CloudFlare Origin IP Discovery for Penetration Testing

A script for finding a domain's real origin IP addresses via the Cloudflare API.

When a target sits behind Cloudflare, the DNS records visible to the public only show Cloudflare’s proxy IPs. If you have API access to the Cloudflare account (for example, during an internal or credentialed engagement), you can query the zone’s DNS records directly to see the real origin IPs behind any non-proxied (“grey cloud”) entries.

1
zones=$(curl -s -X GET "https://api.cloudflare.com/client/v4/zones" \
2
  -H "Authorization: Bearer YOUR_API_TOKEN" \
3
  -H "Content-Type: application/json" | jq -r '.result[] | "\(.id) \(.name)"')
4

5
while read -r zoneid zonename; do
6
  echo "== $zonename =="
7
  curl -s -X GET "https://api.cloudflare.com/client/v4/zones/$zoneid/dns_records" \
8
    -H "Authorization: Bearer YOUR_API_TOKEN" \
9
    -H "Content-Type: application/json" | jq -r '.result[] | "\(.type) \(.name) \(.content) \(.proxied)"' | grep "A "
10
done <<< "$zones"

Treat the API token like any other credential: scope it to the minimum permissions needed (DNS read), and never commit it to a script or repository.