Fast. Passive. Built for penetration testers and security researchers. Discover hidden infrastructure using external intelligence sources—without sending noisy traffic directly to the target.
- What is CF Finder?
- Who Is It For?
- Who Is It Not For?
- Features
- Supported Intelligence Sources
- Getting Started
- Configuration
- Usage Examples
- Privacy & Security
- Contributing
- License
CF Finder correlates multiple passive intelligence sources to uncover origin candidates without directly engaging the target's primary defenses. It relies on historical DNS records, internet-wide scan data (like Shodan and Censys), and bypassed subdomain brute-forcing.
It then uses a custom scoring engine to evaluate candidates. It checks against dynamically fetched CDN IP blocks (to immediately discard known proxies) and performs safe, memory-bounded HTTP probes with spoofed Host headers to validate the backend.
To ensure efficiency and accuracy, CF Finder maintains and continuously checks a database of public IP ranges used by major content delivery networks (including Cloudflare, AWS CloudFront, Fastly, Akamai, and Sucuri). Any target candidate IP resolving to these blocks is automatically flagged and pruned from the final target results since they represent proxy edge nodes rather than the true host origin.
CF Finder was built specifically for:
- Penetration Testers — Identify backend servers during authorized assessments to bypass WAFs and edge protections.
- Bug Bounty Hunters — Uncover misconfigured infrastructure leaking the true origin IP.
- Security Engineers — Audit your own external footprint to ensure your origin servers aren't exposed to the public internet.
- Malicious Actors — This tool is strictly intended for authorized security assessments.
- Automated Scanning Botnets — CF Finder is a precision tool designed for targeted investigation, not blind internet-wide exploitation.
| Feature | Details |
|---|---|
| Multi-Source Correlation | Cross-references Shodan, Censys, and SecurityTrails data for high-confidence matches. |
| Concurrent Probing | HTTP probes run concurrently, while API queries run sequentially with rate-limit protections. |
| Memory-Safe Validation | HTTP probes are capped at 4KB streams to prevent "memory bombs" from malicious tar-pits. |
| Dynamic CDN Filtering | Automatically fetches live IP ranges for Cloudflare, CloudFront, Fastly, and Akamai to prune candidates. |
| Scoring Engine | Candidates are ranked based on TLS SAN matches, response bodies, and source overlap. |
| Web Interface (Flask/SSE) | Sleek Bootstrap 5.3 interface matching the Hack Repair style with real-time SSE progress streaming. |
| Session API Keys | Input keys on-the-fly in the browser. Keys are saved in sessionStorage and vanish when you close the tab. |
| Modern Architecture | Built with an Object-Oriented design, strong typing, and support for .env configurations. |
| Platform | Role | Focus Area |
|---|---|---|
| Censys | Primary Validation | TLS certificate SAN/CN matching and HTTP banner tracking |
| Shodan | Historical Context | Historical hostname associations and open port discovery |
| SecurityTrails | DNS Telemetry | Current and historical A records, subdomain enumeration |
| DNS Resolver | Active Validation | Rapid concurrent resolution of common bypass subdomains |
Ensure you have Python 3.9+ installed on your system.
- Clone the repository:
git clone https://github.com/hackrepair/cf-finder
cd cf-finder- Install dependencies:
pip install -r requirements.txtCF Finder includes a modern web dashboard. Run the application server:
python web.pyThen visit http://127.0.0.1:5000 in your web browser.
Instead of exposing persistent API keys on the server inside files, you can securely enter your Shodan, Censys, and SecurityTrails keys in the browser:
- Click the Gear (Settings) icon in the top right navbar.
- Fill out your credentials.
- These keys are stored in
sessionStorageand will be completely destroyed as soon as you close the browser tab.
If running in headless mode or if you prefer a local configuration, you can create a .env or config.txt file in the same directory as the script:
SHODAN_API_KEY=your_shodan_key_here
CENSYS_API_ID=your_censys_api_id_here
CENSYS_API_SECRET=your_censys_api_secret_here
SECURITYTRAILS_API_KEY=your_securitytrails_key_hereBasic execution against a target:
python cf_finder.py example.comProbe HTTPS in addition to HTTP:
python cf_finder.py example.com --httpsSave the JSON output for external analysis:
python cf_finder.py example.com -o results.jsonRaise the minimum confidence threshold (default is 3):
python cf_finder.py example.com --min-score 5If using the Web Interface, API keys entered in the browser Settings modal are stored in your local browser sessionStorage and passed in the payload in-memory. They are never written to any disk/file logs and are completely wiped when the tab is closed. Target domains are queried only through third-party APIs and safe DNS/HTTP checks.
Jim Walker (The Hack Repair Guy) is a veteran web security specialist and the founder of Hack Repair.
For over 15 years, Jim has helped thousands of business owners, developers, and organizations recover from web compromises, secure their server infrastructure, and implement robust defenses against automated exploits. He specializes in:
- Hands-on malware removal & site restoration
- Server security audits & hardening
- WAF/CDN configuration and optimization
Feel free to connect or learn more at hackrepair.com.
We welcome contributions! Please refer to the CONTRIBUTING.md guide for guidelines on submitting issues and pull requests.
This project is licensed under the MIT License.