This is a rewrite of NSDetect in rust, since that tool requires python2 which is increasingly hard to use on a modern linux distribution.
shell
cargo install nsdetect
The program takes a file with a list of domains as an input, scans each one of them(skipping duplicates) against this
vulnerability and at last reports a list of vulnerable domains. For help you can run it with -h or --help option as shown below:
nsdetect -h
The input file should simply be a list of domains, one per line
Once we have done sufficient recon on the target and have prepared the list of domains/subdomains, we can provide the
list as an input to the tool in order to scan each domain in the list. We can use -i or --input option to provide the
input file as shown below:
$ nsdetect -i ~/Desktop/temp.csv
example.com: false
Or use -d to specify just one domain.
$ nsdetect -d example.com
example.com: false
Or pipe the domains to nsdetect.
$ echo "example.org
example.com" | nsdetect
example.org: false
example.com: false
Use the --async option to do the lookups asynchronously.
cat /tmp/domains | nsdetect -a
example.org: false
example.com: false
For the takeover of the vulnerable domains, we can use NSBrute,
which requires AWS Programmatic Access:
python NSBrute.py -d vulnerabledomain.com -a ThisIsNotMyAccessKey -s ThisIsNotMySecretKet
Note: While you are doing the POC for NSDetect locally, please keep in mind that DNS Propagation Issues might lead to unexpected results. You may need to provide sufficient time for DNS changes to propagate. In case you still observe the problem, feel free to raise an issue, we can fix it together!