v2.7.0

Latest-CVE detection & exploit awareness for tech-stack --cve / scan --cve.

Phase 3: Latest-CVE detection & CISA KEV exploit awareness

• Parse the NVD publishedDate and filter advisory references down to public exploit / PoC links (Exploit-DB, Metasploit, Packet Storm, raw GitHub PoCs), capped per CVE in nvd_cve_checker.go.
• Sort CVE results newest-first; the domain model gains Published, References, KnownExploited, and KEV fields (internal/domain/cve.go).
• CISA KEV cross-reference: the catalog is fetched once per run (cached alongside NVD data, TTL follows --nvd-cache-ttl) under a mutex so concurrent CVE checks hit it exactly once.
• Flag confirmed exploited CVEs as KNOWN EXPLOITED with CISA's remediation deadline + required action in human and JSON reports (present_techstack.go).
• Unit tests: newest-first ordering, exploit-link filtering, KEV enrichment, graceful degradation when the KEV feed is down, single-fetch-per-run.

This release also carries the previously-untagged Phase 2 (v2.6.0) work: NVD/crt.sh rate limiting, two-layer caching, and throttle transparency.

Jin v2.5.0

Bugs that produce wrong results today.

P1: IPv6 / host:port target parsing

• Add a single centralized target parser, internal/hostutil (Split/Host/DialAddress/RootDomain), and route every parsing site through it (replaces the 5 manual "cut at first colon" sites):
  • internal/adapter/in/cli/args.go — cleanHost (deleted; did not strip :port or brackets at all)
  • internal/application/service/full_scan_service.go (manual stripping deleted; target passed straight to the port use case)
  • internal/application/service/techstack_service.go — rootDomain (deleted; now hostutil.RootDomain)
  • internal/adapter/out/scanner/tls_inspector.go — tlsHost (now a one-liner over hostutil.Host)
  • internal/adapter/out/scanner/http_server_scanner.go — extractRootDomain (deleted; now hostutil.RootDomain)
• Fix false "closed" ports: jin ports -t example.com:8080 used to dial example.com:8080:443 (tcp_port_scanner.go:69) and report every port closed. The target is now parsed once in PortScanService.Scan and dialed via net.JoinHostPort (hostutil.DialAddress).
• Make IPv6 literal targets (2001:db8::1, [::1]:8080) dialable in tcp_port_scanner.go.
• Port-selection precedence (was undefined): explicit -p list > port embedded in the target (validated 1–65535) > configured defaults.
• Add the first unit tests of the project — table-driven tests in internal/hostutil/hostutil_test.go (Split, Host, DialAddress, RootDomain covering [::1], [::1]:8080, 2001:db8::1, example.com:8080, example.com, https://example.com/path, credentials, trailing dot, IP literals) plus internal/application/service/port_scan_service_test.go (host extraction, port precedence, error propagation) using a fake out.PortScanner.

JIN v2.4.0

What's new in v2.4.0

CLI interface improvements

• Reworked the command-line interface with richer output presenters for scans, DNS, subdomains, tech-stack, and WHOIS results.
• Added shell completions support for faster command discovery.
• Improved help text, banner, and argument parsing.

WHOIS via RDAP

• New whois module backed by RDAP, with a dedicated presenter for structured registration output.

CVE checking

• New NVD CVE checker that correlates detected technologies against known CVEs.

Full scan

• New full-scan service that chains tech-stack, DNS, subdomain, WHOIS, and CVE checks into a single run.

Tech-stack scanning

• Expanded detection coverage and evidence reporting in the tech-stack module.

Install

• Added Homebrew install instructions to the README.

Getting started

git clone https://github.com/sapiuwu/jin.git && cd jin && go build -o jin ./cmd/
./jin

JIN v2.3.0

What's new in v2.3.0

Interactive REPL

• Run jin with no arguments for a readline-powered interactive shell: tab completion, persisted command history (~/.jin_history), and Ctrl+C to abort in-flight scans and exit cleanly.
• help, exit/quit, and Ctrl+D (EOF) supported; a plain line-reader fallback kicks in when stdin is not a TTY.

tech-stack module

• Fingerprint websites across 13 categories (CMS, web servers, frameworks, JS libraries, CSS, CDN, WAF, analytics, security, and more). Every detection includes a confidence level and the concrete evidence that triggered it.
• --subdomains / -s flag: passive subdomain discovery via certificate transparency logs (crt.sh) plus DNS record lookup (nameservers, MX, TXT). Each discovered subdomain is fingerprinted independently.

Hexagonal architecture

• Full refactor into domain / application / ports-and-adapters layers with a composition root in cmd/main.go, making the codebase easier to test and extend.

info module enhancements

• Weighted security report (0-100 score, A+ to F grade) covering TLS, HSTS, Content-Security-Policy (with lint warnings), X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy, cookie flags, CORS, and version disclosure.
• Cookie values are redacted in output; cloud provider detection (Google Cloud, Cloudflare, Microsoft Azure).

Other

• HTTP scanner improvements and dependency updates (golang.org/x/net).
• Docker images tagged wahyouka/jin:v2.3.0-*.

Getting started

bash git clone https://github.com/sapiuwu/jin.git && cd jin && go build -o jin ./cmd/ ./jin
Docker:
bash docker pull wahyouka/jin:v2.3.0 docker run -it --entrypoint jin wahyouka/jin:v2.3.0

JIN

• Improve scan http scan function - add security checker

jin:v2.0.0

• removed unused functions.
• refactored code structure into hexagonal arch.
• server information: Fetch server information and scan ports for the given URL.
• ports: Fetch all open ports.
• db: Fetch database technology.

Jin v.1.0.0

Current Tools

• server information: Fetch server information and scan ports for the given URL.
• scrape: Scrape website data and return server info in JSON format.
• dns: Fetches and displays DNS records for a given domain.
• subdomains: Enumerates subdomains of a target domain.
• whois: Retrieves WHOIS data for domain registration information.
• ssl: Analyzes SSL/TLS certificate details.
• robots: Fetches and displays robots.txt and sitemap.xml data.
• archive: Retrieves historical snapshots from the Wayback Machine.
• security: Analyzes security headers of a target.
• tech: Detects and displays the technology stack of a website.

Update

• Migrate from python into golang.

Full Changelog: https://github.com/aliftech/jin/commits/v.1.0.0

v.0.3.0

• update the scan command add new parameter -wl to customize the log file name.
• update the map command add new parameter -wl to customize the log file name.
• add logs command to manipulate log file like, read, list, and delete.

Full Changelog: v.0.2.0...v.0.3.0

JIN v.0.2.0

• Interactive CLI app
• Containerized the CLI application

JIN v.0.1.0

• mapping a urls of web page
• mapping open port of targeted url
• send a ddos attack to targeted url.
• logging a url list in mapping url function
• light-weight and simple cli command