KNOX D3: contests

Bypassing Cloudflare - Attack-Secure Challenge Writeup!

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjCTVf_barNY8WNvaMn7oiBFG9vL7f7RRM8Jy-QsEdwhJXf6jZhwPtdN3N_UwStGP9nBecL0Ua9C7lp-6oNNxQAzbMHvQh8Gkck5AB2aA67r2of2IO8i3U-JAx1ZQFrPfDuezuXpuECxPI/s1600/cfhome2.gif" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjCTVf_barNY8WNvaMn7oiBFG9vL7f7RRM8Jy-QsEdwhJXf6jZhwPtdN3N_UwStGP9nBecL0Ua9C7lp-6oNNxQAzbMHvQh8Gkck5AB2aA67r2of2IO8i3U-JAx1ZQFrPfDuezuXpuECxPI/s1600/cfhome2.gif" /></a></div><br />Few days back we setup a small and interesting challenge for RHA readers, the main goal of the challenge was to find the <u>hosting provider</u> and the <u>real iP address</u> of the attack-secure.com. Since attack-secure.com is running cloudflare which acts as a reverse proxy the nameservers and the target iP address would be replaced with the one of cloudflare when ever you try to communicate with the servers. So let's talk about some of the ways we can solve this challenge, we are disclosing some of the ways that could be used to solve this challenge.<br /><b><u></u></b><br /><a name="more"></a><b><u>Bypassing Cloudflare - Method 1</u></b><br /><br />The first method involves the using a website that maintain records of websites using cloudflare, it contains list of around 381,314 domains that have recently shifted to cloudflare and they are actively testing it. The website is called as <b><u>cloudflare-watch.org</u></b>. The guys are cloudflare watch believe that cloudflare was started for a purpose of helping bad guys such as hackers, ddosers, copyright pirates. Here is what they write on their homepage:<br /><br />"<u><i>CloudFlare is a venture-funded startup that routes around Internet abuse by acting as a reverse proxy. They also encourage illegality by allowing hackers, DDoSers, cyberbullies, and copyright pirates to hide behind their servers.</i></u>"   <br /><br />All you need to go to the url below and type your domain name and click on search:<br /><a href="http://www.cloudflare-watch.org/cfs.html">http://www.cloudflare-watch.org/cfs.html</a><br /><br /><div class="separator" style="clear: both; text-align: left;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi4c0vfd8CCMBhqgXJ8HVZMk08LTM1e7wbWIGG8QUUYA9AAKpyuVQ1-iX8qwL3CQtNsz0Adhmrwh90gsBalcr6faDS2zLvadCvMBuFr43R1f3f9rSWYKAV5ur6Smx_MJuS1uvP8wvMtKsg/s1600/asfsa.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="105" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi4c0vfd8CCMBhqgXJ8HVZMk08LTM1e7wbWIGG8QUUYA9AAKpyuVQ1-iX8qwL3CQtNsz0Adhmrwh90gsBalcr6faDS2zLvadCvMBuFr43R1f3f9rSWYKAV5ur6Smx_MJuS1uvP8wvMtKsg/s640/asfsa.png" width="577" /></a></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">A direct iP connect was found inside the database, if you compare this IP address with the ip address that we get while we ping the website, it's different. </div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhLTnFr0Usph_4ngF0Z0KsTIUpzpBST9Mi9w-v1L_vYXqJpuvt7QoRKxMr5-3hJmtPo0_TUWjTZO2sAfAqzhrQtVjmr0WLYxmiwTBTtjE553td9SEuLrs8q5auhcGRlrJce7SYYW3iaRkA/s1600/Untitled.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="220" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhLTnFr0Usph_4ngF0Z0KsTIUpzpBST9Mi9w-v1L_vYXqJpuvt7QoRKxMr5-3hJmtPo0_TUWjTZO2sAfAqzhrQtVjmr0WLYxmiwTBTtjE553td9SEuLrs8q5auhcGRlrJce7SYYW3iaRkA/s640/Untitled.png" width="577" /></a></div><div class="separator" style="clear: both; text-align: left;"><br /></div>On navigating to the following address "<b>http://199..47.222.125</b>", we find that this particular web server belongs to page.ly which is the real webhosting company for attack-secure.com<br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhQfyOtvRlODrQ2uFNKoIoJuofkgCNbtETuxDyeo8U5MrP8DanogMV4kTNjECRVBITb4Ddbbo6hyphenhyphenuJ7bGPS2Io7-JaHczhamk7z8c7gWqWafUZUMx-qm9-70E_iDGYy4prWV4HbsbKBnOw/s1600/Untitled.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="347" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhQfyOtvRlODrQ2uFNKoIoJuofkgCNbtETuxDyeo8U5MrP8DanogMV4kTNjECRVBITb4Ddbbo6hyphenhyphenuJ7bGPS2Io7-JaHczhamk7z8c7gWqWafUZUMx-qm9-70E_iDGYy4prWV4HbsbKBnOw/s640/Untitled.png" width="577" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><b><u>Bypassing Cloudflare Method 2</u></b></div><div class="separator" style="clear: both; text-align: left;"><b><u><br /></u></b></div><div class="separator" style="clear: both; text-align: left;">The second method is one of the best methods specially to figure out the real ip of forums who are using cloudflare. The idea behind this method to register on a forum or any where that allows registrations, since cloudflare does not handles mx records it is possible for us to find out the real iP by email headers. One of our winners have sent us a video on how he utilized this method to solve the challenge:</div><iframe allowfullscreen="" frameborder="0" height="300" mozallowfullscreen="" src="http://player.vimeo.com/video/70763112" webkitallowfullscreen="" width="577"></iframe> <br /><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><b>Winners</b></div><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><div class="separator" style="clear: both; text-align: left;">We received hundred's of submission and most of the people were sending the cloudflare iP instead of the real one. We would like to congratulate the following people for solving our challenge:</div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><b>1)</b> <u><b>Haider Qureshi</b> </u>(Solved first) (Utilized the second method)</div><div class="separator" style="clear: both; text-align: left;"><b>2)</b> <b><u>Aamir Rehman</u> </b>(Utilized the second method)</div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">There are ofcourse other methods such as resolving real iP by subdomains and by using mx records, We might talk about them in upcoming articles. </div></div>

Bypassing Cloudflare - Attack-Secure Challenge Writeup!

Few days back we setup a small and interesting challenge for RHA readers, the main goal of the challenge was to find the hosting provider a...

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgOnF0U_2F_aR5_Ls-ZfXLwLSq1r6W9FijXOXnGAH89bW6qoC-AHFoF_s4JHmzhBVAoRyFw7IplRsQ0pmxneCgaj-uSJnTnM9h3XVzHdHjHzYY5DD2UfJxDTxrtJkO3cuDgCWoP1X75Snk/s1600/image0041170674785895.gif" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="347" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgOnF0U_2F_aR5_Ls-ZfXLwLSq1r6W9FijXOXnGAH89bW6qoC-AHFoF_s4JHmzhBVAoRyFw7IplRsQ0pmxneCgaj-uSJnTnM9h3XVzHdHjHzYY5DD2UfJxDTxrtJkO3cuDgCWoP1X75Snk/s400/image0041170674785895.gif" width="400" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: center;"><u><b><i>Update: Winners Announced <a href="http://www.rafayhackingarticles.net/2013/07/bypassing-cloudfare-attack-secure.html" target="_blank">here </a></i></b></u></div><span id="goog_1567433507"></span><span id="goog_1567433508"></span><br />Well, You might have already about "<a href="http://www.rafayhackingarticles.net/2012/04/penetration-testing-in-real-world.html" rel="nofollow" target="_blank"><b>Attack-Secure Real World Penetration testing course</b></a>", The course is based upon real world Penetration testing, The course covers almost every thing that you need to learn in order to become a good Penetration tester. The lab is based upon over 20+ real world targets that you need to hack and find the key.txt file in order to pass the examination.<br /><a name="more"></a>Luckily for <a href="http://rafayhackingarticles.net/" target="_blank"><b>RHA readers</b></a>, the Attack-secure founder "<b>Muhammad Ramadan</b>" was kind enough to to sponsor a contest for us. The contest is based upon a challenge where the first one to solve it would get a <b><u>free chance at the certification and full access to the lab</u></b>. The others would get amazing <b><u>20% discount</u></b> on all courses.<br /><br />The challenge goes as follows:<br /><br />The website attack-secure.com is running cloudflare, Therefore the real IP and the hosting provider is not known, We verified it by performing a query to it's dns servers.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEilcqX38sM6z_HdJyYoWzb66HAFHuSomXMVsZ2-Dbd6TP7z6eUbLetzdokgttlg9F-8rXo1DjBU5Ym9iVEpPZfHwifd2PS_q7MTQJqEy22Ed9F7KXu8YfSqQA5gzGPz3DHk5jiWj45rnsQ/s1600/ss.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEilcqX38sM6z_HdJyYoWzb66HAFHuSomXMVsZ2-Dbd6TP7z6eUbLetzdokgttlg9F-8rXo1DjBU5Ym9iVEpPZfHwifd2PS_q7MTQJqEy22Ed9F7KXu8YfSqQA5gzGPz3DHk5jiWj45rnsQ/s1600/ss.png" /></a></div><br />Your challenge is as follows:<br /><br /><b>1) </b><u>Find the Hosting Provider of Attack-secure.com</u><br /><b>2) </b><u>Find the real dns servers</u>.<br /><b>3) </b><u>Find the real IP <b>(Additional Points)</b></u><br /><br />Wish you good luck, You can report answers to <b><u>rafayhackingarticles@gmail.com</u></b>.</div>

Win A Free Shot At "Samurai Skills" Penetration Testing Course

Update: Winners Announced here Well, You might have already about " Attack-Secure Real World Penetration testing course ", The co...

+ Read more »