Open-source security research tool for identifying origin IP exposure of websites protected by Cloudflare and similar reverse proxy services.
CloakQuest3r is a Python-based security research tool designed to analyze and identify potential origin IP exposure of websites protected by Cloudflare and other reverse proxy or CDN services.
Websites often rely on Cloudflare to mask their origin server IPs for security and performance benefits. However, misconfigurations—such as exposed subdomains, legacy DNS records, or improperly secured services—can unintentionally reveal the underlying server infrastructure.
CloakQuest3r focuses on subdomain enumeration and passive analysis techniques to help security professionals, penetration testers, and web administrators assess whether sensitive origin infrastructure is inadvertently exposed. The tool is intended to support authorized security testing, defensive assessments, and infrastructure hardening efforts.
Google Colab, Google Shell, Binder
Key Features:
Real IP Detection: CloakQuest3r excels in the art of discovering the real IP address of web servers employing Cloudflare's services. This crucial information is paramount for conducting comprehensive penetration tests and ensuring the security of web assets.
Subdomain Scanning: Subdomain scanning is harnessed as a fundamental component in the process of finding the real IP address. It aids in the identification of the actual server responsible for hosting the website and its associated subdomains.
IP address History: Retrieve historical IP address information for a given domain. It uses the ViewDNS service to fetch and display details such as IP address, location, owner, and last seen date.
SSL Certificate Analysis: Extract and analyze SSL certificates associated with the target domain. This could provide additional information about the hosting infrastructure and potentially reveal the true IP address.
SecurityTrails API (optional): If you add your free SecurityTrails API key to the config.ini file, you can retrieve historical IP information from SecurityTrails.
Threaded Scanning: To enhance efficiency and expedite the real IP detection process, CloakQuest3r utilizes threading. This feature enables the scanning of a substantial list of subdomains without significantly extending the execution time.
Detailed Reporting: The tool provides comprehensive output, including the total number of subdomains scanned, the total number of subdomains found, and the time taken for the scan. Any real IP addresses unveiled during the process are also presented, facilitating in-depth analysis and penetration testing.
With CloakQuest3r, you can confidently evaluate website security, unveil hidden vulnerabilities, and secure your web assets by disclosing the true IP address concealed behind Cloudflare's protective layers.
CloakQuest3r is one of the Top 20 Most Popular Hacking Tools in 2023 by KitPloit
- Sometimes it can't detect the real Ip.
- CloakQuest3r combines multiple indicators to uncover real IP addresses behind Cloudflare. While subdomain scanning is a part of the process, we do not assume that all subdomains' A records point to the target host. The tool is designed to provide valuable insights but may not work in every scenario. We welcome any specific suggestions for improvement.
- We created a proof of concept.
1. False Negatives: CloakReveal3r may not always accurately identify the real IP address behind Cloudflare, particularly for websites with complex network configurations or strict security measures.
2. Dynamic Environments: Websites' infrastructure and configurations can change over time. The tool may not capture these changes, potentially leading to outdated information.
3. Subdomain Variation: While the tool scans subdomains, it doesn't guarantee that all subdomains' A records will point to the primary host. Some subdomains may also be protected by Cloudflare.
[!IMPORTANT]
This tool is a Proof of Concept and is for Educational Purposes Only.
[!CAUTION] Please use this responsibly and ethically.
DISCLAIMER
It is possible to use CloakQuest3r for nefarious purposes. It merely illustrates what adept attackers are capable of. Defenders have a responsibility to consider such attacks and protect their users from them. Using CloakQuest3r should only be done with the written permission of the targeted parties for legitimate penetration testing assignments.
