(03-18-2013, 05:17 PM)The Alchemist Wrote:

Bypass Cloudflare And Get IP addresses of Forums/Websites And Members

So, enough of using Cloudflare Resolvers to get hidden IP addresses of websites protected by Cloudflare. This method won't need any download.
I'm assuming you're trying this on a forum so that you can understand this tutorial better.
Ok, lets begin. We'll take help from this link :

Code:

http://iplogger.org/getnewid.php

What this site does is, it allows you to see IP addresses of the servers which had accessed the images they'd given you.
Here are the steps :
1. Go to the website.

Code:

http://iplogger.org/getnewid.php

2. Copy the link for the JPEG file that appears on the page. You'll be given instructions on the page about what to do and what not to do. The link for the jpeg looks something like this :

Code:

http://iplogger.org/abc12.jpg

3. Now, go to the User CP of your profile and go to the option for changing your avatar. Here : http://www.hackcommunity.com/usercp.php?action=avatar
4. Now, copy and paste the link you obtained in step 2 in the textbox for the avatar URL and click on the Change Avatar button.
5. As you click on the Change Avatar button, the website server pings the image URL. And as it pings the image URL, the original IP address of the website server gets logged. Don't worry if an error message about the size of the image appears because the work is already done.
6. Now, you can easily obtain the original IP address of the website from iplogger.org(In step 2, I'd told you to read the instructions carefully)
7. Done, now you have the IP address of that forum.
Use a little bit of your brains and you can get IP addresses of websites that are not forums too.
Not enough?
With the same website and a similar technique, you can get the IP address of members of that forum.
Here are the steps :
1. Go to the website.

Code:

http://iplogger.org/getnewid.php

2. Copy the forum code for the JPEG file that appears on the page and as I'd said earlier, read the instructions carefully. The code looks some thing like this.

Code:

[img]http://iplogger.org/abc12.jpg[/img]

3. Now, its very simple, post it in your comment to any thread. Anyone who views the page with your comment, that person's IP address gets logged in iplogger.org.
4. OR, if you want to get the IP address of a particuar member of that forum, send that member a Private Message which contains the code shown in step 2. As the receiver opens his PM inbox, that person's IP address gets logged.
5. Now, you'll have IP addresses of hackers from forums too.
It took me some time to make this tutorial for you guys.
Hope you like it.
~The Alchemist
FEEDBACK WOULD BE HIGHLY APPRECIATED!!!

(03-18-2013, 05:29 PM)Linuxephus Wrote: That my fine feathered friend is a very clever means of obtaining such information for those who would rather keep it hidden.
However, for me personally, I appear to be the only idjit who has no problem merely and quite blatantly posting my own IP Address with-out hesitation.
So my question for you at least would be:
Why do I do that with-out a second thought?

(03-18-2013, 06:16 PM)The Alchemist Wrote: Well, I see that my friend whose username is illuminated with Golden bulbs and the owner of a medieval sword has something unique in him.
I advise you not to post your own IP address without hesitation because I've seen noobs only looking for ways of DDOSing. And, there are people who can do stuff with metasploit if they have your IP address.

(03-18-2013, 06:31 PM)Linuxephus Wrote: And I see my friend with the color of the Green Lantern Authority Of Staff -- yes, I'm guilty of watching the animated series on Cartoon Network...it's my son's fault:yes: -- is indeed correct on all counts as listed.
DDOSing only being effective on a system not properly protected from such.
Metasploit being effective only on improperly patched systems.
Thus far in my deliberately unique nonchalance on the subject, I've yet to have any of those well known exploits used in a manner that I would be concerned about.
Notwithstanding, the two tools/methods you've listed are among several that logic dictates the majority would use first and foremost.
Thus does that breed what is to be expected.
And I figure there were/are several who have sought to gain my IP Address for whatever amusing reason, so why not give freely so state I brother.
After all, it's not impossible to obtain that kind of information when any is of a mind to, even here in this Community.
As you've very well demonstrated with this very good thread in and of itself.

(03-18-2013, 06:35 PM)zomgwtfbbq Wrote: Nice, I use a similar technique but with php GD. The idea is to log the ip-address in the php script that creates the image. This however is much quicker, thanks!

(03-19-2013, 07:57 AM)The Alchemist Wrote: I'm a complete noob when it comes to PHP GD(not PHP). Would you mind sharing some snippets of your technique? You'd stated that the process I shared is quicker, but I'd wanna have a look at your snippet too. Its never a waste to learn something new.

(03-19-2013, 01:09 PM)The Alchemist Wrote:

Spoiler:

(03-19-2013, 12:54 PM)zomgwtfbbq Wrote: Had to rewrite one from scratch as it's on one of my laptops, but since it's not too much effort..here's what you need.

You will need four files, all in the same folder:
- .htaccess (image.php > image.jpg)
- log.txt (logs the ip address and other stuff you want to log)
- someimage.jpg (the real image)
- image.php (creates the image based on someimage.jpg)

.htaccess

Code:

RewriteEngine On RewriteRule ^image\.jpg$ image.php

image.php

PHP Code:

<?php // locations $sSourceImage = "someimage.jpg"; $sLogFile = "log.txt"; // data string you want to log $sLogEntry = $_SERVER['REMOTE_ADDR']."|".date('d-m-Y H:i:s',time())."\n"; // log the request $rConnect = @fopen($sLogFile,"a"); @fwrite($rConnect,$sLogEntry); @fclose($rConnect); // create the image stream and send the header $rImage = @imagecreatefromjpeg($sSourceImage); header('Content-type: image/jpeg'); @imagejpeg($rImage); @imagedestroy($rImage); ?>

rest of the files:
- someimage.jpg (any image you like)
- log.txt(just name a file like that)

Make sure you have url_rewriting enabled and that the GD extension is loaded. Also name the htaccess file .htaccess, not htaccess.txt for example.

So, the .htaccess file is the main key behind this. Just one doubt, in my tut, I'd to share a link thats like this :

Code:

http://iplogger.org/imagename.jpg

For, your code, the URL I'll be using will be http://mysite.com/folder/image.jpg and not http://mysite.com/folder/image.php right??
Anyways, thanks a lot for sharing the script. It really means a lot to me.