# Finding A Websites IP Behind Cloudflare/Reverse Proxy **URL:** \ **Category:** Tutorials & Methods\ **Tags:** freebies, cloud-storage, tips-tricks\ **Created:** [October 26, 2022, 7:46pm UTC](https://onehack.st/t/finding-a-websites-ip-behind-cloudflare-reverse-proxy/227414 "2022-10-26T19:46:00Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![WhiteHat](https://onehack.st/user_avatar/onehack.st/whitehat/32/162514_2.png) [@WhiteHat](https://onehack.st/u/WhiteHat)\ **Post date:** [October 26, 2022, 7:46pm UTC](https://onehack.st/t/finding-a-websites-ip-behind-cloudflare-reverse-proxy/227414/1 "2022-10-26T19:46:00Z")
Lots of sites hide their real server’s IP using a service such as Cloudflare In this tutorial I am going to present you a few ways, in order to find out the IP, even if the website uses some kind of portection Let it be said that all these methods rely on poor configuration, so it will not work for sites that know how to configure their infrastructure **1. Web Server Errors** Web Server can return error codes, such as 404 or 403 In some cases the web server will reveal it’s real IP, when returning an error of that type This picture presents such a misconfiguration If the site’s owner does not set the web server hostname to the domain or even better, creates custom error messages, this kind of leakage could be prevented **2. Application Errors** Causing an error in an application, might cause the server to leak it’s IP address If the error reporting is not set to off and the website has kind of the settings it had in development still running in production, you can play around a bit and try to cause an error When it works, you will get something like “unexpected parameter ’ in application.php at xx.xxx.x.xxx” I wanted to showcase this with a real life example I had saved for my tutorial, but cannot seem to find it right now, will edit should I find it **3. Historical DNS data** One of the most promising methods if you ask me that will at least point you in a good direction The dnstrails feature of securitytrails will help your with this It shows every DNS records that have ever been published for this domain Lots of admins tend to first assign their domain to a single server, because “the site is not known yet” However, this is a big mistake The data can later be found and thus the real IP of the server I would love to see some input on this and maybe methods you use for this This Thread will probably be edited some time in the future to provide an example for #2 or to expand it by more methods that come to my mind **Happy learning!**