# Singularity of Origin: An Open Framework for DNS Rebinding Research

> Singularity of Origin is a DNS rebinding framework from NCC Group that ships a custom DNS server, an HTTP manager interface, sample payloads and an automated scanner, and it is published as awareness material alongside research on how to prevent the attack. Its own wiki covers the defence side as carefully as the attack side.

**nccgroup/singularity** — A DNS rebinding attack framework.

- Repository: https://github.com/nccgroup/singularity
- Website: https://github.com/nccgroup/singularity/wiki/%5BAnnouncement-Blog-Post%5D--Singularity-of-Origin:-A-DNS-Rebinding-Attack-Framework
- Stars: 1,320 · Forks: 159
- Language: JavaScript
- License: MIT
- Published: 2026-10-19 · Updated: 2026-10-19 · Language: en
- Canonical page: https://hysenlabs.com/projects/nccgroup-singularity

## The Attack and the Awareness Goal

Singularity of Origin is a tool to perform DNS rebinding attacks, and it includes the necessary components to rebind the IP address of the attack server DNS name to the target machine's IP address and to serve attack payloads to exploit vulnerable software on that target.

The project states its purpose in two parts. It aims at providing a framework to facilitate the exploitation of software vulnerable to DNS rebinding attacks, and to raise awareness on how they work and how to protect from them.

That second half is not a disclaimer, it is a deliverable. The wiki has a page on what DNS rebinding attacks are, a page on preventing them, a page on setup and installation, and a page describing the existing payloads and how to write your own. The public research record runs alongside the code, with a blog post on the state of DNS rebinding in April 2023, a DEF CON 27 video, a BSidesLV presentation on attack and prevention techniques, and a separate investigation into the impact of DNS over HTTPS on DNS rebinding attacks whose conclusion is that DoH has no effect on rebinding attacks and that protections advertised by providers can be bypassed.

The tool is written in Go, with the module named github.com/nccgroup/singularity and the manager interface and payloads served as HTML and JavaScript.

```toml
module github.com/nccgroup/singularity

go 1.25.0
```

## Four Components: DNS Server, Manager, Payloads, Scanner

The core features list describes a complete delivery stack, which is what distinguishes a framework from a single exploit script.

The custom DNS server is what performs the rebinding, resolving the attack server's DNS name to the target machine's IP address. The HTTP server is the manager web interface, which serves the HTML pages and JavaScript code to the targets and is also where you manage the attacks. Several sample attack payloads come with it, ranging from grabbing the home page of a target application to performing remote code execution, and the README says they can be easily adapted to perform new and custom attacks.

There is also an HTTP port scanner, described as simple, fast and efficient, to identify vulnerable services. And attack automation allows the scanning and exploitation of vulnerable services on a network to be completely automated.

One detail in the list is easy to miss and useful in practice. Singularity supports DNS CNAME values in the target specification in addition to IP addresses, and the stated reasons are to evade DNS filtering solutions and to target internal resources for which the IP address is unknown. A device on a local network often has no address you can guess from outside, and a CNAME sidesteps that.

The dependency set in the module manifest matches the design: a DNS library for the server, a router, a websocket library and a securecookie implementation for the manager interface.

## Hook and Control: The Victim Browser as a Proxy

The most distinctive feature is Hook and Control, which permits using the victim web browsers as HTTP proxies to access internal network resources, to interactively explore and exploit otherwise inaccessible applications with your own browser.

The idea is worth understanding, because it changes what a rebinding attack can achieve. Without it, the attack is a script that fetches a page and exfiltrates something, so the output is whatever the payload decided to send back. With it, the attacker's browser and the victim's browser are linked, and the victim browser becomes a proxy that can reach the local network from the attacker's side.

That turns a blind exploitation into an interactive one. You can browse an internal application that is only reachable from the victim's machine, using your own browser as the interface, which is the difference between proving a vulnerability and using it as a foothold.

The README also documents the automation side with a screenshot showing the scanning and compromise of all vulnerable applications on a network, and the manager interface screenshot shows the rails-rce-auto flow. So the three workflows the project is built around are the manual one, the hooked one, and the automated one.

## What Setup Requires: A Domain You Control and a Linux Server

The requirements are stated without softening them. Setting up Singularity requires a DNS domain name where you can edit your own DNS records for your domain, and a Linux server to run it. The detailed instructions are on the setup and installation wiki page.

Both requirements follow from the mechanism. A rebinding attack needs a DNS name whose address changes, and if you cannot edit the records for that name, the server has nothing to rebind. And since the attack is delivered through a browser making requests, the server has to be reachable from the client that will be lured to it.

There is a public test instance for demo purposes, and the demo site is at rebind.it, on port 8080, with the manager interface at the manager.html path. The IPv6 support in that demo was added in May 2025, and that change also modified the DNS query format, which the README calls a breaking change for manual queries made outside the Singularity Manager interface, with a wiki page on creating manual DNS requests.

The same note says new attack payloads are added periodically, so the payload list is a moving target and the wiki is the current state of it.

## Local Network Access and What Chrome 142 Changed

The most recent update in the README is the one that matters most for anyone trying the tool today, and it is dated 2025-11-25.

Chrome release 142 added Local Network Access, which prevents the DNS rebinding attack techniques implemented in Singularity. LNA is the browser-side control that stops a page served from the public internet from making requests to addresses on the local network, which is exactly the primitive the attack depends on.

Singularity of Origin's LNA-from-Non-Secure-Contexts branch implements support for the Trial for Local Network Access from Non-Secure Contexts, and the effect is described precisely: it temporarily allows access to resources on local networks from non-secure contexts, thus letting you experiment with DNS rebinding attacks a bit longer, until May 18, 2026, when using Chrome.

So the current state is that the technique is largely mitigated in Chrome, that an experimental branch exists for people who need to keep testing against it, and that the branch has an end date attached.

The April 2023 blog post described the same problem earlier. It documents Local Network Access as a new draft W3C specification currently implemented in some browsers that aims to prevent DNS rebinding, and shows two ways to bypass these restrictions, and it discusses the effects of WebRTC IP address leak mitigation and DNS Bit 0x20 on DNS rebinding attacks.

## The Browser Table and the Speed Claim

The README publishes a table of how the exploit behaves in different browsers, and it is a useful piece of information for anyone planning a test.

The claim is that Singularity has been tested to work with the listed browsers in optimal conditions in under three seconds. The rows give the time to exploit, the rebinding strategy, which is Multiple answers (fast), the fetch interval at one second, and the target specification.

Firefox on Windows 10, Chromium and Firefox on Ubuntu, and Chrome, Firefox and Safari on macOS are all listed at about three seconds. The Chrome and Edge rows on Windows 10 are struck through, which reads as those combinations no longer working in the way described, and the Chrome row being struck through is consistent with the later Local Network Access update.

The target specification column shows 127.0.0.1 for the Windows rows and 0.0.0.0 for the others, and the distinction is about how the rebinding address is expressed rather than about a different exploit.

The payload list itself is where the practical detail sits, with a basic fetch request as the simplest example, described as making a GET request to the root directory and showing the server response using the fetch API, and the README says the goal of that payload is to function as an example request to make additional contributions.

## Conclusion

Singularity of Origin fits a security researcher studying browser and router defences against DNS rebinding, and a defender who wants to reproduce the attack against their own test environment so the mitigation is verified rather than assumed. It is a poor fit for a production environment, since the tool needs its own DNS domain, a Linux server and a victim browser pointed at it, and a poor fit if your goal is only to check whether a service is exposed, since the scanning half is small compared with the payload half. Before using it, check the browser table in the README, because Chrome 142 added Local Network Access and the technique no longer works there without the experimental branch. The project is MIT licensed, the last push was on 2026-07-21, and it publishes no GitHub releases.

## FAQ

### What is Singularity of Origin?

It is a tool to perform DNS rebinding attacks, from NCC Group, that includes the components needed to rebind the IP address of the attack server DNS name to the target machine's IP address and to serve attack payloads to exploit vulnerable software on the target. The project states that it aims both to facilitate exploitation of vulnerable software and to raise awareness on how the attacks work and how to protect against them.

### What does running Singularity require?

A DNS domain name where you can edit your own DNS records for the domain, and a Linux server to run it. The detailed instructions are on the setup and installation wiki page, and a public test instance is available for demo purposes at rebind.it on port 8080.

### Does DNS rebinding still work in Chrome?

The README notes that Chrome release 142 added Local Network Access, which prevents the DNS rebinding techniques implemented in Singularity. An experimental branch implements support for the Trial for Local Network Access from Non-Secure Contexts, temporarily allowing access to local network resources from non-secure contexts until May 18, 2026.

### What is the Hook and Control feature?

It permits using the victim web browsers as HTTP proxies to access internal network resources, so you can interactively explore and exploit otherwise inaccessible applications with your own browser. The project also ships an HTTP port scanner and attack automation that can fully automate scanning and exploitation on a network.

### How does DNS over HTTPS affect rebinding attacks?

The README links to a blog post investigating the impact of DoH on DNS rebinding attacks, whose summary is that DoH has no effect on rebinding attacks and that protections advertised by providers can be bypassed.

## Sources

- [Issues](https://github.com/nccgroup/singularity/issues)
- [License: MIT](https://github.com/nccgroup/singularity/blob/master/LICENSE)
- [nccgroup/singularity on GitHub](https://github.com/nccgroup/singularity)
- [Project website](https://github.com/nccgroup/singularity/wiki/%5BAnnouncement-Blog-Post%5D--Singularity-of-Origin:-A-DNS-Rebinding-Attack-Framework)
- [README](https://github.com/nccgroup/singularity/blob/master/README.md)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/nccgroup-singularity