diff --git a/.screens/preview.gif b/.screens/preview.gif new file mode 100644 index 0000000..91b668b Binary files /dev/null and b/.screens/preview.gif differ diff --git a/README.md b/README.md index ee5b5fc..e13f78a 100644 --- a/README.md +++ b/README.md @@ -1,13 +1,18 @@ # NSECX +> Research project on NSEC[3] walking for DNSSEC enabled Zones -###### Rsearch project on NSEC[3] walking for DNSSEC enabled Zones +![](./.screens/preview.gif) -## Work in progress: Come back later +## [Work in Progress] The repository contains utilities for DNSSEC zone enumeration and subdomain discovery via NSEC/NSEC3 walking. It focuses on extracting and analyzing DNSSEC records for TLDs and specific target domains. Meant for educational purposes, security research, and sanctioned penetration testing, these tools aid in uncovering the underlying mechanisms of DNS security. -## Statistics -Based on my research at the time of writing this repository, after mapping 1,458 TLD zones, 89.78% use NSEC3, and 3.50% use NSEC, and 6.72% do not have DNSSEC features at all. +## DNSSEC Statistics +| Status | Percentage | TLDs | +| ---------------------------------------- | ---------- | ----- | +| [NSEC3](./dnssec_stats/nsec3.txt) | 90% | 1,313 | +| [NSEC](./dnssec_stats/nsec.txt) | 3% | 51 | +| [NO DNSSEC](./dnssec_stats/nodnssec.txt) | 7% | 98 | ## NSEC Pitfalls - Results inconsistent, must hop dns servers on ALL issues to continue the crawl. diff --git a/output/nodnssec.txt b/dnssec_stats/nodnssec.txt similarity index 100% rename from output/nodnssec.txt rename to dnssec_stats/nodnssec.txt diff --git a/nsec.txt b/dnssec_stats/nsec.txt similarity index 100% rename from nsec.txt rename to dnssec_stats/nsec.txt diff --git a/output/nsec3.txt b/dnssec_stats/nsec3.txt similarity index 100% rename from output/nsec3.txt rename to dnssec_stats/nsec3.txt diff --git a/tldsec b/extras/tldsec similarity index 80% rename from tldsec rename to extras/tldsec index ccd3f05..3f850d3 100755 --- a/tldsec +++ b/extras/tldsec @@ -1,5 +1,5 @@ #!/bin/sh -# NSEC walk script for DNSSEC - developed by acidvegas (https://git.acid.vegas/nsecx) +# NSEC Statistics for TLDs - developed by acidvegas (https://git.acid.vegas/nsecx) # tldsec # This script will check the DNSSEC status of all TLDs and output the results separated by NSEC, NSEC3, and NODNSSEC. @@ -17,17 +17,8 @@ NC='\033[0m' # Create the output directory if it doesn't exist mkdir -p output -# Parse the tld list from a root nameserver (todo: randomize the root nameserver) +# Parse the tld list from a root nameserver tld_list=$(dig AXFR . @g.root-servers.net | grep -E 'IN\s+NS' | awk '{print $1}' | sed 's/\.$//' | sort -u) -if [ -z $tld_list ]; then - tld_list=$(curl -s 'https://data.iana.org/TLD/tlds-alpha-by-domain.txt' | tail -n +2 | tr '[:upper:]' '[:lower:]') -fi - -# Check if the list was retrieved successfully -if [ -z "$tld_list" ]; then - printf "${RED}Failed to fetch the list of TLDs.${NC}\n" - exit 1 -fi # Get the total number of TLDs, excluding comments and empty lines total_tlds=$(echo "$tld_list" | grep -v '^#' | grep -v '^$' | wc -l | tr -d ' ') diff --git a/nsec b/nsec deleted file mode 100755 index 1201a9a..0000000 --- a/nsec +++ /dev/null @@ -1,54 +0,0 @@ -#!/bin/sh -# NSEC walk script for DNSSEC - developed by acidvegas (https://git.acid.vegas/nsecx) -# nsec - -# This script will walk through a DNS zone using NSEC records. - -# You can wall all the zones outputted from tldsec using the following command: -# cat output/nsec.txt | while read line; do ./nsec "$line"; done - -dns_servers=$(curl -s https://public-dns.info/nameservers.txt | grep -oE '\b([0-9]{1,3}\.){3}[0-9]{1,3}\b') -nameserver=$(echo "$dns_servers" | shuf -n 1) - -# Loop to walk through the zone using NSEC records -while IFS= read -r line; do - tld="$line" - - current_domain="$tld" - retry=0 - breaker=0 - while true; do - # Perform the dig command to get the NSEC record for the current domain - output="$(dig @${nameserver} +trace +time=10 +tries=3 $current_domain NSEC)" - - # Use grep to find the line with the current domain and then use awk to extract the next domain - next_domain=$(echo "$output" | grep -F "$current_domain" | awk '$4 == "NSEC" { print $5 }') - - if [ -z "$next_domain" ] || [ -n "$(printf '%s' "$next_domain" | tr -cd '\000')" ] || [ "$next_domain" = "$current_domain" ]; then - next_domain="$current_domain" - retry=$((retry + 1)) - elif [ "$next_domain" = "nic.$tld" ]; then - echo "Found NIC!" - next_domain= - else - echo "Found NSEC record: $next_domain" - echo "$next_domain" >> output/nsec/$tld.txt - retry=0 - breaker=0 - fi - - if [ $retry -eq 3 ]; then - nameserver=$(echo "$dns_servers" | shuf -n 1) - retry=0 - breaker=$((breaker + 1)) - if [ $breaker -eq 3 ]; then - echo "Failed to get NSEC record for $current_domain" - break - fi - fi - - # Update the current domain to the next one for the following iteration - current_domain=$next_domain - - done -done < nsec.txt \ No newline at end of file diff --git a/nwalk b/nwalk index bde8b88..4bba8a4 100755 --- a/nwalk +++ b/nwalk @@ -1,5 +1,17 @@ #!/bin/sh -# NSEC Walk - developed by acidvegas (https://git.acid.vegas) +# NSEC Walking for DNSSEC enabled zones - developed by acidvegas (https://git.acid.vegas/nsecx) + +# Usage: +# NSEC walk on a single domain: +# ./nwalk +# NSEC walk on a list of domains: +# cat domain_list.txt | ./nwalk +# NSEC walk on a list of domains using parallel: +# parallel -a domain_list.txt -j 10 ./nwalk +# NSEC walk on all TLDs: +# curl -s 'https://data.iana.org/TLD/tlds-alpha-by-domain.txt' | tail -n +2 | tr '[:upper:]' '[:lower:]' | ./nwalk +# NSEC walk on all PSL TLDs: +# curl -s https://publicsuffix.org/list/public_suffix_list.dat | grep -vE '^(//|.*[*!])' | grep '\.' | awk '{print $1}' | ./nwalk # Colors BLUE="\033[1;34m" @@ -12,11 +24,6 @@ RED="\033[1;31m" YELLOW="\033[1;33m" RESET="\033[0m" -# Set output directory -output_dir="nwalk_out" -mkdir -p $output_dir - - nsec_crawl() { domain=$1 @@ -101,70 +108,15 @@ nsec_crawl() { fi } - -psl_crawl() { - psl=$(curl -s https://publicsuffix.org/list/public_suffix_list.dat | grep -vE '^(//|.*[*!])' | grep '\.' | awk '{print $1}') - - [ -z "$psl" ] && echo "${RED}No PSL TLDs found${RESET}" && exit 1 - - total_psl=$(echo "$psl" | wc -l) - echo "${BLUE}Found ${total_psl} PSL TLDs${RESET}" - - for tld in $psl; do - nsec_crawl $tld - done -} - - -tld_crawl() { - process_domain "." - - rndroot=$(find $output_dir/*.root-servers.net.txt -type f | shuf -n 1) - - tlds=$(curl -s 'https://data.iana.org/TLD/tlds-alpha-by-domain.txt' | tail -n +2 | tr '[:upper:]' '[:lower:]') - - [ -z "$tlds" ] && echo "${RED}No TLDs found${RESET}" && exit 1 - - total_tld=$(echo "$tlds" | wc -l) - echo "${BLUE}Found ${total_tld} TLDs${RESET}" - - for tld in $tlds; do - nsec_crawl $tld - done -} - - +# Set output directory +output_dir="nwalk_out" +mkdir -p $output_dir if [ -t 0 ]; then - [ $# -eq 0 ] && echo "Usage: $0 or cat domain_list.txt | $0" && exit 1 + [ $# -ne 1 ] && echo "Usage: $0 or cat domain_list.txt | $0" && exit 1 nsec_crawl $1 else while IFS= read -r line; do nsec_crawl $line done -fi - -if [ -t 0 ]; then - if [ $# -ne 1 ]; then - echo "Usage: $0