spyboy-productions/cloakquest3r

Uncover the true IP address of websites safeguarded by Cloudflare & Others

If you find this GitHub repo useful, please consider giving it a star! ⭐️

     

CloakQuest3r is a powerful Python tool meticulously crafted to uncover the true IP address of websites safeguarded by Cloudflare and other alternatives, a widely adopted web security and performance enhancement service. Its core mission is to accurately discern the actual IP address of web servers that are concealed behind Cloudflare's protective shield. Subdomain scanning is employed as a key technique in this pursuit. This tool is an invaluable resource for penetration testers, security professionals, and web administrators seeking to perform comprehensive security assessments and identify vulnerabilities that may be obscured by Cloudflare's security measures.

🚀 Run Online Free On Google Colab, Google Shell, Binder

Key Features:

• Real IP Detection: CloakQuest3r excels in the art of discovering the real IP address of web servers employing Cloudflare's services. This crucial information is paramount for conducting comprehensive penetration tests and ensuring the security of web assets.

• Subdomain Scanning: Subdomain scanning is harnessed as a fundamental component in the process of finding the real IP address. It aids in the identification of the actual server responsible for hosting the website and its associated subdomains.

• IP address History: Retrieve historical IP address information for a given domain. It uses the ViewDNS service to fetch and display details such as IP address, location, owner, and last seen date.

• SSL Certificate Analysis: Extract and analyze SSL certificates associated with the target domain. This could provide additional information about the hosting infrastructure and potentially reveal the true IP address.

• SecurityTrails API (optional): If you add your free SecurityTrails API key to the config.ini file, you can retrieve historical IP information from SecurityTrails.

• Threaded Scanning: To enhance efficiency and expedite the real IP detection process, CloakQuest3r utilizes threading. This feature enables the scanning of a substantial list of subdomains without significantly extending the execution time.

• Detailed Reporting: The tool provides comprehensive output, including the total number of subdomains scanned, the total number of subdomains found, and the time taken for the scan. Any real IP addresses unveiled during the process are also presented, facilitating in-depth analysis and penetration testing.

With CloakQuest3r, you can confidently evaluate website security, unveil hidden vulnerabilities, and secure your web assets by disclosing the true IP address concealed behind Cloudflare's protective layers.

Featured:

CloakQuest3r is one of the Top 20 Most Popular Hacking Tools in 2023 by KitPloit

• Top 20 Most Popular Hacking Tools in 2023

Limitation

- Sometimes it can't detect the real Ip.

- CloakQuest3r combines multiple indicators to uncover real IP addresses behind Cloudflare. While subdomain scanning is a part of the process, we do not assume that all subdomains' A records point to the target host. The tool is designed to provide valuable insights but may not work in every scenario. We welcome any specific suggestions for improvement.

- We created a proof of concept, but it's not well-written. We welcome pull requests to improve it.

1. False Negatives: CloakReveal3r may not always accurately identify the real IP address behind Cloudflare, particularly for websites with complex network configurations or strict security measures.

2. Dynamic Environments: Websites' infrastructure and configurations can change over time. The tool may not capture these changes, potentially leading to outdated information.

3. Subdomain Variation: While the tool scans subdomains, it doesn't guarantee that all subdomains' A records will point to the primary host. Some subdomains may also be protected by Cloudflare.

This tool is a Proof of Concept and is for Educational Purposes Only.

---

OS compatibility :

Requirements:

How to Use:

1. Run CloudScan with a single command-line argument: the target domain you want to analyze.

    git clone https://github.com/spyboy-productions/CloakQuest3r.git
   

   cd CloakQuest3r
   

   pip3 install -r requirements.txt
   

   For Termux(android) User use the command given below if having trouble installing cryptography using requirements.txt

   pkg install python-cryptography

   python cloakquest3r.py example.com
   

2. The tool will check if the website is using Cloudflare. If not, it will inform you and ask if you still want to proceed.

3. If Cloudflare is detected, it will first print historical IP records and then it will scan for subdomains and identify their real IP addresses.

4. You will receive detailed output, including the number of subdomains scanned, the total number of subdomains found, and the time taken for the scan.

5. Any real IP addresses found will be displayed, allowing you to conduct further analysis and penetration testing.

it simplifies the process of assessing website security by providing a clear, organized, and informative report. Use it to enhance your security assessments, identify potential vulnerabilities, and secure your web assets.

---

Optional: SecurityTrails API

Retrieves historical IP information from SecurityTrails. if you have an API key add it to the configuration file (config.ini).

Upon initial execution of the script, it generates a config.ini file with the following content:

[DEFAULT]
securitytrails_api_key = your_api_key

Subsequently, the script attempts to retrieve data from the SecurityTrails API. If the retrieval fails due to reasons such as quota limitations or site unavailability, the corresponding function is gracefully skipped.

---

Contribution:

Contributions and feature requests are welcome! If you encounter any issues or have ideas for improvement, feel free to open an issue or submit a pull request.

😴🥱😪💤 ToDo:

• Discover IP through website API calls (POC)
• Save all info on a Txt/CSV file.

💬 If having an issue Chat here

⭔ Snapshots:

---

If you find this GitHub repo useful, please consider giving it a star! ⭐️

cloakquest3r's Issues

No real IP addresses found for subdomains

╰➤ Total Subdomains Scanned: 781
╰➤ Total Subdomains Found: 0
╰➤ Time taken: 35.18 seconds
No real IP addresses found for subdomains.

Cloakquest3r Refactor Suggestion/Review

While browsing through LinkedIn I found this tool and it was very useful to me so I thought "why not?" and I've decided to refactor this code while trying to improve my Python skills and helping the community somehow.

Before opening a new Pull Request I'd rather ask to the authors their opinion on the actual code as I don't expect you to accept those changes without complaints or questions. So here's a breakthrough of the changes.

⚠️ Disclaimer: I'm not good at coloring outputs, and I find the methods to do so extremely irritating so I didn't used many colors, but this can always be updated later on.

⚠️ Disclaimer #2: I'm also not the best programmer ever, but I've tried my best to facilitate people's life, this does include the author of the code.

🗒️ Changelog:

I've made a couple of changes, so I'm splitting this in different sections.

File Structure

I've modified the project's folder structure. Having a unique and extremely big file containing different functions and parts of the code can become a real mess sometimes and, unfortunately, this is the case.

Previous Structure

CloakQuest3r/
│
├── cloakquest3r.py
├── requirements.txt
└── wordlist.txt

Updated Structure

CloakQuest3r/
│
├── cloakquest3r.py
├── requirements.txt
├── config.toml				# Author information/links, version tag & API keys
├── core/					# Core functionalities of the code
│	├── __init__.py
│	├── cloakquester.py		# Main functions
│	├── banner.py			
│	└── color.py			
├── docs/					# Documentation related files
│	└── LICENSE
└── wordlists/				# Out-of-the-box wordlists
	└── default.txt

Splitting the code into distinct sections enhances organization and makes it easier to find specific code segments when updating or adding new features. Cloakquest3r has been modularized, with its own dedicated module.

• The banner.py contains functions related to banner and social media output, as this is not relevant for the main code to work, this allows the author to easily change the visual and/or colors as desired without touching the main code.
• The config.toml file stores API keys and also other relevant information about the author and his social media links and code version.
• The color.py file stores colored output related functions, to avoid unnecessary lines of code in the main file.
• The default out-of-the-box tool wordlist is included inside the wordlists folder.
• Templates, license, and other documentation should be stored inside the docs folder.

Code Changes

Previously created functions have been refactored, rewritten and/or renamed for simplicity of code as needed. Some functions and variables names have become clearer and shorter.

• Reduced is_using_cloudflare and detect_web_server to a single function, since both do basically the same thing. The code now verifies wheter the target is behind Cloudflare before doing anything else, and only asks for confirmation if the code isn't.
• The code now verifies both if both URL and wordlist file are valid. Both have their own functions for validation: is_valid_url and is_valid_file.
• Two functions have been added _to_url and _to_hostname. Those basically convert the string as some functions require the URL schema (https://) while others don't.

Features

I've added some features that I thought would help users and also trying to add some features mentioned in the Contribution section of the README.md file.

• Added the -w/--wordlist flag, allowing the user to set a custom wordlist for subdomain discovery.
• Added the --no-bruteforce option to avoid subdomain discovery through bruteforcing.
• Added the --no-security-trail option to avoid Security Trails usage for IP history discovery,
• Added the --no-banner option, as this can be useful while piping the output to an external file.
• Added the --force option to ignore wheter the target is using cloudflare of not.
• Added a help page -h/--help using argparse module.

TODO:

Some changes are still in progress and may or may be not continued based on the author's opinion on the code.

• Adding docstrings to functions, some functions already have this included but I was too lazy to add them all.
• Adding typing to functions. Same as above, too lazy to add all.
• More color to printed texts. Adding colors can be an issue due to the fact a simple print function can become hard to understand in the code with the brackets everywhere.
• Turn this into a PyPI package?

Final Considerations

My only objectives is to help and collaborate to the code somehow while improving my coding skills, I don't expect those changes to be accepted without complaints. I'm willing to listen and react to feedback from the code author.

The refactored code is available here: https://github.com/JLowborn/CloakquesterRedone

Good tool!

I tried this instrument, and work's good for me.

UnicodeEncodeError: 'charmap'

I got an error when running the code for the first time

Traceback (most recent call last): File "C:\Users\62897\CloakQuest3r\cloakquest3r.py", line 167, in <module> print_banners() File "C:\Users\62897\CloakQuest3r\cloakquest3r.py", line 44, in print_banners print(f'{G} \u2570\u27a4 {Y}Twitter : {W}{twitter_url}') File "C:\Users\62897\AppData\Local\Programs\Python\Python312\Lib\site-packages\colorama\ansitowin32.py", line 47, in write self.__convertor.write(text) File "C:\Users\62897\AppData\Local\Programs\Python\Python312\Lib\site-packages\colorama\ansitowin32.py", line 177, in write self.write_and_convert(text) File "C:\Users\62897\AppData\Local\Programs\Python\Python312\Lib\site-packages\colorama\ansitowin32.py", line 202, in write_and_convert self.write_plain_text(text, cursor, start) File "C:\Users\62897\AppData\Local\Programs\Python\Python312\Lib\site-packages\colorama\ansitowin32.py", line 210, in write_plain_text self.wrapped.write(text[start:end]) File "C:\Users\62897\AppData\Local\Programs\Python\Python312\Lib\encodings\cp1252.py", line 19, in encode return codecs.charmap_encode(input,self.errors,encoding_table)[0] ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ UnicodeEncodeError: 'charmap' codec can't encode characters in position 1-2: character maps to <undefined>

سحب صور من المسلسل

هكر

1