GitHub - beescuit/chatflare: Chat with your friends via Cloudflare cache hits · GitHub
/" data-turbo-transient="true" />
Skip to content
Search/
Sign in<br>Sign upAppearance settings
You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.
Dismiss alert
{{ message }}
beescuit
chatflare
Public
Notifications<br>You must be signed in to change notification settings
Fork
Star<br>20
master
BranchesTags
Go to file
CodeOpen more actions menu
Latest commit
History<br>1 Commit<br>1 Commit
Folders and files<br>NameNameLast commit message<br>Last commit date<br>.github/workflows
.github/workflows
src
src
.gitignore
.gitignore
Cargo.lock
Cargo.lock
Cargo.toml
Cargo.toml
README.md
README.md
demo.gif
demo.gif
View all files
Repository files navigation
Chatflare
Tired of chatting with your friends over real chat applications? Fear no more! Now you can chat by flipping bits on lots of Cloudflare cache-enabled websites :)
This is a PoC of an idea that I had: What if we used HTTP cache hits/misses as a communication channel? So I built this stupid app.
NOTE: For this to work properly, both peers must be connecting to the same cloudflare POP. You can verify this by checking the last 3 letters of a cf-ray response header.
-c, --connect<br>-e, --ext Asset extension [default: css]<br>--concurrency [default: 16]<br>-d, --debug<br>-p, --probe<br>-h, --help Print help<br>-V, --version Print version">Usage: chatflare [OPTIONS]
Options:<br>-u, --url<br>-c, --connect<br>-e, --ext Asset extension [default: css]<br>--concurrency [default: 16]<br>-d, --debug<br>-p, --probe<br>-h, --help Print help<br>-V, --version Print version
Keybinds:
Enter send message<br>F2 toggle raw cache log<br>Ctrl+L clear raw cache log<br>Ctrl+C quit
The way this protocol works is fairly simple: a chat session has 2 "channels" for each side: a "signalling" channel and a "data" channel. We use HTTP paths for non-existent asset files (such as .css) in order to control the cache key on Cloudflare's side. Every 1 second interval, a client fetches their counterparty's signalling channel via {chat_id}/{counterparty_id}/s{timestamp_s}.css (where counterparty_id is h for "host" and c for "client"). When the counterparty decides to send a message, it first writes all of the message's individual 1 bits to its data channel via {chat_id}/d/{counterparty_id}/{seq}/{byte_index}{bit_index}.css (where seq is the message index, starting at 0) and then warms the signalling path with timestamp_s + offset (offset is initially 1 but grows if the sender notices a cache HIT). Once the receiver gets a cache HIT on a signalling channel, it fetches all bits from the data channel (first byte indicates the byte size of the message) and displays it to the screen.
There are probably some cool use cases for this like C2 comms over "trusted domains". https://www.crowdstrike.com/ is supported!
Some endpoints that work with this tool:
https://www.cloudflare.com/static/
https://www.crowdstrike.com/
https://www.zendesk.com/
https://static.notion-static.com/
https://static.pexels.com/
You can run ./chatflare --probe URL to test others.
About<br>Chat with your friends via Cloudflare cache hits<br>Resources<br>Readme<br>Activity<br>Stars<br>20 stars<br>Watchers<br>0 watching<br>Forks<br>0 forks<br>Report repository
Releases
Packages
Contributors
Languages
You can’t perform that action at this time.