I have been running into heaps of websites that run through a cloudflare proxy, which stops me from being able to see service versions after i am unable to find a vulnerability in the website itself.
Tried doing DNS lookups but it doesn't tend to reveal the origin IP of the server.
Does anyone know a good way at getting around this?
PS. still new-ish to web hacking.
Edit: Thanks for the replies, old DNS lookups, SSRF callback and possibly service headers leaking the origin IP look like its worth trying for anyone reading this later on.
this is borderline impossible, try another target, or attack the backend/api
Not imposible at all actually. The most efficient way of doing this is to look for old DNS lookups as well as different subdomains. If you want to attack a company but cloudflare is in the way, look for subdomains first that maybe dont run through cloudflare. Old NS records are the best way of doing this though. In my experience Shodan often times keeps old ND addresses, meaning if they had their domain connected to the original IP at some point and later decided to use cloudflare, you could find something like this. Thats unlikely though. If your question was whether there is any way to literally detect an IP through cloudflare the honest answer is probably no. Unless you could somehow connect the server back to you per SSRF its not looking good. Before attempting to do that you might want to either choose a different target or target a more high level approach.
change useragent and a clean ip adresssess disable javascript because cloudflare hes does some shity things inside the browser using js
dont use leaked tools, change them cloud flare he can understand how scanning crawling things works in requests
subdomain enumerate and then get ip history is the only external way
maybe try finding subdomains with assetfinder, sublist3r or subfinder and run dns lookups all of them. if you couldnt find origin IP from that, than find another website.