Skip to main content

Questions tagged [cloudflare]

Cloudflare is a Content Delivery Network (CDN).

Filter by
Sorted by
Tagged with
0 votes
1 answer
48 views

Where to host custom catch-page Cloudflare?

Cloudflare offers the option to show your own custom catchpa-validation page instead of the standard page with the Cloudflare logo. You do this by making a HTML file with the ::CATCHPA_BOX:: ...
O'Niel's user avatar
  • 2,916
1 vote
0 answers
62 views

ECDSA certificates not impacted by Let’s Encrypt certificate chain change?

We received an email from Cloudflare about the upcoming Let’s Encrypt certificate chain change. At some point, it states that "Additionally, this change only impacts RSA certificates. It does not ...
Vic Seedoubleyew's user avatar
0 votes
1 answer
334 views

Why can't we encrypt twice instead of having Cloudflare MITM half the internet?

First of all I want to address a thought I had which is that they might market their ability to read the encrypted code being sent so they can spot "bots" and such, and that this is why they ...
Henrik F's user avatar
0 votes
2 answers
240 views

Why does turning on encrypted DNS unblock some geo locked websites?

When I turn on Warp provided by Cloudflare or use 1.1.1.1, it unlocks some of the websites which are geo locked. How does it unblock the websites which are blocked by ISP?
jinchuriki's user avatar
0 votes
0 answers
103 views

2 network tunnels from 2 providers to 1 machine running docker, will this expose all containers on both tunnels?

I have a server running multiple docker containers, accessible through tunneling. I want to create a new tunnel that is separate from the one I already have. Will the new tunnel service interfere or ...
Maize's user avatar
  • 1
21 votes
2 answers
5k views

Which IP address would be most safe and suitable to use as a placeholder in a live system?

Is there a best practice IP address that is safe to use as a placeholder in a live public system on the Internet? e.g. In a similar capacity, the domain name example.com is reserved and can be safely ...
BadHorsie's user avatar
  • 385
2 votes
0 answers
1k views

Checking IP's reputation on CloudFlare and Google [closed]

Google and CloudFlare have recently indicated that my home IP address is contributing to a DDoS or spam network. I am frequently being checked (What is the website checking about my browser to protect ...
Peter Becich's user avatar
0 votes
1 answer
548 views

Cloudflare not hide VPS IP (ngnix)

I have a problem with hiding the VPS IP using Cloudflare. My IP can be found on search.censys.io. I don't have any DNS leaks. I'm using nginx to reverse proxy a node.js server. Is it possible to hide ...
MomboteQ's user avatar
0 votes
0 answers
64 views

"needs to review the security of your connection before proceeding.": What security check is that? [duplicate]

From time to time, when browsing a website I see the following message: [Webpage URL] needs to review the security of your connection before proceeding. What kind of security check on my connection ...
Franck Dernoncourt's user avatar
1 vote
2 answers
2k views

How bad it is to open qBittorrent web UI port

I have small home server that runs a qBittorrent in docker container, and I was wondering how bad/risky it is if I'd forward the port for the web UI so I can access it from outside my network. I know ...
Razero's user avatar
  • 111
0 votes
1 answer
1k views

What happens if both DoH and DoT are enabled?

If I have DNS over HTTPS and DNS over TLS activated simultaneously (router has DoT activated and smartphone browser has DoH activated, so I see on https://1.1.1.1/help DoH: yes and DoT: yes), which ...
iwab's user avatar
  • 181
1 vote
1 answer
10k views

Any Cloudflare's DNS over TLS (DoT) check + DNSSEC test?

In my original question from 2020, I was unsuccessful in my effort to setup Cloudflare's (link to docs) DNS over TLS (DoT) (link to wiki) in my old, and now decomissioned, router: Does Cloudflare'...
Vlastimil Burián's user avatar
0 votes
1 answer
1k views

Cloudflare SQLinjection protection

I'm testing for vulnerabilities for a specific site using sqlmap. However, the site has a cloudflare firewall which blocks queries including for example *, ANY or OR. I sort of found a bypass while ...
nonetype's user avatar
1 vote
0 answers
104 views

How are DDOS protection mechanisms setup when confidential data is involved?

Scenario: A hospital has the records of all patients. There is an online portal where patients can login to see their personal medical data. Since a hospital is an obvious target for any type of hack, ...
groundwine's user avatar
1 vote
2 answers
2k views

Bypass WAF to perform XSS?

I am trying to find an XSS in website protected by Cloudflare. I use Burp to find which HTML tags allowed. Only the <script/> is tag disallowed. I tested multiple payloads to pass the WAF and ...
Qassam Mahmoud's user avatar
0 votes
1 answer
825 views

My ISP seems to be intercepting my DNS requests even though my router is set to use Cloudflare [duplicate]

I am using an Indian ISP, one that is notorious for DNS hijacking and script injection (BSNL). I have my router set to use Cloudflare's Family DNS. But despite this, every time I attempt to access a ...
ShankarG's user avatar
  • 101
0 votes
0 answers
34 views

What are the benefits of using a Cloudflare's DNS (not WARP) instead of ISP's DNS? [duplicate]

What advantages users get, specifically, from 'PRIVACY' point-of-view? Can ISP still see and log browsing history? Can user's location be still traceable? What's the ultimate security & privacy ...
Sven T's user avatar
  • 11
16 votes
2 answers
6k views

Is cloudflare injecting tracking code for PDF requests in browsers via the browser PDF plugin?

Opening a PDF link in the browser (e.g. google chrome with the ootb PDF viewer plugin) apparently indicates that when the PDF is hosted on a cloudflare-facing domain there is additional data present ...
ccpizza's user avatar
  • 301
0 votes
2 answers
196 views

Can wide IPv6 adoption make technologies like ECH obsolete?

Encrypted Client Hello (ECH) encrypts the whole Client hello and because of that ISPs won't know which website any given user intends to visit unless the website is using a dedicated IP address and ...
Pooya Estakhri's user avatar
0 votes
1 answer
227 views

pfsense subdomain timeout with error 522

I want to attach a valid ssl subdomain to my pfsense. I would check it (with warnings) via my the pfsense's IP 192.168.11.1 . I used multiple tutorials to come up with the following: Bought a domain ...
SILENT's user avatar
  • 166
0 votes
2 answers
425 views

No SSL between Cloudflare and S3 static site. A big security issue?

So I have a S3 static website. Domain, DNS and proxy is managed via Cloudflare. Cloudflare is set to communicate with browsers using SSL and it in fact enforces SSL for non-SSL requests. However, ...
marko-36's user avatar
  • 101
12 votes
4 answers
4k views

Webserver DDOS protection without giving away private keys (https, tls, ssl)

What are the possible ways to protect an organization's web servers from a DDoS attack without giving away your web server's https private keys? Many of the common solutions for DDoS protection of a ...
Michael Altfield's user avatar
2 votes
1 answer
378 views

Rate Limit DNS Subdomain Requests

I work at a company that provides a SaaS program for other organizations, and each subscribed organization receives their own subdomain of their choosing - generally they choose the organization name. ...
Daryl1976's user avatar
  • 123
1 vote
0 answers
144 views

Is using randomized filenames a good way to secure data stored in a product like S3?

If I want to use a S3 clone to host something somewhat sensitive (probably digitalocean, since it's cheapest and probably has a perfectly good quality), is it sensible to do it this way: https://...
john01dav's user avatar
  • 225
1 vote
2 answers
1k views

Does Cloudflare's DNS over TLS (DoT) implement DNSSEC too?

I am confused about if I decided to implement DNS over TLS (DoT), would I lose DNSSEC? Details: I am connected with IPv4 + IPv6 Cloudflare DNS directly in my home OpenWrt router. I love the idea of ...
Vlastimil Burián's user avatar
8 votes
1 answer
9k views

What does using Cloudflares WARP app offer that HTTPS (websites) alongside DNS over HTTPS / TLS doesn't?

Intoduction to Cloudflare WARP I’ve been looking at Cloudflares WARP app for mobile. It claims to be a VPN but without some of the IP hiding anonymity features normal VPNS have: “Under the covers, ...
SneakyShrike's user avatar
2 votes
3 answers
3k views

Security implications of Cloudflare's SSL Full mode (not Strict)

Cloudflare enables several options regarding the communication between its servers and our own. "SSL Full" means Cloudflare encrypts the traffic but doesn't check the validity of our servers'...
Vic Seedoubleyew's user avatar
-1 votes
1 answer
555 views

CDN end to end encryption?

I setup Cloudflare CDN for my site. I added my site to Cloudflare and it asked me to add Cloudflare nameserver to my domain. I did that in my DNS registrar portal. That's all I did. Now I'm able to ...
Mani Bharathy's user avatar
2 votes
1 answer
262 views

Seems my CNAMEs got "curled". Somebody please explain this to me

According to my CloudFlare firewall logs, somebody went through each of my subdomains. My website is not advertised, it doesn't even show on Google unless typing the exact domain name into it. I think ...
Mere Mortal's user avatar
0 votes
1 answer
359 views

Cloudflare Full Strict HTTPS flow

I would like to understand Cloudflare full(strict) SSL flow. Because if user type https://example.com it redirects to Cloudflare web servers. So how Cloudflare decrypt HTTPS data before sending to ...
aze2201's user avatar
  • 113
0 votes
2 answers
1k views

Is using Cloudflare, and other services that proxy your site, a security hazard?

If I understand correctly, they can see all the requests that are coming in to your server. So, all POST requests (user credentials, comments user posts, and many more) can be seen by Cloudflare (...
Tomas 's user avatar
  • 13
1 vote
0 answers
116 views

How do you mitigate the risk of stolen unencrypted data because you are using Cloud DNS to proxy the request that are sent to your server?

Goal My goal is to build a PWA. I am new to programming and I believe it is better to start with NGINX. I have not found a good article (explaining the security risk) about using the Cloud DNS (such ...
Jason Rich Darmawan's user avatar
3 votes
0 answers
270 views

How does Cloudflare negotiate its server certificate?

When I access https://example.com on my company's laptop that has a X509 client certificate installed, using my home internet connection, without using a VPN, the requested page is signed using the ...
Lemon Sky's user avatar
  • 185
5 votes
2 answers
871 views

Does Cloudflare masking my IP make my server more secure?

I've heard in a conversation and read in some forum posts that Cloudflare will proxy your IP, hiding it from the public, and this mitigates the risk of an attacker finding your server in the first ...
TCooper's user avatar
  • 366
2 votes
1 answer
3k views

Is there any way to pretend like we are routing our request via cloudflare? [closed]

There is this Web App which uses cloudflare and to bypass certain things I had to find a way to access the actual web server directly. I tried numerous things and finally I think I have found the ...
John's user avatar
  • 21
3 votes
4 answers
4k views

How do I configure Azure Web Apps so that the only access is via CloudFlare?

I have a Web Apps (Linux) application on Azure, and I added a custom domain which I have protected with CloudFlare. I added Azure Security Center to my subscription. At the moment one can access the ...
gordon613's user avatar
  • 291
8 votes
2 answers
1k views

Does cloudflare protect against BREACH attacks?

I know that enabling http compression would make a server vulnerable to the BREACH attacks. So we have disabled compression from the server side, tested and it was all good. Then we implemented ...
Anonymous Platypus's user avatar
-2 votes
2 answers
368 views

Did I just find a bug in CloudFlare or is this a feature?

While doing penetration testing for a client I stumbled upon a security incident. CloudFlare promises to hide the origin IP address when using its DNS. I went to dnsdumpster.com, inputted my client's ...
Sir Muffington's user avatar
3 votes
2 answers
557 views

How do I prevent traffic on my site from a source other than Cloudflare?

I use Google Cloud Platform to serve the site I manage. I have one load balancer there, which controls the movement to several virtual machines. When I came across the problem of DDOS attacks on ...
simhumileco's user avatar
0 votes
0 answers
1k views

Requests logged in Cloudflare as "XSS, HTML Injection - Body"

Rule name: XSS, HTML Injection - Body Rule: 100096BHTML Since about a week ago, requests matching this WAF rule have strongly increased on a customer's website. This is an example graph showing only ...
hey's user avatar
  • 111
2 votes
2 answers
1k views

Can't Cloudflare sniff sensitive login data from its users' websites?

So I recently started using the free Cloudflare plan for my website to provide any sort of protection. And I noticed that, given they do the whole "We'll accelerate your website by caching parts of ...
TheFuzzyFish's user avatar
1 vote
0 answers
184 views

Bot detection without client script

I am working in a small startup and we are looking for Security tools - mostly WAF and Bot Detection (specifically to identify click fraud). Some solutions that integrate client side scripts are ...
achie's user avatar
  • 111
1 vote
1 answer
3k views

How to verify website owner behind CloudFlare SSL?

I went to Bittrex today and noticed the SSL certificate is issued to CloudFlare, not Bittrex, as seen in the screenshot below. I'm used to seeing information on this screen which can be recognized as ...
rkagerer's user avatar
  • 113
1 vote
2 answers
224 views

Could the use of Cloudflare's free SSL feature result in loss of availability?

When using Cloudflare's free shared SSL feature, the certificate for your website is shared with dozens of others websites via the use of SANs (Subject Alternate Names). Of course some of these ...
rubberband876's user avatar
3 votes
1 answer
717 views

Why is TLS1.2 wrapped in TLS1.3?

I was just curious about TLS1.3 which Cloudflare is one of the companies leading the implementation. I then visited blog.cloudflare.com and turned on my Wireshark. I am not 100% clear about all ...
匿名柴棍's user avatar
0 votes
1 answer
126 views

CentOS payload injection attempts? [duplicate]

My PHP logs have been flooding with seemingly random attempts to access scripts and software which isn't installed on my server. At first, All the attempts came from a single IP, I was using ...
DireDoesGames's user avatar
1 vote
0 answers
342 views

health check to test haproxy -- request deny with 200. good idea?

I have been working on a multi-provider redundant load balancing solution using HAProxy, AWS, and Cloudflare. I have a solution, and I believe it will be secure, but I am looking for further ...
Muradin007's user avatar
2 votes
2 answers
2k views

How does Cloudflare track their client? Tor is not a workaround

I mirrored a ecommerce site using wget. This site seems to use Cloudflare to handle their web traffic. What's interesting is that after 90 % or so of the mirroring was done, wget started to produce/...
d-b's user avatar
  • 489
1 vote
0 answers
182 views

HSTS over HTTP-CDN-HTTPs chain [closed]

I'm using CloudFlare's flexible SSL: Flexible SSL: You cannot configure HTTPS support on your origin, even with a certificate that is not valid for your site. Visitors will be able to access ...
niguhuzal's user avatar
6 votes
1 answer
408 views

How SSL/TLS handshake happens when we use Cloudflare Service?

I was reading about the offerings of the Cloudflare and then I read about the working of Cloudflare. Based on my understanding, the domain name of my website(alice.com) is resolved to the IP address ...
Shiv Sahni's user avatar