One method can achieve DDOS and intrusion by looking for real IP addresses without using CDN

This vulnerability is not considered a vulnerability. However, the impact scope is extremely great. Currently, CDN, such as jiasule, website guard, Baidu cloud acceleration, and quickshield, are playing a great role ~, Various anti-DDOS and CC defenses ~, However, this cave can ignore the CDN defense and implement intrusion and traffic attacks. After thinking for a long time, I have not found a solution ~ You can only submit the CDN vendor.

1. First, register the target website and 90% of the websites require email verification.

2. If no email verification is available, select "retrieve password" to implement email verification.

3. Open your mailbox, find the verification email, and click Show Original

4. In the original article, you can find the real IP address of the server.

5. Bind a host to check whether the target website can be opened, which is a real IP address.

6. Conduct intrusion tests on real IP addresses, DDOS traffic attacks, CC attacks, and so on to achieve defense against CDN attacks.

 

Solution:

The CDN vendor issues a mail forwarding like sendcloud, or sends a security mailbox without recording IP addresses.