CloudFlair vs WeirdAAL
GitHub Stats
About CloudFlair
CloudFlair is a tool for finding origin servers of websites protected by Cloudflare, using Internet-wide scan data from Censys. When a website uses Cloudflare as a reverse proxy, the actual origin server's IP address is hidden. CloudFlair works by searching Censys for IPv4 hosts that present an SSL certificate associated with the target domain, then checks each candidate to see if it responds with the same content as the Cloudflare-protected site. This technique is effective because many administrators configure SSL certificates on their origin servers that match the domain they're protecting, but forget to restrict direct IP access. It's a valuable tool for penetration testers looking to bypass Cloudflare's WAF and DDoS protection.
About WeirdAAL
WeirdAAL (AWS Attack Library) is a Python framework for offensive testing of Amazon Web Services environments. It organizes AWS attacks into categorized modules covering enumeration (listing resources, permissions, and configurations across services), exploitation (abusing misconfigurations and excessive permissions), and persistence (creating backdoor access). WeirdAAL supports testing across a wide range of AWS services including IAM, EC2, S3, Lambda, STS, CloudTrail, and many others. Each module performs a specific action - from enumerating all S3 buckets and their ACLs, to checking for privilege escalation paths through IAM policy misconfigurations, to creating persistence mechanisms via Lambda backdoors. WeirdAAL uses boto3 and works with standard AWS credential configurations, making it easy to test with compromised or provided access keys.
Platform Support
Tags
CloudFlair only
WeirdAAL only