Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What gives Cloudflare the right to takedown apps revealing site real IP?

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 61 posts

Re: Ask HN: What gives Cloudflare the right to takedown apps revealing site real IP?

#11

Post by Liquid_Fire »

5ESS wrote: post #6
formerkrogemp wrote: post #5

The name might be infringement or the code might abuse their API. Or, GitHub could decide it's not worth it. Why would you try to scan every IP address?

A valid use case for wanting to know the “real” IP of a site hiding behind CloudFlare is being able to access the website from a Tor IP address (which they categorically block). For users in a country with censored internet, such a service would be essential.

If your website is behind CloudFlare, why even allow direct connections from anyone that's not CloudFlare?

Re: Ask HN: What gives Cloudflare the right to takedown apps revealing site real IP?

#13

Post by zinekeller »

5ESS wrote: post #6
formerkrogemp wrote: post #5

The name might be infringement or the code might abuse their API. Or, GitHub could decide it's not worth it. Why would you try to scan every IP address?

A valid use case for wanting to know the “real” IP of a site hiding behind CloudFlare is being able to access the website from a Tor IP address (which they categorically block). For users in a country with censored internet, such a service would be essential.

> which they categorically block

Everytime I check this statement with Cloudflare-enabled sites... it was either always accessible (a nagging screen might be shown momentarily, but that's it), or the block is usually due to that site being a bank or something else that will block Tor users regardless of their firewall solutions. I've just tested it again just in case something has changed, but that statement holds up every time.

Can you please give a non-banking site that a) uses Cloudflare and b) blocks Tor?

Re: Ask HN: What gives Cloudflare the right to takedown apps revealing site real IP?

#14

Post by cft »

5ESS wrote: post #4
cft wrote: post #2

>by scanning the public internet in it’s entirely, indexing the domains Can you explain this?

So there’s only 4.2 billion possible IPv4 addresses where a site can live. A lot are reserved or unused, leaving about 3.7 billion possibilities. Household internet speeds are fast enough that it is within the realm of possibility that a computer could sequentially connect to every single IPv4 host on the entire internet in search for the target website. Specialty network cards with datacenter connections can scan th…

But what makes you think that the real IP serves the same site to the public internet, as it proxies to CF? If I were using CF for DDoS mitigation, I would drop all traffic to my real IP other than traffic originating from CF.

Re: Ask HN: What gives Cloudflare the right to takedown apps revealing site real IP?

#16

Post by jokethrowaway »

ushakov wrote: post #9
Nathanba wrote: post #8

Why on earth would you try to help DDOS'ers? I think you should really take a step back here and reevaluate what drives you here and what impact you have on other people.

aren’t there any legitimate use-cases for it?

Yes, for example, pirate websites are often hiding their identity and if someone is infringing on your copyright you can't go and report it to their hosts because Cloudflare hides the IP. Reporting DMCA to Cloudflare won't give you the IP of their hosts.

A court ruling exempted Cloudflare from its users infringements of copyright making things easy for them.

Re: Ask HN: What gives Cloudflare the right to takedown apps revealing site real IP?

#17

Post by zinekeller »

ushakov wrote: post #12
spacemanmatt wrote: post #3

https://github.com/zidansec/CrimeFlare-1

that’s just the client though it only makes request to https://api.xploit.my.id/v1/crimeflare.php and logs the output

Nope, that's literally it: https://web.archive.org/web/20210426093141/https://github.co...

Re: Ask HN: What gives Cloudflare the right to takedown apps revealing site real IP?

#18

Post by jeroenhd »

cft wrote: post #14
5ESS wrote: post #4

Earlier quoted context omitted.

So there’s only 4.2 billion possible IPv4 addresses where a site can live. A lot are reserved or unused, leaving about 3.7 billion possibilities. Household internet speeds are fast enough that it is within the realm of possibility that a computer could sequentially connect to every single IPv4 host on the entire internet in search for the target website. Specialty network cards with datacenter connections can scan th…

But what makes you think that the real IP serves the same site to the public internet, as it proxies to CF? If I were using CF for DDoS mitigation, I would drop all traffic to my real IP other than traffic originating from CF.

Your approach would definitely protect you. In practice, many site owners don't do this, or they configure their web server with the whitelist instead of their firewall, denying direct access but exposing information about their domain.

For site owners who don't know about this, these are the IP addresses you can expect traffic from: https://www.cloudflare.com/ips/

I'd personally advice using IPv6 (with a high, random address rather than the common aa:bb:cc:dd::0) to make scanning for hosts a lot harder to accomplish, just in case your firewall fails for some weird reason.

Re: Ask HN: What gives Cloudflare the right to takedown apps revealing site real IP?

#20

Post by jasode »

>, I intend to create a new internet-wide scanning system in order to revive the functionality of CrimeFlare just to prove a point that security through obscurity is no security and all,

I'm not familiar with CrimeFlare and its technical details but a cursory google search shows that security-through-obscurity is possible with Cloudflare if one follows the correct sequence of steps to hide the ip. Otherwise, a careless setup such as public MX mail record will inadvertently "leak" the ip. E.g. Stackoverflow Q&A: https://stackoverflow.com/questions/58591448/how-does-crimef...

>, I intend to create a new internet-wide scanning system

But the host systems at the receiving end of your scanning tool still have to respond to your tool pinging them with network requests and if your ip origin isn't Cloudflare, the host server doesn't have to reply with useful information. Or did you have another mass scanning technique we're overlooking?

Post reply on HN