DISCLAIMER: This project was generated by Artificial Intelligence (AI) but has undergone a rigorous "Human-in-the-Loop" (HITL) process. This means the code has been reviewed and refactored by a human software engineer, the architectural design was human-directed, and a basic security audit was performed to verify functionality and rule out typical AI hallucinations. This process ensures a level of quality and reliability that pure AI generation cannot guarantee.

NSEC3-X

NSEC3-X is a specialized forensics and penetration testing tool designed for auditing DNSSEC NSEC3 configurations. It provides a modern, high-performance alternative to legacy tools like nsec3walker, offering integrated capabilities for zone enumeration (harvesting) and hash reversal (cracking).

The tool is written in Go and is designed to be a self-contained, dependency-free binary suitable for deployment in restricted environments.

Technical Overview

Domain Name System Security Extensions (DNSSEC) use NSEC3 records to prove the non-existence of a domain name without revealing the entire zone content. NSEC3 achieves this by hashing the domain names. However, if the hashing parameters (specifically the iteration count and salt) are weak, these hashes can be vulnerable to offline brute-force attacks.

NSEC3-X automates the exploitation of these weaknesses through two primary phases:

1. Harvesting: The tool uses DNS-over-HTTPS (DoH) to query random subdomains of the target zone. When the nameserver responds with "NXDOMAIN", it includes NSEC3 records proving the non-existence. These records contain the hashes of the "next closer" existing domains in the chain. By collecting enough of these records, the tool can reconstruct parts of the zone's hash chain.
2. Cracking: Once hashes are collected, NSEC3-X attempts to reverse them. It computes the NSEC3 hash for entries in a provided wordlist using the zone's specific parameters (Iterations and Salt). If a computed hash matches a collected hash, the original subdomain is revealed.

Features

• DNS-over-HTTPS (DoH) Transport: utilizes Google's DoH API to perform DNS queries. This bypasses local firewall restrictions on UDP port 53 and encrypts traffic to avoid simple packet inspection.
• Automatic Parameter Detection: Automatically queries the target zone for NSEC3PARAM records to configure the cracker with the correct salt and iteration count.
• RFC-Compliant Hashing: Implements the NSEC3 hashing algorithm strictly according to RFC 5155, including correct handling of Base32Hex encoding which is often problematic in general-purpose cracking tools.
• Multi-threaded Architecture: Both harvesting and cracking modules are multi-threaded, scaling with the number of available CPU cores for maximum performance.

Installation

go install gitlab.com/CyberDev.Hacker/nsec3-x/cmd/nsec3-x@latest

Prerequisites

• Go 1.21 or higher (if building from source)

Binary Integrity Verification

For security reasons, it is recommended to verify the integrity of the downloaded binaries using the provided SHA256 checksums.

1. Download the binary and the sha256sums.txt file from the Release page.
2. Verify the checksum:
   root@kitploit:~

   sha256sum -c sha256sums.txt
   

Building from Source

Clone the repository and build the binary:

git clone https://gitlab.com/CyberDev.Hacker/nsec3-x.git
cd nsec3-x
go build ./cmd/nsec3-x

This will produce an executable named nsec3-x in the current directory.

Usage

The tool operates in distinct modes, controlled by the -mode flag.

1. Investigation Mode

Analyzes the target domain to determine if NSEC3 is active and evaluates the security strength of its configuration.

./nsec3-x -mode investigate -target example.com

2. Harvest Mode

Collects NSEC3 hashes by sending random queries to the target. This fills the gap between known hashes in the zone.

./nsec3-x -mode harvest -target example.com -n 1000

• -n: The number of random queries to send. Higher numbers increase coverage but generate more traffic.
• -t: Number of concurrent worker threads.
• Output is saved to hashes.txt by default.

3. Crack Mode

Attempts to recover plaintext subdomains from the collected hashes using a wordlist.

./nsec3-x -mode crack -target example.com -w /path/to/wordlist.txt

• -target: The target zone (required for correct salt application).
• -file: Path to the file containing harvested hashes (default: hashes.txt).
• -w: Path to the dictionary file (wordlist).
• -no-auto: Disable automatic parameter detection (requires manual -i and -s flags).

4. Verify Mode

A debug utility that calculates the NSEC3 hash for a specific Fully Qualified Domain Name (FQDN). This is useful for verifying if a specific subdomain matches a hash found during harvesting.

./nsec3-x -mode verify -target secret.example.com

Security Considerations

• Network Noise: The harvesting mode generates significant DNS traffic. While DoH hides the content from local observers, the volume of requests to the upstream resolver (Google DNS) is visible.
• Active Defense: Administrators may detect the "NXDOMAIN" flood associated with the harvesting phase.
• Ethical Use: This tool is intended for authorized security assessments only. Unsolicited scanning of third-party infrastructure may violate legal statutes or terms of service.