RinHit

RinHit - macOS ecosystem reconnaissance framework. Collects artifacts from the Apple ecosystem to build timelines of network activity, cross-device identity, and physical location correlation.

This is the open-source reconnaissance module. The closed-source Swift payload (rinhit-agent) is used internally by our redteam and is not part of this repository.

Features

• Wi-Fi Network Recon - Parses com.apple.wifi.known-networks.plist (legacy) or uses networksetup (macOS 15+ Data Vault)
• Bluetooth Devices - Paired, cached, and connected devices from com.apple.Bluetooth.plist
• USB Device History - Connected USB devices via ioreg (IOKit) and system_profiler
• Correlation Engine - Cross-artifact analysis:
  • Cross-device identity (iPhone hotspot + AirPods)
  • Travel patterns (hotel/guest Wi-Fi detection)
  • Home/Office fingerprint (ISP router detection)
  • Temporal session clustering
• Offline BSSID Geolocation - SQLite cache with Wigle CSV import
• Severity Scoring - Cloud Sync = high, mobile hotspot = medium, etc.
• JSON Output - Structured reporting for further analysis

Installation

# Clone
git clone https://github.com/toxy4ny/rinhit.git
cd rinhit

# Build
go build -o rinhit ./cmd/rinhit

# Or install directly
go install ./cmd/rinhit

Usage

List available collectors

./rinhit list

Run all collectors (requires sudo for Wi-Fi)

sudo ./rinhit scan -v

Run specific collectors

sudo ./rinhit scan -c wifi,bluetooth -v

Run with correlation engine

sudo ./rinhit scan --correlate -v

Save report to file

sudo ./rinhit scan -o report.json

Geolocation database

# Import Wigle CSV dump
./rinhit geo import wigle-export.csv

# Lookup a BSSID
./rinhit geo lookup AA:BB:CC:DD:EE:FF

# Show cache stats
./rinhit geo stats

Example Output

{
  "generated_at": "2026-08-21T21:09:10Z",
  "hostname": "MacBook-Pro-test.local",
  "user": "root",
  "artifacts": [
    {
      "id": "wifi-ns-iPhone7",
      "collector": "wifi",
      "type": "wifi-network",
      "name": "iPhone7",
      "severity": "medium",
      "timestamp": "2026-08-21T14:09:10-07:00",
      "source": "networksetup",
      "data": {"ssid": "iPhone7", "source": "networksetup"},
      "tags": ["wifi", "network", "macos15-fallback", "mobile-hotspot", "cross-device"]
    }
  ],
  "summary": {
    "total_artifacts": 12,
    "by_severity": {"info": 11, "medium": 1},
    "by_collector": {"wifi": 12}
  },
  "data": {
    "correlations": [
      {
        "type": "mobile-hotspot",
        "confidence": 0.7,
        "description": "Mobile hotspot 'iPhone7' detected - indicates iPhone/iPad tethering usage",
        "artifact_ids": ["wifi-ns-iPhone7"],
        "tags": ["mobile-hotspot", "tethering", "cross-device"]
      }
    ]
  }
}

Architecture

rinhit/
├── cmd/rinhit/main.go          # CLI entrypoint
├── pkg/
│   ├── collector/              # Collector interface & registry
│   │   ├── wifi/               # Wi-Fi artifact collector
│   │   ├── bluetooth/          # Bluetooth device collector
│   │   └── usb/                # USB device collector
│   ├── model/                  # Artifact & Report structs
│   ├── parser/plist/           # Plist parsing with SIP fallback
│   ├── reporter/json/          # JSON reporter
│   ├── correlator/             # Cross-artifact correlation engine
│   └── geoloc/                 # Offline BSSID geolocation cache

Extending

To add a new collector, implement the Collector interface:

type Collector interface {
    Name() string
    Description() string
    Collect(ctx context.Context) ([]model.Artifact, error)
    RequiresRoot() bool
}

Register it in buildRegistry() in cmd/rinhit/main.go.

OPSEC Notes

• RinHit operates in read-only mode - no system modifications
• On macOS 15+, Wi-Fi plist is protected by Data Vault - RinHit falls back to networksetup (living off the land)
• BSSID geolocation via public APIs can fingerprint the operator - use the offline SQLite cache for sensitive engagements
• Run with minimal privileges where possible - only wifi collector requires sudo

Roadmap

• Wi-Fi network reconnaissance (plist + networksetup fallback)
• Bluetooth paired/cached devices
• USB device history (ioreg + system_profiler)
• Correlation engine (cross-device, travel, temporal)
• Offline Wigle CSV import + BSSID lookup
• TCC database analysis
• Quarantine extended attributes
• Spotlight metadata search
• Unified Logs timeline
• SARIF output format
• Markdown human-readable reports

License

MIT - see LICENSE.

"Just as the weevil drills into fruit, lays eggs, and severs the stem to cover its tracks, RinHit drills into the Apple ecosystem, plants persistence, and erodes security boundaries from within."