5 ms·

To me it looks like this tool (and cloudflair.py) can only ever find servers which are configured in a very specific way: * The traffic between server and CDN

To me it looks like this tool (and cloudflair.py) can only ever find servers which are configured in a very specific way: * The traffic between server and CDN is encrypted using a valid certificate * The server's firewall is not properly configured Apparently there are indeed servers with this configuration, but I just find it odd how someone would go through the trouble of setting up HTTPS (instead of terminating it at the CDN) and then not bother to block traffic from anywhere but the CDN.

rdl 7y ago
Could be a shared hosting platform behind the CDN where the user doesn't have the ability to ip-acl but does have https. Common among low-end users and in the particular case of a "hidden" site, easily purchased cheap VPSes which are de facto anonymous.
throwaway744678 7y ago
Imagine someone with a fully configured HTTPS web server (without a front CDN), that adds Cloudflare in front of it when the load gets higher, and does not bother configuring their firewall.
- dalbotex 7y ago
  Yeah, that does sound plausible.
latchkey 7y ago
> then not bother to block traffic from anywhere but the CDN How can you find that odd when there are so many mongodb instances on the open internet?
- dalbotex 7y ago
  Because I imagine someone who would expose their mongodb instance to the web would also just terminate HTTPS at the CDN, rendering curryfinger/cloudflare.py useless.
alexhornbake 7y ago
Someone wants to lower their cdn bill, so they serve static things on cdn, and dynamic things from origin.
CapacitorSet 7y ago
>I just find it odd how someone would go through the trouble of setting up HTTPS (instead of terminating it at the CDN) At least wrt CloudFlare, it's actually recommended - for privacy reasons, at least so they claim - that you run SSL both between client and CDN, and between CDN and server: https://support.cloudflare.com/hc/en-us/articles/200170416-End-to-end-HTTPS-with-Cloudflare-Part-3-SSL-options#h_4e0d1a7c-eb71-4204-9e22-9d3ef9ef7fef https://support.cloudflare.com/hc/en-us/articles/200170416-E...
- penagwin 7y ago
  Uhh they recommend it so the traffic between your server and cloudflare isn't unencrypted over HTTP

rdl 7y ago

Could be a shared hosting platform behind the CDN where the user doesn't have the ability to ip-acl but does have https. Common among low-end users and in the particular case of a "hidden" site, easily purchased cheap VPSes which are de facto anonymous.

throwaway744678 7y ago

Imagine someone with a fully configured HTTPS web server (without a front CDN), that adds Cloudflare in front of it when the load gets higher, and does not bother configuring their firewall.

dalbotex 7y ago
Yeah, that does sound plausible.

latchkey 7y ago

> then not bother to block traffic from anywhere but the CDN How can you find that odd when there are so many mongodb instances on the open internet?

dalbotex 7y ago
Because I imagine someone who would expose their mongodb instance to the web would also just terminate HTTPS at the CDN, rendering curryfinger/cloudflare.py useless.

alexhornbake 7y ago

Someone wants to lower their cdn bill, so they serve static things on cdn, and dynamic things from origin.

CapacitorSet 7y ago

>I just find it odd how someone would go through the trouble of setting up HTTPS (instead of terminating it at the CDN) At least wrt CloudFlare, it's actually recommended - for privacy reasons, at least so they claim - that you run SSL both between client and CDN, and between CDN and server: https://support.cloudflare.com/hc/en-us/articles/200170416-End-to-end-HTTPS-with-Cloudflare-Part-3-SSL-options#h_4e0d1a7c-eb71-4204-9e22-9d3ef9ef7fef https://support.cloudflare.com/hc/en-us/articles/200170416-E...

penagwin 7y ago
Uhh they recommend it so the traffic between your server and cloudflare isn't unencrypted over HTTP