# spyboy-productions/CloakQuest3r

Open-source security research tool for identifying origin IP exposure of websites protected by Cloudflare and similar reverse proxy services.

Repository: https://github.com/spyboy-productions/CloakQuest3r
Canonical: https://ross.abutalabs.com/products/cloakquest3r
Homepage: https://colab.research.google.com/github/spyboy-productions/CloakQuest3r/blob/main/cloakquest3r.ipynb
Language: Python
License: MIT
License Family: permissive
Topics: bypass-cloudflare, bypass-hostname, bypass-waf, dnssec, exploit, information-gathering, osint-tool, pentesting-tools, subdomain-scanner, cloudflare, subdomain-ip, ip-history, ssl-certificates, ssl-certificate-analysis, dns-analysis, dns-history, cloudflare-ip
Last push: 2026-01-06T19:57:54+00:00

## Health v2 (maintenance only)
Score: 54/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 61, release rhythm 35, longevity 73
- inputs: {"age_days": 1035, "days_push": 239, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 2250, forks 301 (observed 2026-08-28T04:06:30.955793+00:00)

## What it is
CloakQuest3r is a Python-based open-source security research tool that identifies potential origin IP exposure of websites protected by Cloudflare and similar reverse proxy/CDN services. It uses subdomain enumeration and passive analysis techniques (DNS history, SSL certificate analysis) to detect misconfigurations that reveal underlying server infrastructure.

## Use cases
- find the real origin IP behind a Cloudflare-protected website
- check if my subdomains leak the origin server IP
- enumerate subdomains and resolve their IPs during a pentest
- audit DNS history and SSL certificates for exposed infrastructure
- assess whether a WAF or CDN is properly hiding the backend server
- harden my website's infrastructure against origin IP discovery

## When to choose
- you are a penetration tester or security researcher doing authorized reconnaissance on Cloudflare-protected targets
- you are a web administrator auditing whether your own origin servers are exposed
- you need a lightweight Python CLI for subdomain and DNS-based origin discovery

## When to avoid
- you need a full vulnerability scanner or exploitation framework
- you require a GUI or continuous monitoring platform rather than a point-in-time CLI scan
- your target is not behind a reverse proxy/CDN, since the tool's techniques are Cloudflare-focused

## Facets
- artifact type: cli-tool
- maturity: active
- function: osint, security, networking, web-scraping, developer-tools
- domain: security, penetration-testing, osint, networking, web-development
- platform: python, cli, windows, cross-platform
- tags: cloudflare-bypass, origin-ip-discovery, subdomain-enumeration, dns-analysis, pentesting, reconnaissance, waf-bypass, linux, macos

## Member repositories
- spyboy-productions/CloakQuest3r (main) score 54

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:06:30.955793+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T02:43:52.989028+00:00, confidence not recorded.
  - readme: https://github.com/spyboy-productions/CloakQuest3r (fetched 2026-08-28T04:06:30.955793+00:00, sha 34915c333d21)
  - homepage: https://colab.research.google.com/github/spyboy-productions/CloakQuest3r/blob/main/cloakquest3r.ipynb (fetched 2026-08-29T10:24:09.646911+00:00, sha cbaa090f147c)
- Data as of 2026-08-30T08:39:29.467469+00:00.