Integration Cloudflare with ShadowMap

ShadowMap supports a secure, read-only integration with Cloudflare to automatically discover and monitor domains, sub-domains, DNS records, and origin infrastructure. This integration allows ShadowMap to ingest authoritative data directly from Cloudflare, ensuring comprehensive and continuously updated visibility of your external attack surface.

This guide walks you through creating a Cloudflare API Token with the required permissions and configuring ShadowMap to use it.

Step 1: Create a Cloudflare API Token

1. Sign in to the Cloudflare Dashboard.

2. Click your profile icon in the top-right corner and select My Profile.

3. Navigate to API Tokens.

4. Click Create Token.

5. Choose Create Custom Token.

Step 2: Configure API Token Permissions

Configure the token with read-only permissions as outlined below.

Scope

• Include access to the specific Cloudflare account that manages the domains you want ShadowMap to monitor
  (or all accounts, if centrally managed)

Once configured:

1. Click Continue to summary

2. Review the permissions

3. Click Create Token

4. Copy the token value immediately (it will not be shown again)

Step 3: Identify Your Cloudflare Account ID

To find your Cloudflare Account ID.

1. Open any domain in the Cloudflare dashboard

2. Locate the Account ID in the account or domain overview section

Step 4: Configure Cloudflare in ShadowMap

1. Log in to your ShadowMap dashboard.

2. Navigate to Settings → Cloud Sources.

3. Select Cloudflare.

4. Click Create New Configuration.

5. Enter:

   • Configuration Name

   • Cloudflare API Token

   • Cloudflare Account ID (if applicable)

6. Click Create Source to enable the integration.

Once enabled, ShadowMap will begin ingesting Cloudflare data automatically.

How Cloudflare Data is Used in ShadowMap

After the integration is active, ShadowMap retrieves and correlates Cloudflare data to enrich your external attack surface inventory.

Domain & Sub-Domain Discovery

• Managed domains (zones)

• DNS records, including:

  • A / AAAA records

  • CNAME records

  • TXT records (for contextual intelligence)

• Automatic identification of sub-domains, including newly added or previously unknown entries

Origin Infrastructure Mapping

• Extraction of origin IP addresses from DNS and routing configurations

• Detection of:

  • Direct-to-origin exposure risks

  • Cloudflare bypass paths

  • Shared origin infrastructure across multiple domains

Exposure Context & Metadata

• Proxy status (proxied vs DNS-only)

• Mapping of protected versus unprotected endpoints

• Correlation with certificates, IP intelligence, and hosting providers

These elements are then:

• Continuously monitored for changes.

• Automatically included in ShadowMap's scanning engine.

• Evaluated for vulnerabilities, misconfigurations, and threats.