Jin: Your Passive OSINT & Recon CLI Toolkit

Version: 2.7.0

Jin is an open-source command-line interface (CLI) toolkit for OSINT (Open-Source Intelligence) and reconnaissance. It gathers server, network, and technology-stack information about a target using passive, safe techniques — no active exploitation. This tool is intended for ethical and educational use only—please refrain from using it for harmful actions.

Overview

Jin provides a suite of commands to assist with network reconnaissance, domain analysis, and vulnerability assessment. Built with Go, it is lightweight, portable, and containerizable with Docker, making it accessible for security researchers, students, and enthusiasts.

Commands

• info: Full server reconnaissance — response headers, TLS version, and a weighted security grade (0–100, A+→F). Ideal for quick posture checks.
• ports: Scan for open ports using a TCP connect scan (custom port lists supported).
• tech-stack: Fingerprint the technology stack (CMS, server, frameworks, JS libraries, CDN) with confidence levels and evidence. Add --subdomains for passive subdomain + DNS discovery, and --cve to cross-reference detected versions against the NVD — results are sorted newest-first and flagged when CISA's Known Exploited Vulnerabilities (KEV) catalog confirms in-the-wild exploitation (with remediation deadline and required action), plus links to public exploit references (Exploit-DB, Metasploit, PoCs).
• dns: Resolve a domain's DNS records (nameservers, MX, TXT).
• subdomains: Enumerate subdomains passively via certificate transparency logs (crt.sh).
• whois: Registration data (RDAP) for a domain — registrar, creation/expiry, nameservers.
• scan: One combined report covering info + ports + tech-stack (accepts the same flags).
• diff: Compare two saved JSON reports and print what changed.
• completions: Emit a shell completion script (bash, zsh, or fish).

Shared flags

Flag	Description
-t, --target <host>	Target URL or host for most commands. Accepts host, host:port, [IPv6]:port, and full URLs.
-j, --json	Output as JSON (for piping/automation).
-o, --output <file>	Write the JSON report to a file instead of stdout.
-p, --ports <list>	Custom ports for the ports/scan commands (comma-separated). Wins over a port embedded in the target.
-s, --subdomains	Include subdomain + DNS discovery (tech-stack/scan).
--cve	Cross-reference detected versions against the NVD. CVEs are listed newest-first and annotated when CISA's KEV catalog confirms in-the-wild exploitation (due date + required action), with public exploit references where available. (tech-stack/scan).
--min-grade <grade>	CI gate: exit non-zero if the security grade is below this (e.g. B).
--fail-on-low	CI gate: exit non-zero if the security grade is below C.
--cache-dir <dir>	On-disk cache directory for NVD/crt.sh results (default ~/.jin/cache).
--no-cache	Disable the on-disk result cache (per-run dedupe stays on).
--nvd-cache-ttl <dur>	TTL for cached NVD CVE lookups (default 24h).
--ct-cache-ttl <dur>	TTL for cached crt.sh enumerations (default 6h).
--nvd-rate-limit <n>	NVD requests per 30s window (default 5, or 50 with an API key).

NVD queries are rate limited (5 req/30s unauthenticated) and retried with backoff on throttling; set JIN_NVD_API_KEY (or nvd_api_key in ~/.jin.json) to raise the budget to 50 req/30s. Throttling is reported as a warning instead of being silently treated as "no CVEs".

With --cve, CVE results are cross-referenced against CISA's KEV catalog (one cached request per run): a CVE known to be exploited in the wild is flagged KNOWN EXPLOITED with its remediation deadline and required action, alongside any public exploit references (Exploit-DB, Metasploit, PoCs). This is informational only — Jin never executes or deploys an exploit.

Installation

Homebrew (recommended)

brew tap sapiuwu/jin
brew install jin

Prerequisites

• Homebrew (for the tap above)
• Go 1.25 or higher (to build from source)
• Docker (optional, for containerized usage)

From Source

1. Clone the repository:

   git clone https://github.com/sapiuwu/jin.git
   

2. Navigate to the project directory:

   cd jin
   

3. Build the binary:

   go build -o jin ./cmd/
   

4. Run the CLI:

   ./jin
   

Using Docker

1. Pull an image from Docker Hub (built per base image, e.g. alpine-latest, debian-bookworm, ubuntu-24.04):

    docker pull wahyouka/jin:v2.4.1-alpine-latest
   

2. Interactive mode (REPL — recommended). Running with no command enters the REPL: the prompt returns after each command so you can keep investigating. Always add --rm so the container is automatically removed when you quit (exit/quit or Ctrl+C) — this prevents leftover ("sampah") containers piling up:

   docker run -it --rm wahyouka/jin:v2.4.1-alpine-latest
   

   Inside the REPL you can type commands or a bare URL, e.g.:

   jin> https://example.com
   jin> ports -t example.com -p 80,443
   jin> dns -t example.com
   jin> exit
   

3. One-shot command. Pass the command directly; the program runs once and exits. Add --rm to clean up the container automatically:

   docker run -it --rm wahyouka/jin:v2.4.1-alpine-latest ports -t example.com
   docker run -it --rm wahyouka/jin:v2.4.1-alpine-latest dns -t example.com
   docker run -it --rm wahyouka/jin:v2.4.1-alpine-latest subdomains -t example.com
   

4. Reuse a single container (no --rm). docker run always creates a new container, so if you prefer one persistent container, give it a name and reconnect or run commands into it:

   docker run -it --name jin-session wahyouka/jin:v2.4.1-alpine-latest   # then quit
   docker start -ai jin-session                                          # reconnect to REPL
   docker exec -it jin-session ports -t example.com                      # run a command inside it
   docker rm -f jin-session                                              # remove when done
   

5. (Optional) Build the image locally:

   docker build -t <yourusername>/jin:latest .
   docker push <yourusername>/jin:latest
   

Usage

Interactive mode (recommended)

Running jin with no arguments starts an interactive session. Type any of the commands below (or a bare URL), press Enter to run it, and the prompt returns afterwards so you can keep investigating. Press Ctrl+C (or type exit/quit) to leave. Up/Down arrow keys recall history, and Tab completes command names.

jin
jin> https://example.com
jin> ports -t example.com -p 80,443
jin> tech-stack -t example.com --subdomains --cve
jin> dns -t example.com
jin> whois -t example.com
jin> scan -t example.com -o report.json
jin> exit

One-shot commands

For scripts and Docker, commands can also be passed directly — the program runs once and exits:

jin <command> [options] <url> [options]

Or, using Docker:

docker run -it <yourusername>/jin:latest <command> [options] <url> [options]

Roadmap

Planned fixes and improvements are tracked in ROADMAP.md (complete SARIF output is next). Latest-CVE detection with CISA KEV exploit-status cross-referencing shipped in v2.7.0 (Phase 3); NVD/crt.sh rate limiting & caching shipped in v2.6.0 (Phase 2); IPv6 / host:port target parsing shipped in v2.5.0 (Phase 1).

Contributing

We welcome contributions! To contribute:

1. Fork the repository.
2. Create a feature branch: git checkout -b feature-name.
3. Commit changes: git commit -m "Add feature-name".
4. Push to the branch: git push origin feature-name.
5. Submit a pull request.

License

This project is licensed under the Apache 2.0 License. See the LICENSE file for details.

Disclaimer

The tools in this project are intended for ethical and educational purposes only. Use them responsibly and avoid actions that could harm others or violate privacy laws.

About

Jin began as sapiuwu/jin, a project focused on ethical port scanning and DDoS simulation for educational purposes. It has since been rewritten in Go and repurposed as a passive OSINT and recon toolkit for security research and education.