0

I would like to know how one can access a shared webhosted webpage without using the domainname. If i directly access the IP adress I get Apache is functioning normally

I need to access it since the page uses cloudflare and blocks some type of penetration tests, so I need to do it more directly.

0

1 Answer 1

2

It's completely normal that a site is only available with the domain, and it's vital for shared hosting: before the Host: header was added in HTTP 1.1 (RFC 2068, 14.23 from 1997, updated in RFC 7230, 5.4) every site required an own IP address, and before SNI (RFC 6066, 3) it was pretty much the same with HTTPS.

This same Host: header could be used in your situation, where Cloudflare's Web Application Firewall (WAF) is sitting between you and the target server, as you already have the original IP address that's supposed to be hidden behind the WAF. You have two options:

  • Add the Host: header manually with an intercepting HTTP proxy. You are probably already using one, as you are supposed to do some penetration testing.
  • Override the Cloudflare's IP address with the IP address of the destination server. The authoritative DNS servers are configured to give the IP address of the WAF, but you can locally override that e.g. by adding an entry to your hosts file.

Of course this should not be possible if the original server is properly protected i.e. only giving access through Cloudflare. For permitted penetration testing, your IP address should be added to the same whitelist. If this is not the case, please remember to add this in your vulnerability report.

Interesting reading close to the subject: CloudFlair: Bypassing Cloudflare using Internet-wide scan data.

1
  • Thank you, adding the IP and domain to my hosts file got me direct access to the website with the original IP.
    – TakeCare
    Jun 9, 2019 at 22:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .