How hackers bypass cloudflare & other reverse proxy solutions

In this video, I go through how can you bypass reverse proxies put in place.
Books to get started on hacking:
1. Hacker's Handbook - amzn.to/4aH5msF
2. Real World Bug Hunting - amzn.to/48Msi7N
3. Certified Blackhat - amzn.to/3tG7QXB
4. Linux For Hackers - amzn.to/47plE6E
5. Black Hat Python - amzn.to/48N3k8D
PC I use: amzn.to/3S6XERh
NOTE: This video is purely for educational purposes.
Tags:
#reverse #proxy #ethicalhacking #ctf #bug #bounty #hacker #hacking #cloudflare #akamai #bypass

[@grandmat2561]

If cloudflare is correctly setup, you can't access the ip adress directly. This works in extremely précise cases.

[@ItsVaness_official]

There are still ways to bypass that, for example I know about XenForo bypass that will give you real IP. Most of XenForo websites don't know about that, but it's simple.

[@Klinoklaz]

i can still see my server's real ip in email headers. is there a way to set up cloudflare to proxy emails?

[@shazzz_land]

If you do a whois don t u get the home ip?

[@OMNICOMPETENTEST]

Your mic sounds really good (after the video ends)

[@christian84726]

It did not work like this. Cloudflare proxy is in the datacenter of the customer it make a tunnel direktly to the internal ip the webservice did not have a direkt ip in public

[@RahulSinghInfosec]

The video talks about a misconfiguration. If you still have some doubts, I would suggest looking up some reports on H1 and even referring some cloudflare documentation around origin IP misconfiguration. That will help :)

[@christian84726]

@@RahulSinghInfosec thx I will Look at it

[@christian84726]

@@RahulSinghInfosec would u mind if u explain it in more Detail what u means also with h1

[@Roshan12pc]

How can we use it in web scraping

[@samuelkojoquansah8115]

Amazing information

[@Exodus-ze1pr]

if i got the orgin ip and the webpage loads ,so can i report it as a vulnerablity?

[@RahulSinghInfosec]

Yes def. I think it might be eligible for a bounty as well. I have seen a report on h1 which showed origin ip and waf bypass

[@Exodus-ze1pr]

@@RahulSinghInfosec Bro i reported it and got 100$ bounty

[@shazzz_land]

​@@Exodus-ze1prseriously? for just finding out the real ip of the server?

[@shazzz_land]

​@@RahulSinghInfosecwhat other entry level bounty hunting things are there besides revealing true ip?

[@shazzz_land]

​@@Exodus-ze1pra digital bounty should be of a minimum of 1k

[@AliAhmed-gu6wy]

Can I talk to you

[@soufianeloua]

how to contact u ?

[@Audionic1]

?

[@Scorpion_Yug]

Meow 😂

[@miask8965]

despite being indian i liked your vídeo

[@raf3da1st]

🙄