Automate and finds the IP address of a website behind Cloudflare
Hello Fellow Hackers, today i want show you how to automate the discovering of origin IP of those sites behind CloudFlare, using Censys and CloudFlair tool.

Why this ?
Cloudflare is a global network designed to make everything you connect to the Internet secure, private, fast, and reliable. Cloudflare is a reverse proxy, cdn, load balancer, waf and so on… For Bounty Hunters is useful to try to discover the origin IP of any site behind CloudFlare to evade WAF !
Sometimes you can’t get to work a XSS payload due to CloudFlare WAF, so if we discover the origin IP our way to heaven will be easier because we bypass CloudFlare entirely !

Before to start, first you need to register an account on Censys (https://search.censys.io) and get your APIs.
Then get CloudFlair tool: https://github.com/christophetd/CloudFlair
Let’s start !
# Run Nuclei on subdomains
nuclei -list subdomains.txt -o nuclei_results.txt -c 2
# Extract cloudflare protected hosts from nuclei output
cat nuclei_results.txt | grep ":cloudflare" | awk '{print $(NF)}' | sed -E 's/^\s*.*:\/\///g' | sed 's/\///'g | sort -u > cloudflare_hosts.txt
# Try to get origin ip using SSL certificate (cloudflair and censys)
while IFS='' read -r DOMAIN || [ -n "${DOMAIN}" ]; dopython3 cloudflair.py $DOMAIN --censys-api-id YOUR_API_ID --censys-api-secret YOUR_SECRET | tee -a origin_IPs.txtdone < cloudflare_hosts.txt