Cloudflare takeovers

[aiblade]

Hi,

Wondering if anyone has pulled off a cloudflare takeover? If so, did you go about automating the process, and how?

Thanks :)

[indianajson]

Please see Issue #10 for more details, but the short answer is that doing a targeted takeover is extremely difficult or impossible (thus it is labeled an Edge Case). While there are thousands of vulnerable domains on Cloudflare you can't automate which ones you takeover at the moment.

[aiblade]

Yep gotcha... is it easy to automate account creation (and repeat until you get a match) or did you find this tricky to do?

[indianajson]

I didn't try to automate account creation, but I manually created about a dozen accounts, then just grabbed the global API key for each account and added them to a Python script that looped through them.

The problem at the moment surrounds the fact that each account gets a specific pair of nameservers when it's created (say Jane and Jack), but if you attempt to add a domain it doesn't like your account will suddenly have a new pair (Bob and Bridget). There's no way to currently predict which NS pair will be assigned or re-assigned to your account which means random takeovers are possible, but targeted takeovers are insanely difficult and fully chance based.