RinHit - macOS 生态系统侦察框架。从 Apple 生态系统中收集痕迹，构建网络活动、跨设备身份和物理位置关联的时间线。
这是开源侦察模块。闭源 Swift 载荷（
rinhit-agent）由我们的红队内部使用，不属于本仓库。
com.apple.wifi.known-networks.plist（旧版）或使用 networksetup（macOS 15+ Data Vault）com.apple.Bluetooth.plist 的已配对、缓存和已连接设备ioreg (IOKit) 和 system_profiler 获取已连接的 USB 设备high，手机热点 = medium，等。# Clone
git clone https://github.com/toxy4ny/rinhit.git
cd rinhit
# Build
go build -o rinhit ./cmd/rinhit
# Or install directly
go install ./cmd/rinhit
./rinhit list
sudo）sudo ./rinhit scan -v
sudo ./rinhit scan -c wifi,bluetooth -v
sudo ./rinhit scan --correlate -v
sudo ./rinhit scan -o report.json
# Import Wigle CSV dump
./rinhit geo import wigle-export.csv
# Lookup a BSSID
./rinhit geo lookup AA:BB:CC:DD:EE:FF
# Show cache stats
./rinhit geo stats
{
"generated_at": "2026-08-21T21:09:10Z",
"hostname": "MacBook-Pro-test.local",
"user": "root",
"artifacts": [
{
"id": "wifi-ns-iPhone7",
"collector": "wifi",
"type": "wifi-network",
"name": "iPhone7",
"severity": "medium",
"timestamp": "2026-08-21T14:09:10-07:00",
"source": "networksetup",
"data": {"ssid": "iPhone7", "source": "networksetup"},
"tags": ["wifi", "network", "macos15-fallback", "mobile-hotspot", "cross-device"]
}
],
"summary": {
"total_artifacts": 12,
"by_severity": {"info": 11, "medium": 1},
"by_collector": {"wifi": 12}
},
"data": {
"correlations": [
{
"type": "mobile-hotspot",
"confidence": 0.7,
"description": "Mobile hotspot 'iPhone7' detected - indicates iPhone/iPad tethering usage",
"artifact_ids": ["wifi-ns-iPhone7"],
"tags": ["mobile-hotspot", "tethering", "cross-device"]
}
]
}
}
rinhit/
├── cmd/rinhit/main.go # CLI entrypoint
├── pkg/
│ ├── collector/ # Collector interface & registry
│ │ ├── wifi/ # Wi-Fi artifact collector
│ │ ├── bluetooth/ # Bluetooth device collector
│ │ └── usb/ # USB device collector
│ ├── model/ # Artifact & Report structs
│ ├── parser/plist/ # Plist parsing with SIP fallback
│ ├── reporter/json/ # JSON reporter
│ ├── correlator/ # Cross-artifact correlation engine
│ └── geoloc/ # Offline BSSID geolocation cache
要添加新的收集器，请实现 Collector 接口：
type Collector interface {
Name() string
Description() string
Collect(ctx context.Context) ([]model.Artifact, error)
RequiresRoot() bool
}
在 cmd/rinhit/main.go 的 buildRegistry() 中注册它。
networksetup（就地取材）wifi 收集器需要 sudoMIT - 参见 LICENSE。
"正如象鼻虫钻入果实、产卵并切断果梗以掩盖行踪，RinHit 钻入 Apple 生态系统，植入持久化，并从内部瓦解安全边界。"