CF-Hero

该介绍目前仅提供英文版本。

🕵️ Project Overview

CF-Hero is a comprehensive reconnaissance tool specifically designed to discover the real IP addresses of web applications protected by Cloudflare. It leverages multiple intelligence sources and advanced techniques to perform multi-source intelligence gathering, helping security researchers and penetration testers identify origin servers behind Cloudflare’s protective layer.

⭐ Core Features

• 🔍 Multi-Source Intelligence Gathering

  • ZoomEye search engine integration
  • Censys search engine support
  • Shodan historical data analysis
  • SecurityTrails historical DNS records

• 📊 DNS Reconnaissance

  • Current DNS records analysis (A, TXT)
  • Historical DNS data examination
  • Associated domain discovery
  • Active DNS enumeration

• 🌐 Advanced Detection Methods

  • Subdomain correlation techniques
  • Response analysis validation
  • Header manipulation testing
  • False positive minimization

• ⚡ Performance & Customization

  • Multi-threaded worker support
  • Custom JA3 fingerprinting
  • HTTP proxy support
  • Configurable request methods

🛠️ Technology Stack

Core Technology

• Go - 100% Go language implementation
• Multi-threaded - Concurrent processing capabilities
• API Integration - Multiple OSINT platform connectors

Supported Intelligence Sources

• ZoomEye - Cyberspace search engine
• Censys - Internet-wide scanning platform
• Shodan - Internet of Things search engine
• SecurityTrails - Historical DNS data provider

🚀 Quick Start

Installation Requirements

# Requires Go 1.18 or higher
go install -v github.com/musana/CF-Hero/cmd/cf-hero@latest

Basic Usage

# Scan from file
cf-hero -f domains.txt

# Scan from stdin
cat domains.txt | cf-hero

# Enable verbose output
cf-hero -f domains.txt -v

Advanced Scanning Options

# Include multiple intelligence sources
cf-hero -f domains.txt -zoomeye -censys -shodan -securitytrails

# Target-specific domain scanning
cf-hero -td https://example.com -dl subdomains.txt

# Custom configuration
cf-hero -f domains.txt -w 32 -ua "Custom-Agent" -px "http://127.0.0.1:8080"

🔧 Configuration Setup

API Keys Configuration

Create configuration file: ~/.config/cf-hero.yaml

zoomeye:
  - "your_zoomeye_api_key"
securitytrails:
  - "your_securitytrails_api_key"
shodan:
  - "your_shodan_api_key"
censys:
  - "your_censys_api_key"

Command Line Options

# General Options
-w int         Worker count (default 16)
-f string      Input file containing domains
-v             Enable verbose output
-title string  Specify HTML title to match

# Source Options
-censys          Include Censys scanning
-securitytrails  Include SecurityTrails records
-shodan          Include Shodan data
-zoomeye         Include ZoomEye search
-dl string       Domain list for subdomain scanning
-td string       Target domain for analysis

# HTTP Configuration
-hm string   HTTP method (default "GET")
-ua string   User-Agent string
-px string   HTTP proxy URL
-ja3 string  Custom JA3 fingerprint

🔍 Detection Methodologies

1. DNS Analysis

┌──────────┐    ┌─────────┐
│  Domain  │───►│ Check A │
│          │    │ Records │
└──────────┘    └────┬────┘
                     │
      ┌──────────────┘
      ▼
┌─────────────┐
│Is it behind │  YES  ┌──────────────────────────┐
│ CloudFlare  │──────►│  Check from various      │
└─────────────┘       │  intelligence sources   │
                      └──────────────────────────┘

2. OSINT Intelligence

• Historical Records: Discover IPs before Cloudflare protection
• Search Engine Data: Leverage Shodan, Censys, ZoomEye databases
• Continuous Monitoring: Track changes in asset configurations

3. Subdomain Correlation

# Multiple subdomain IP discovery
blog.example.com    [123.45.67.89]
api.example.com     [123.67.45.98]
tools.example.com   [123.44.55.66]
admin.example.com   [33.44.123.45]

# Test with Host header manipulation
GET / HTTP/2
Host: main.example.com

4. Response Validation

• Compare HTTP responses
• Analyze HTML content similarity
• Validate server fingerprints
• Minimize false positives

📊 Output Filtering

Domain Classification

# Show only Cloudflare-protected domains
cf-hero -f domains.txt -cf

# Show only non-Cloudflare domains
cf-hero -f domains.txt -non-cf

# Smart coloring for easy identification
# Yellow = Non-Cloudflare IPs (targets for testing)

🎯 Use Cases

• Penetration Testing - Identify real origin servers
• Security Research - Study Cloudflare bypass techniques
• Red Team Operations - Reconnaissance and target analysis
• Bug Bounty Hunting - Discover hidden attack surfaces
• Infrastructure Mapping - Map organizational assets

🔒 Ethical Considerations

• Educational Purpose - Designed for security research and education
• Responsible Disclosure - Follow responsible vulnerability disclosure
• Legal Compliance - Ensure compliance with local laws and regulations
• Permission Required - Only test systems you own or have permission to test

📊 Project Statistics

• ⭐ 1.4k+ GitHub Stars
• 🍴 113 Forks
• 🐛 2 Open Issues
• 👥 10 Watchers
• 🏷️ 3 Releases
• 💻 Go 100%

📈 Roadmap

Planned Features

• Favicon Search - Additional fingerprinting methods
• Enhanced Validation - Improved accuracy algorithms
• Additional Sources - More intelligence platform integrations
• Automated Reporting - Structured output formats

⚠️ Important Disclaimers

• Legal Usage Only: This tool is intended for legitimate security testing and research
• API Limitations: Intelligence sources have rate limits and quotas
• Accuracy Notice: Results should be validated through additional testing
• Responsible Use: Always obtain proper authorization before testing

🤝 Contributing

Contributions are welcome in various forms:

• New intelligence source integrations
• Detection method improvements
• Bug reports and fixes
• Documentation enhancements
• Performance optimizations