nyns

DNS scanner and mapper for identifying orphaned and dangling DNS records.

nyns enumerates subdomains via passive DNS sources (crt.sh, Anubis, HackerTarget), follows CNAME chains, and detects takeover vulnerabilities across 9 attack vectors. It fingerprints 32 cloud services, performs active HTTP/HTTPS probing with WAF detection, correlates findings into attack chains, and generates reports in 5 output formats. Built for security teams, penetration testers, and infrastructure auditors.

Features

9 attack vectors -- CNAME takeover, NS takeover, MX takeover, SPF include hijack, TXT verification record abuse, expired domain detection, service takeover, dangling cloud IPs, attack chain correlation
32-service fingerprint database -- AWS, Azure, GitHub Pages, Heroku, Shopify, Fastly, and more
Active service probing -- HTTP/HTTPS probing, TLS certificate inspection, WAF detection (9 WAFs: Cloudflare, Akamai, AWS WAF, Imperva, Sucuri, F5 BIG-IP, Barracuda, Fortinet, Citrix ADC), cloud error page matching (13 signatures), redirect chain following
Web UI -- full-featured web interface with dashboard, real-time scan progress via WebSocket, scan history with SQLite persistence, interactive graph visualization, and search/filter across all data. Start with nyns web on port 8484.
Confidence scoring -- categorical confidence levels (Certain/High/Medium/Low) on every finding
Discovered domains -- extracts related domains from CNAME chains and redirect targets with "Follow the Thread" capability for recursive investigation
Multi-domain scanning -- scan multiple domains in a single run with concurrent execution
Domain relationship verification -- detect shared infrastructure (NS, MX, IPs, WHOIS, certificates) between domains
4 scan profiles -- quick, email, infrastructure, full -- or override with custom record types and vectors
5 output formats -- terminal (Rich), JSON, HTML, PDF, interactive graph visualization
Attack chain detection -- correlates individual findings into multi-vector attack chains with MITRE ATT&CK, CWE, and OWASP references
Configurable severity model -- default severity per vector with config overrides and severity floor enforcement
Interactive wizard -- guided scan setup with Rich prompts
SQLite caching -- avoids redundant lookups across runs
Token bucket rate limiting -- configurable per-provider RPM and global delay
CI-friendly -- exit code 2 when vulnerabilities are found

Installation

Binary (recommended)

Download a standalone binary from GitHub Releases. No Python installation required.

# macOS (Apple Silicon)
curl -L https://github.com/samelsaid/nyns/releases/latest/download/nyns-darwin-arm64 -o nyns
chmod +x nyns
./nyns scan example.com

# Linux (x64)
curl -L https://github.com/samelsaid/nyns/releases/latest/download/nyns-linux-x64 -o nyns
chmod +x nyns
./nyns scan example.com

# Windows (x64)
# Download nyns-windows-x64.exe from https://github.com/samelsaid/nyns/releases/latest

pip

pip install nyns

Optional extras for web UI, graph visualization, and PDF export:

pip install nyns[web]         # web UI (FastAPI, aiosqlite, WebSockets)
pip install nyns[viz]         # graph visualization (pyvis)
pip install nyns[pdf]         # PDF export (weasyprint)
pip install nyns[web,viz,pdf] # all extras

Web UI, PDF, and graph visualization require the pip install. They are not available in the standalone binary.

Web UI

The web interface provides a full-featured dashboard with real-time scan progress, scan history, and interactive visualizations.

# Install with web UI support
pip install nyns[web]

# Start the web UI
nyns web
# Opens browser to http://localhost:8484

Features:

Real-time scan progress via WebSocket
Scan history with SQLite persistence
Interactive graph visualization of domain relationships
Search and filter across all findings
Cancel running scans
Rescan with saved configurations
Export to JSON/HTML from the UI

Quick Start

# Start the web UI
nyns web

# Basic scan (default full profile with all vectors)
nyns scan example.com

# Full scan with JSON and HTML export
nyns scan example.com --profile full --json --html

# Scan multiple domains
nyns scan a.com b.com c.com

# Scan domains from a file
nyns scan --domains-file domains.txt

# Mix positional domains and file input
nyns scan a.com b.com --domains-file more-domains.txt

# Follow discovered domains to maximum depth
nyns scan example.com --follow-depth 3

# Reconnaissance scan (host enumeration without vulnerability detection)
nyns recon example.com

# Verify relationships between domains
nyns verify a.com b.com

# Deep verify (full scan + relationship analysis)
nyns verify a.com b.com --deep

# Interactive wizard
nyns scan --interactive

CLI Reference

`nyns web`

Start the web interface.

Flag	Short	Description
`--host`		Host to bind to (default: `127.0.0.1`)
`--port`		Port to listen on (default: `8484`)
`--no-browser`		Don't open browser automatically

`nyns scan`

Scan domain(s) for subdomain takeover vulnerabilities.

Flag	Short	Description
`DOMAINS`		Target domain(s) as positional arguments
`--domains-file`	`-f`	File with domains (one per line by default)
`--delimiter`		Delimiter for domains file (default: newline)
`--interactive`	`-i`	Launch interactive wizard
`--profile`	`-p`	Scan profile: `quick`, `email`, `infrastructure`, `full`
`--records`		Comma-separated record types (overrides profile)
`--vectors`		Comma-separated attack vectors (overrides profile)
`--follow-depth`		Max depth for following discovered domains (default: 0, disabled)
`--verbose`	`-v`	Show detailed output
`--output-dir`	`-o`	Output directory (default: `./output/`)
`--json`		Export results to JSON
`--html`		Export HTML report
`--pdf`		Export PDF report (requires `nyns[pdf]`)
`--graph`		Generate interactive graph HTML (requires `nyns[viz]`)
`--limit`	`-l`	Max subdomains to process
`--dry-run`		Show what would be scanned without scanning

`nyns recon`

Perform reconnaissance/host enumeration without vulnerability detection.

Flag	Short	Description
`DOMAINS`		Target domain(s) as positional arguments
`--domains-file`	`-f`	File with domains (one per line by default)
`--delimiter`		Delimiter for domains file (default: newline)
`--verbose`	`-v`	Show detailed output
`--output-dir`	`-o`	Output directory (default: `./output/`)
`--json`		Export results to JSON
`--html`		Export HTML report
`--limit`	`-l`	Max subdomains to process

`nyns verify`

Verify relationships between domains (shared NS, MX, IPs, certificates).

Flag	Short	Description
`DOMAINS`		Domains to compare (minimum 2)
`--domains-file`	`-f`	File with domains (one per line by default)
`--delimiter`		Delimiter for domains file (default: newline)
`--deep`		Run full scan before relationship analysis
`--verbose`	`-v`	Show detailed output
`--output-dir`	`-o`	Output directory
`--json`		Export results to JSON

`nyns version`

Print the current version.

Exit Codes

Code	Meaning
0	Scan completed, no vulnerabilities found
1	Error (invalid input, configuration, etc.)
2	Scan completed, vulnerabilities found

Scan Profiles

Profiles control which DNS record types are queried and which attack vectors are evaluated.

Profile	Records	Vectors	Description
`quick`	CNAME	CNAME takeover	Fast CNAME takeover scan only
`email`	MX, TXT	MX takeover, SPF takeover, TXT verification	Email security assessment
`infrastructure`	NS, A, AAAA	NS takeover, expired domain	DNS infrastructure audit
`full`	All	All	Comprehensive assessment (all vectors)

The default profile is full. Override with --profile:

nyns scan example.com --profile quick

Override individual record types or vectors regardless of profile:

nyns scan example.com --records cname,mx --vectors cname_takeover,mx_takeover

Available Record Types

cname, a, aaaa, ns, mx, txt

Available Attack Vectors

cname_takeover, ns_takeover, mx_takeover, spf_takeover, expired_domain, txt_verification, service_takeover, dangling_ip, attack_chain

Configuration

Configuration is loaded with the following precedence (highest wins):

defaults -> config.yaml -> environment variables -> CLI flags

config.yaml

Place a config.yaml in the working directory or alongside the binary:

defaults:
  tier: free
  delay_ms: 100
  user_agent: "nyns/0.1.0 (DNS security scanner)"

scan:
  profile: quick

concurrency:
  dns_semaphore: 100
  http_semaphore: 50
  per_provider_rpm: 60

output:
  format: terminal

# Severity overrides (optional)
# severity:
#   cname_takeover: high
#   txt_verification: low

Environment Variables

Environment variables use the NYNS_ prefix. API keys for premium providers are loaded from environment variables or a .env file:

export NYNS_DELAY_MS=200
export NYNS_DNS_SEMAPHORE=50

See .env.example for the full list of supported variables.

Output Formats

Terminal (default)

Rich-formatted terminal output with color-coded severity, CNAME chain visualization, and MITRE/CWE/OWASP references. Use --verbose for additional detail including DMARC signals, vector-specific evidence, and full chain paths.

JSON (`--json`)

Structured JSON export for programmatic consumption and CI integration. Written to <output-dir>/<domain>-<timestamp>/results.json.

HTML (`--html`)

Self-contained HTML report with styled tables and finding details. Written to <output-dir>/<domain>-<timestamp>/report.html.

PDF (`--pdf`)

PDF version of the HTML report. Requires pip install nyns[pdf] (weasyprint). Not available in the standalone binary.

Interactive Graph (`--graph`)

Interactive network graph showing domain-subdomain-CNAME relationships with vulnerability highlighting. Requires pip install nyns[viz] (pyvis). Not available in the standalone binary.

Development

git clone https://github.com/samelsaid/nyns.git
cd nyns
python -m venv .venv && source .venv/bin/activate
pip install -e ".[dev]"

Run Tests

pytest tests/ -v

Lint and Type Check

ruff check src/ tests/
mypy src/nyns/

Project Structure

src/nyns/
  main.py              # Typer CLI entry point
  models.py            # Data models, enums (RecordType, AttackVector, ConfidenceLevel)
  config.py            # Config loading (YAML, env, CLI precedence)
  validation.py        # Input validation, domain sanitization
  cache.py             # SQLite result caching
  rate_limit.py        # Token bucket rate limiter
  log.py               # Structured logging (structlog)
  scan_engine.py       # Scan pipeline orchestration (13 phases)
  providers/           # Subdomain discovery sources
    sources/
      crtsh.py         # crt.sh Certificate Transparency
      anubis.py        # Anubis (jldc.me)
      hackertarget.py  # HackerTarget hostsearch
  resolver/            # DNS resolution
    dns_resolver.py    # Async bulk DNS resolver
    record_chain.py    # CNAME chain follower
  detection/           # Takeover detection
    cname_takeover.py  # CNAME + HTTP fingerprinting
    ns_takeover.py     # NS delegation takeover
    mx_takeover.py     # MX takeover + DMARC check
    spf_takeover.py    # SPF include hijack
    txt_verification.py # TXT record verification abuse
    expired_domains.py # WHOIS expiry detection
    service_prober.py  # HTTP/HTTPS probing, TLS, WAF detection, redirect chains
    confidence.py      # Confidence scoring (Certain/High/Medium/Low)
    attack_chains.py   # Multi-vector attack chain correlation
    severity.py        # Severity model + overrides
    profiles.py        # Scan profiles (quick/email/infra/full)
    domain_relationships.py # Domain relationship analysis
  discovery/
    subdomain_enum.py  # Subdomain enumeration orchestrator
  reporting/           # Output formatters
    terminal.py        # Rich terminal output
    json_export.py     # JSON export
    html_export.py     # HTML report
    pdf_export.py      # PDF report (weasyprint)
    graph_viz.py       # Interactive graph (pyvis)
  reference/
    library.py         # MITRE ATT&CK, CWE, OWASP references
  cli/
    wizard.py          # Interactive wizard mode
  web/                 # Web UI (FastAPI + React)
    app.py             # FastAPI application
    scan_manager.py    # Scan lifecycle management, WebSocket events
    routes/
      scans.py         # Scan API routes
      history.py       # Scan history API
    static/            # Frontend build output
    templates/         # HTML templates

License

nyns is dual-licensed:

AGPL-3.0 for open source and non-commercial use
Commercial license for organizations -- includes a 30-day evaluation period at no cost

For commercial licensing inquiries, contact inquiry@nnjasec.com.

See LICENSE for the full AGPL-3.0 text and COMMERCIAL_LICENSE.md for commercial terms.

Name		Name	Last commit message	Last commit date
.github/workflows		.github/workflows
design-system/nyns		design-system/nyns
src/nyns		src/nyns
tests		tests
web		web
.env.example		.env.example
.gitignore		.gitignore
ARCHITECTURE.md		ARCHITECTURE.md
COMMERCIAL_LICENSE.md		COMMERCIAL_LICENSE.md
DEVELOPMENT.md		DEVELOPMENT.md
DNS_TAKEOVER_TOOL_PLAN.md		DNS_TAKEOVER_TOOL_PLAN.md
LICENSE		LICENSE
README.md		README.md
nyns.spec		nyns.spec
pyproject.toml		pyproject.toml

Navigation Menu

Repository files navigation

nyns

Features

Installation

Binary (recommended)

pip

Web UI

Quick Start

CLI Reference

`nyns web`

`nyns scan`

`nyns recon`

`nyns verify`

`nyns version`

Exit Codes

Scan Profiles

Available Record Types

Available Attack Vectors

Configuration

config.yaml

Environment Variables

Output Formats

Terminal (default)

JSON (`--json`)

HTML (`--html`)

PDF (`--pdf`)

Interactive Graph (`--graph`)

Development

Run Tests

Lint and Type Check

Project Structure

License

About

Releases

Packages

Contributors

Languages

Latest commit

History

Folders and files

Repository files navigation

nyns

Features

Installation

Binary (recommended)

pip

Web UI

Quick Start

CLI Reference

nyns web

nyns scan

nyns recon

nyns verify

nyns version

Exit Codes

Scan Profiles

Available Record Types

Available Attack Vectors

Configuration

config.yaml

Environment Variables

Output Formats

Terminal (default)

JSON (--json)

HTML (--html)

PDF (--pdf)

Interactive Graph (--graph)

Development

Run Tests

Lint and Type Check

Project Structure

License

About

Resources

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages

`nyns web`

`nyns scan`

`nyns recon`

`nyns verify`

`nyns version`

JSON (`--json`)

HTML (`--html`)

PDF (`--pdf`)

Interactive Graph (`--graph`)