A proof of concept script for discovering AWS dangling domains

aws-dangling-domain-discovery-tool.sh

#!/bin/bash

# This script attempts to locate potential dangling domains on AWS. You need AWS CLI installed and your keys configured
# Make sure you insert your Bing API key below as well.
# All the sleeps were necessary to not allocate the same IP address multiple times


while true
do
	unset IP
	unset ALLOCID
	unset RESULTS	
	IP=$(aws ec2 allocate-address --region us-west-1 --output text --query 'PublicIp')
	sleep 10
	ALLOCID=$(aws ec2 describe-addresses --region us-west-1 --output text --query 'Addresses[0].AllocationId')
	echo "Checking address: $IP with allocID: $ALLOCID"	
	sleep 10
	# Put your Bing v7.0 API key in the next line after Ocp-Apim-Subscription-Key
	RESULTS=$(curl -s -H "Ocp-Apim-Subscription-Key: BING-API-KEY-GOES-HERE" "https://api.cognitive.microsoft.com/bing/v7.0/search?q=ip:$IP&count=1&mkt-en-us")
	if echo "$RESULTS" | grep 'displayUrl'; then
		echo "We found one! $IP"
		break
	else
		echo "Releasing Address $IP with allocID: $ALLOCID"		
		RELEASE=$(aws ec2 release-address --region us-west-1 --allocation-id $ALLOCID)
		sleep 20
	fi
done