Cloudflare Developers•3y ago

https://www.techradar.com/pro/cloudflare-tunnels-are-being-used-to-breach-networks

TechRadar

Cloudflare Tunnels are being used to breach networks

Benign tool is being used to steal data by abusing Cloudflare Tunnels

SohamOP•8/15/23, 6:52 AM

Is cloudflare aware of this?

SSoham Is cloudflare aware of this?

chientrm.com•8/15/23, 6:57 AM

perfect tool.

chientrm.com•8/15/23, 6:57 AM

May aswell grab the credentials inside ~/.cloudflare and do funny back.

SohamOP•8/15/23, 7:00 AM

Does the folder even exist if you install cloudflared as a service though?

SohamOP•8/15/23, 7:01 AM

I thought it was only for if you manually configured the tunnel

SSoham Does the folder even exist if you install cloudflared as a service though?

chientrm.com•8/15/23, 7:02 AM

yep afaik.

SSoham I thought it was only for if you manually configured the tunnel

Hello, I’m Allie!•8/15/23, 8:21 AM

The only time it doesn’t exist is when you run a Dash Tunnel manually

Ssathoro still waiting on this meanwhile Free Cloudflare zones get 1 rate limiting rule b...

Erisa•8/15/23, 8:42 AM

Hey, what's the ticket number? I can take a look for you

EErisa Hey, what's the ticket number? I can take a look for you

sathoro•8/15/23, 8:43 AM

2894026 thank you!

Erisa•8/15/23, 8:44 AM

On it

SSoham https://www.techradar.com/pro/cloudflare-tunnels-are-being-used-to-breach-networ...

Dubz•8/15/23, 8:48 AM

I had the same thoughts about tunnels when it launched, but didn't want to be that guy to give birth to it. Then again, if I thought of it, so would someone else...

Ssathoro 2894026 thank you!

Erisa•8/15/23, 8:52 AM

Added RL and replied, sorry again for the trouble!

Erisa•8/15/23, 8:52 AM

there is an explanation of sorts in the ticket

EErisa Added RL and replied, sorry again for the trouble!

sathoro•8/15/23, 11:39 AM

thanks

SSoham https://www.techradar.com/pro/cloudflare-tunnels-are-being-used-to-breach-networ...

Cyb3r-Jak3•8/15/23, 11:49 AM

I mean it’s the same with any tunnel program like ngrok or even net cat. If a free tool exists it will get abused

Gglendc Would there be a channel here where I can propose some possible contributions to...

Erisa•8/15/23, 4:06 PM

The Issues on that repo would be the most appropriate place

Dubz•8/15/23, 9:22 PM

Is it possible to block cloudflared from being used as a service but not as a client? WARP is not an option in my circumstances but curious if the service/client side of cloudflared use different hostnames and/or ports

Erisa•8/15/23, 9:38 PM

Sure, just do the opposite of these https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/install-and-setup/ports-and-ips/

Tunnel with firewall · Cloudflare Zero Trust docs

Users can implement a positive security model with Cloudflare Tunnel by restricting traffic originating from cloudflared. The parameters below can be …

!_r3c4•8/15/23, 9:38 PM

EErisa Sure, just do the opposite of these https://developers.cloudflare.com/cloudflare...

Dubz•8/16/23, 4:15 AM

I'm kinda confused on what part of the connection that's referring to.

divby0•8/16/23, 9:15 AM

When I want to register a low-price domain, is there a way to see a list of domain extensions with their prices or even sort by price then? Not specifically for my domain, just the extensions would be helpful already, currently the list of supported extensions is listed without price or anything else, just the bare "com" or "org" part

divby0•8/16/23, 9:17 AM

I saw for example that

.work

.work

is $6.18 but currently it's really really difficult to explore low price extensions

kian•8/16/23, 9:52 AM

https://github.com/Cloudflare-Mining/Cloudflare-Datamining/blob/main/data/registrar/README.md

GitHub

Cloudflare-Datamining/data/registrar/README.md at main · Cloudflare...

Public datamining for all things Cloudflare. Contribute to Cloudflare-Mining/Cloudflare-Datamining development by creating an account on GitHub.

kian•8/16/23, 10:08 AM

kian•8/16/23, 10:08 AM

Seems like these are the cheapest ones

Erisa•8/16/23, 10:16 AM

party is a great tld

Kkian Click to see attachment

divby0•8/16/23, 10:40 AM

that list looks nice! I got the _list.json and going to sort it to see all of them, thank you kian

EErisa party is a great tld

divby0•8/16/23, 10:41 AM

yes, party seems non-weird enough and but still cheap

Original message was deleted

zegevlier•8/16/23, 10:48 AM

Please move this to a thread. This is a very spammy message

zegevlier•8/16/23, 10:49 AM

Yea, spoiler just makes all the text blacked-out. When I saw it I immediately thought it was someone just trying to flood the channel

zegevlier•8/16/23, 10:52 AM

It's no problem haha, but having a very large completely black message in chat is unusual. Moving it to a thread like this works for me!

Ddivby0 yes, party seems non-weird enough and but still cheap 😄

dave•8/16/23, 2:42 PM

.trade

.trade

is nice

dave•8/16/23, 2:42 PM

I don't recommend

.stream

.stream

, since it's often misspelled as

.steam

.steam

Tricked•8/16/23, 3:59 PM

.party is fun

valkyrie_pilot•8/16/23, 6:59 PM

one day r2 public buckets in the API

sathoro•8/17/23, 6:23 AM

there is a dynamic image we embed on our site from a third-party site. sometimes the image seems to randomly be broken (404) and then will work again several minutes later, not sure why. what would be the easiest way for us to proxy the image through our server so it stays relatively up-to-date (updating every several hours is fine) while not breaking?

sathoro•8/17/23, 8:32 AM

yes that is one solution. was looking for a more simple solution

Ssathoro there is a dynamic image we embed on our site from a third-party site. sometimes...

Hello, I’m Allie!•8/17/23, 8:37 AM

KV with expiration?

Hello, I’m Allie!•8/17/23, 8:38 AM

About as simple as it gets

chientrm.com•8/17/23, 10:30 AM

How do I make Web Analytics to recognize and exclude my visits on my pages?

David•8/17/23, 10:54 AM

Are there issues with Cloudflare ZTNA? my Policy updates do not apply for some reason
well I can see changes, but they are not updated in the application

chientrm.com•8/17/23, 11:03 AM

also is there a way to get logs more than 72 hours, like for a months or years.

Original message was deleted

sathoro•8/17/23, 11:05 AM

eh seems like fairly common case. simply serve stale cached version of asset

Original message was deleted

sathoro•8/17/23, 11:44 AM

who said anything about your CDN? like I said, this is a third party asset

sathoro•8/17/23, 11:44 AM

we can't "switch", it's not a computing platform

Original message was deleted

sathoro•8/17/23, 11:49 AM

yeah will just use DO with an alarm to attempt to get fresh version every hour

DDavid Are there issues with Cloudflare ZTNA? my Policy updates do not apply for some r...

David•8/17/23, 1:42 PM

and according to #cloudflare-status It's not me

Retard•8/17/23, 2:32 PM

When trying to setup a custom Error Page - I get this warning with a URL to an image that is not even on the page.

The custom URL I am trying to setup is:

https://ellasbubbles.com/please-wait/

https://ellasbubbles.com/please-wait/

https://www.techradar.com/pro/cloudflare-tunnels-are-being-used-to-breach-networks

Similar Threads

Similar Threads

Similar Threads