SYN is a next-generation, autonomous port scanner and vulnerability assessment framework powered by Artificial Intelligence (Machine Learning) and real-time CVE intelligence.
Designed for red teamers, bug bounty hunters, and penetration testers, SYN goes beyond traditional scanning mechanisms. By predicting the target's operating system, identifying network anomalies through machine learning models, and dynamically adapting its scanning behavior, SYN ensures maximum stealth and efficiency. It automatically fetches the latest high-risk CVEs from the NIST National Vulnerability Database (NVD) to provide immediate threat context.
- 🤖 Autonomous AI Engine (SMART Mode): Utilizes trained Random Forest models to analyze target responses (TTL, Latency, Flags). It can predict the underlying OS and automatically pivot to the optimal scan method (e.g., switching to FIN scans if a stateful firewall drops initial probes).
- ⚡ Ultra-Fast Asynchronous Scanning: Implements high-performance TCP connection scans via
asyncio, allowing rapid reconnaissance without requiring root privileges. - 🥷 Stealth Operations & AI Jitter: Integrates a powerful
scapyengine supporting advanced packet manipulation (SYN, ACK, FIN, XMAS, NULL, and UDP scans) to map networks. Uses AI Dynamic Jitter to intelligently throttle packet rates in real-time, effectively bypassing modern adaptive IDS/IPS systems and WAFs. - 🌐 Real-Time CVE Integration: Automatically queries the NIST NVD API using intelligent banner grabbing. It discovers zero-days and known vulnerabilities on the fly, utilizing a local SQLite caching system to prevent API rate limits.
- 📊 Rich Terminal UI & Reporting: Features a highly interactive setup wizard, color-coded terminal tables, and robust export capabilities (JSON, HTML, Markdown).
- 🐳 Docker Ready: Fully containerized environment for isolated, dependency-free execution with optimized caching.
Provides an intuitive, colorized CLI wizard to quickly configure targets, port profiles, and scan modes.
Loads the machine learning models and initializes the OODA (Observe, Orient, Decide, Act) loop for target analysis.
For a text-based preview of the tool in action, expand the section below:
Click to view the full raw terminal output
C:\Users\Egcae>syn
██████ ▓██ ██▓ ███▄ █
▒██ ▒ ▒██ ██▒ ██ ▀█ █
░ ▓██▄ ▒██ ██░▓██ ▀█ ██▒
▒ ██▒ ░ ▐██▓░▓██▒ ▐▌██▒
▒██████▒▒ ░ ██▒▓░▒██░ ▓██░
▒ ▒▓▒ ▒ ░ ██▒▒▒ ░ ▒░ ▒ ▒
[ INTERACTIVE SETUP ]
[?] Target IP/Hostname (127.0.0.1): 127.0.0.1
Port Scanning Profiles:
[1] FAST - Top 10,000 Ports (Includes 9999, 10000, 8443 etc.)
[2] ALL - 1-65535 All Ports (Thorough but slow)
[3] CUSTOM - Specify a custom range (e.g., 50-500)
[?] Select Port Profile [1/2/3/FAST/ALL/CUSTOM] (1): 1
Available Scan Modes:
[1] SMART - Autonomous AI Decision Engine (Recommended)
[2] ASYNC - Ultra-Fast TCP Connect Scan
[3] STEALTH - Scapy Stealth Scan (Requires root/admin)
[?] Select Mode [1/2/3/SMART/ASYNC/STEALTH] (1): 2
[?] Output Format [console/json/html/md] (console): console
Summary: Target: 127.0.0.1, Ports: 1-10000, Mode: ASYNC, Report: console
[?] Are these settings correct? [y/n] (y): y
[ SYN ENGINE INITIALIZATION ]
[09/18/26 12:10:35] INFO [SYSTEM] Loading AI inference models...
INFO [SYSTEM] AI models initialized successfully.
INFO
[bold cyan]>>> Scanning Target: 127.0.0.1 <<<[/bold cyan]
INFO [EXEC] Commencing Async TCP Scan: 127.0.0.1 (1-10000)
[09/18/26 12:13:06] INFO [EXEC] Commencing deep service fingerprinting...
[09/18/26 12:13:22] INFO [AI_EXEC] Preprocessing network vectors for AI consumption...
[09/18/26 12:23:58] INFO [AI_EXEC] Inference successful: OS footprints and anomaly scores mapped.
SYN - Advanced Scan & AI Analysis Results
┌───────────┬──────┬───────┬───────────────────────┬──────────┬────────────────────┐
│ Target IP │ Port │ State │ Service / Banner │ AI OS │ Risk / Web Surface │
├───────────┼──────┼───────┼───────────────────────┼──────────┼────────────────────┤
│ 127.0.0.1 │ 135 │ OPEN │ MSRPC (Port Fallback) │ Linux/64 │ MEDIUM RISK │
│ 127.0.0.1 │ 445 │ OPEN │ SMB (Port Fallback) │ Linux/64 │ HIGH RISK │
│ 127.0.0.1 │ 2179 │ OPEN │ Unknown (No Banner) │ Linux/64 │ SAFE │
│ 127.0.0.1 │ 5040 │ OPEN │ Unknown (No Banner) │ Linux/64 │ SAFE │
│ 127.0.0.1 │ 7070 │ OPEN │ Unknown (No Banner) │ Linux/64 │ SAFE │
│ 127.0.0.1 │ 7680 │ OPEN │ Unknown (No Banner) │ Linux/64 │ SAFE │
└───────────┴──────┴───────┴───────────────────────┴──────────┴────────────────────┘
>>> WARNING: CRITICAL RISKS OR VULNERABILITIES DETECTED! <<<
Port 135 Detailed Analysis:
Warning: OPEN PORT 135 (RPC).
Action: Restrict access to this port to local network only.
Port 445 Detailed Analysis:
Warning: OPEN PORT 445 (SMB) and AI guessed Linux! Likely Samba service. Check for Samba vulnerabilities.
Action: Samba service may be vulnerable. Check version and update.
[09/18/26 12:24:00] INFO [SYSTEM] Execution halted. Scan complete.Running via Docker ensures all scapy dependencies (like tcpdump and libpcap) are perfectly isolated.
git clone https://github.com/egnakesec/syn.git
cd syn
docker-compose up --buildNote: The docker-compose.yml uses network_mode: "host" to ensure stealth scans and proper port bindings work flawlessly.
If you prefer running it locally on your host machine:
git clone https://github.com/egnakesec/syn.git
cd syn
pip install -e .SYN defaults to its Interactive Wizard if no arguments are provided. Simply type syn in your terminal:
synFor automated pipelines or power users, SYN supports direct execution:
# Autonomous AI Scan on a specific port range
syn 192.168.1.1 1 1000 --mode SMART
# Ultra-Fast Async Scan (No root needed) with JSON reporting
syn scanme.nmap.org 80 443 --mode ASYNC --report json
# Stealth TCP SYN Scan (Requires Root/Admin Privileges)
sudo syn 10.0.0.5 1 65535 --mode S| Mode | Description | Privileges Required |
|---|---|---|
| SMART | Autonomous AI Decision Engine. Analyzes initial state and pivots dynamically. | User / Root |
| ASYNC | Ultra-fast concurrent TCP connect scan. | User |
| S | TCP SYN Stealth Scan (Half-open scanning). | Root |
| A | TCP ACK Scan (Used for firewall mapping). | Root |
| F | TCP FIN Scan (Bypasses stateless firewalls). | Root |
| X | TCP XMAS Scan (Lights up the packet like a Christmas tree). | Root |
| N | TCP NULL Scan (No flags set). | Root |
| U | UDP Scan (Detects stateless UDP services). | Root |
Generate comprehensive reports using the --report flag:
console: Rich terminal output (Default)json: Machine-readable JSON outputhtml: Beautifully styled HTML reportmd: Markdown format for easy sharing
- Reconnaissance & Expansion: Resolves domains, performs subdomain enumeration via OSINT, and executes initial host discovery.
- AI Pre-Processing (OODA Loop): Initial stealth probes measure TTL and Latency.
- Inference: The Scikit-Learn Random Forest and Anomaly Detection models classify the host (Windows/Linux/Custom) and score the network anomaly.
- Execution Pivot: Based on the AI decision, SYN automatically switches to the optimal scan payload (e.g., Async, Stealth, FIN).
- Deep Fingerprinting: Grabs banners and analyzes HTTP web surfaces dynamically.
- Vulnerability Assessment: Queries the local NVD cache and live API for CVEs matching the grabbed banners.
SYN Framework is developed exclusively for educational purposes and authorized professional penetration testing. The author assumes no liability and is not responsible for any misuse, damage, or unauthorized access caused by this tool. Always obtain explicit, written authorization before scanning any network or system.
Developed by Egnake.