカウントでは動作しなくなりました 。 CloudFlairは、CloudFlare（またはCloudFront）で保護されたWebサイトのうち、一般に公開されており、関連するCDNのIP範囲へのネットワークアクセスを適切に制限していないオリジンサーバーを見つけるためのツールです。...

bypass-firewalls-by-DNS-history

DNS履歴を悪用してファイアウォールを迂回する このスクリプトは以下を見つけようとします： Cloudflare、Incapsula、SUCURIなどのファイアウォールの背後にあるサーバーの直接IPアドレス 現在のアクティブなサイトと同じ（非アクティブで管理されていない）ウェブサイトをまだ実行している古いサーバー。A...

Cloudmare

Cloudmare Cloudmareは、Cloudflare、Sucuri、Incapsulaで保護されたWebサイトのDNS設定の誤構成を利用して、オリジンサーバーを見つけるシンプルなツールです。 この一般的な設定ミスとCloudmareの動作の詳細については、プライベートメッセージを送ってください。 以下はCloudmareの動作イメージです。 この例のWebサイトとIPアドレスは難読化されています。 セットアップ 1. リポジトリをクローンします git clone https://github.com/MrH0wl/Cloudmare.git 2. フォルダに移動します cd...

Astra Linux – Vulnerability in Apache2

Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded- headers to the origin server based on the client-side Connection header hop-by-hop mechanism. This could be used to bypass IP-based authentication on the origin server/application...

Astra Linux – Vulnerability in Apache2

The Apache HTTP Server versions 2.4.6 to 2.4.46, with the modproxywstunnel module configured, were used to handle a URL. The origin server did not necessarily upgrade this connection. This setup allowed subsequent requests on the same connection to be processed without any HTTP validation,...

Astra Linux – Vulnerability in Apache2

A properly crafted request URI-path can cause modproxy to forward the request to an origin server chosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier...

CVE-2026-18408

A vulnerability in PostgreSQL allows a malicious origin-server superuser to achieve client-side arbitrary code execution during a database restore. By injecting untrusted data into a pgdump export, the attacker can exploit the input expansion of the psql \restrict meta-command. When a victim...

CDN Tsunami Attack Abuses HTTP/3 Translation for Up to 350x DoS Amplification

Cybersecurity researchers have disclosed two denial-of-service DoS attacks that exploit how major content delivery networks CDNs convert client-facing HTTP/3 traffic into HTTP/1.1 requests to the websites they front, amplifying a low-bandwidth request stream by up to 350x against the origin serve...

Linux Distros Unpatched Vulnerability : CVE-2026-67339

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cURL handlers. Attackers can capture proxy...

EUVD-2026-51854

guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cURL handlers. Attackers can capture proxy credentials through origin server access logs when requests are redirected, bypassed, or sent through SOCKS proxies that Guzzle...

PT-2026-67319

Name of the Vulnerable Software and Affected Versions guzzlehttp/guzzle versions prior to 7.14.2 Description The built-in cURL handlers CurlHandler and CurlMultiHandler fail to properly isolate Proxy-Authorization headers from origin servers. This occurs because the handlers place first-class...

CVE-2026-44487

Axios Node.js HTTP adapter vulnerability: Proxy-Authorization credentials can leak to the redirected origin during specific proxy-to-direct redirects. Affected in Axios < 0.32.0 and

CVE-2026-44487 Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter

Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usage, where an initial HTTP request is...

Your Origin Server Might Be Your Most Expensive Decision

...

GHSA-P92Q-9VQR-4J8V Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter

Summary Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usage, where an initial HTTP request is sent through an authenticated HTTP proxy, redirects are followed, and the redirected UR...

CVE-2026-26365

Akamai Ghost on Akamai CDN edge servers before 2026-02-06 mishandles processing of custom hop-by-hop HTTP headers, where an incoming request containing the header "Connection: Transfer-Encoding" could result in a forward request with invalid message framing, depending on the Akamai processing pat...

Cloudflare Fixes ACME Validation Bug Allowing WAF Bypass to Origin Servers

Cloudflare has addressed a security vulnerability impacting its Automatic Certificate Management Environment ACME validation logic that made it possible to bypass security controls and access origin servers. "The vulnerability was rooted in how our edge network processed requests destined for the...

curl: Proxy-Authorization header is leaked to origin server after redirect from proxied to direct connection

Summary curl leaks the Proxy-Authorization header to the origin server after following an HTTP redirect that transitions from a proxied connection to a direct connection e.g. when using --noproxy or when proxy is bypassed after redirect. This causes proxy credentials which are hop-by-hop to be se...