CF-Hero：突破Cloudflare防护的智能侦察工具

git clone https://github.com/musana/CF-Hero.git

cd CF-Hero

go mod download

go build -o cf-hero main.go

go install -v github.com/musana/cf-hero/cmd/cf-hero@latest

# 扫描单个目标
./cf-hero -d example.com

# 从文件读取多个目标
./cf-hero -f targets.txt

# 使用管道输入
cat targets.txt | ./cf-hero

packagemain

import (
"fmt"
"os"

"github.com/gammazero/workerpool"
"github.com/musana/cf-hero/internal/config"
"github.com/musana/cf-hero/internal/scanner"
"github.com/musana/cf-hero/internal/utils"
)

funcmain() {
fmt.Print(utils.Banner())

options :=config.ParseOptions()
varurls []string
vardomainList []string

ifoptions.File!=""&&options.DomainList=="" {
urls=utils.ReadFromFile(options.File)
} elseifoptions.File==""&&options.DomainList!="" {
urls=append(urls, options.TargetDomain)
domainList=utils.ReadFromFile(options.DomainList)
} else {
fi, _ :=os.Stdin.Stat()
iffi.Mode()&os.ModeNamedPipe==0 {
fmt.Println("[!] No data found in pipe. Urls must be given using pipe or f parameter!")
os.Exit(1)
} else {
urls=utils.ReadFromStdin()
}
}

scanner :=scanner.New(options, urls, domainList)
scanner.PreScan()

wp :=workerpool.New(options.Worker)
for_, url :=rangeurls {
url :=url
wp.Submit(func() {
scanner.Start(url)
})
}
wp.StopWait()
}

packagedns

import (
"net"
"regexp"

"github.com/miekg/dns"
"github.com/projectdiscovery/retryabledns"
)

funcGetARecords(domainstring) ([]net.IP, []net.IP) {
varcfIPs []net.IP
varnonCFIPs []net.IP

ips, _ :=net.LookupIP(domain)
iflen(ips) >0 {
for_, ip :=rangeips {
ifip.To4() !=nil {
result, _ :=IsInCloudflareIPRange(ip)
ifresult {
cfIPs=append(cfIPs, ip)
} else {
nonCFIPs=append(nonCFIPs, ip)
}
}
}
}
returncfIPs, nonCFIPs
}

funcIsInCloudflareIPRange(aIPnet.IP) (bool, net.IP) {
cloudflareRanges := []string{
"173.245.48.0/20",
"103.21.244.0/22",
"103.22.200.0/22",
"103.31.4.0/22",
"141.101.64.0/18",
"108.162.192.0/18",
"190.93.240.0/20",
"188.114.96.0/20",
"197.234.240.0/22",
"198.41.128.0/17",
"162.158.0.0/15",
"104.16.0.0/13",
"104.24.0.0/14",
"172.64.0.0/13",
"131.0.72.0/22",
}

for_, rangeStr :=rangecloudflareRanges {
_, cidr, _ :=net.ParseCIDR(rangeStr)
ifcidr.Contains(aIP) {
returntrue, aIP
}
}

returnfalse, aIP
}

packagehttp

import (
"crypto/tls"
"fmt"
"net"
"net/http"
"strings"
"time"

"github.com/Danny-Dasilva/CycleTLS/cycletls"
"golang.org/x/net/html"
)

funcNewHTTPClient(proxystring, targetURLstring) *http.Client {
transport :=&http.Transport{
DialContext: (&net.Dialer{
Timeout:   30*time.Second,
KeepAlive: 30*time.Second,
}).DialContext,
MaxIdleConns:          100,
IdleConnTimeout:       90*time.Second,
TLSHandshakeTimeout:   10*time.Second,
ExpectContinueTimeout: 1*time.Second,
ResponseHeaderTimeout: 30*time.Second,
DisableKeepAlives:     false,
TLSClientConfig: &tls.Config{
InsecureSkipVerify: true,
},
}

ifproxy!="" {
transport.Proxy=http.ProxyFromEnvironment
}

return&http.Client{
Transport: transport,
Timeout:   60*time.Second,
}
}

funcCheckPort(hoststring, portstring) bool {
timeout :=time.Second*2
conn, err :=net.DialTimeout("tcp", net.JoinHostPort(host, port), timeout)
iferr!=nil {
returnfalse
}
ifconn!=nil {
conn.Close()
returntrue
}
returnfalse
}

cf-hero -f E:\work\SecurityProject\CF-Hero\com.txt
\\-f 配置输入的文件路径，从文件中读取域名