How yyhuni/xingrin works
XingRin is an attack-surface management platform for authorized asset discovery and security testing. Users manage organizations and targets, initiate or schedule scans, and review discovered assets, vulnerabilities, snapshots, and search results in the web UI. The README documents scan stages from subdomain discovery through vulnerability checks, plus distributed workers, notifications, and configurable scan engines. The tree and excerpts establish the relevant modules, but do not expose most runtime wiring; unverified links are dashed.
Main entry points: dashboard/page.tsx Web application · flow_orchestrator.py Flow orchestrator · fingerprint_detect_flow.py Fingerprint detection · overview/page.tsx Asset and findings UI
Components 24
Web interface
- Web application
frontend/app/[locale]/dashboard/page.tsx - Target management UI
frontend/app/[locale]/target/page.tsx - Scan UI
frontend/app/[locale]/scan/history/page.tsx - Asset and findings UI
frontend/app/[locale]/scan/history/[id]/overview/page.tsx - Search UI
frontend/components/search/search-page.tsx
Targets and scans
- Target management
backend/apps/targets/services/target_service.py - Scan control
backend/apps/scan/services/scan_control_service.py - Flow orchestrator
backend/apps/scan/orchestrators/flow_orchestrator.py
Discovery and analysis
- Subdomain discovery
backend/apps/scan/flows/subdomain_discovery_flow.py - Port scanning
backend/apps/scan/flows/port_scan_flow.py - Site discovery
backend/apps/scan/flows/site_scan_flow.py - Fingerprint detection
backend/apps/scan/flows/fingerprint_detect_flow.py - URL collection
backend/apps/scan/flows/url_fetch/main_flow.py - Directory scanning
backend/apps/scan/flows/directory_scan_flow.py - Site screenshots
backend/apps/scan/flows/screenshot_flow.py - Vulnerability scanning
backend/apps/scan/flows/vuln_scan/main_flow.py
Platform services
- Asset records
backend/apps/asset/services/asset/website_service.py - Asset snapshots
backend/apps/asset/services/snapshot/website_snapshots_service.py - Asset search
backend/apps/asset/services/search_service.py - Scan engines
backend/apps/engine/models/engine.py - Worker scheduling
backend/apps/engine/services/worker_service.py - Notifications
backend/apps/scan/notifications/services.py - Scan target provider
backend/apps/scan/providers/base.py
Other components
- Security user
Connections 25
- Security user → Web application: uses
- Web application → Target management UI: manages
- Web application → Scan UI: initiates
- Web application → Asset and findings UI: reviews
- Web application → Search UI: searches
- Target management UI → Target management: configures targets
- Scan UI → Scan control: controls scans
- Scan control → Flow orchestrator: orchestrates
- Flow orchestrator → Subdomain discovery: starts discovery
README.md - Subdomain discovery → Port scanning: then scans ports
README.md - Port scanning → Site discovery: then probes sites
README.md - Site discovery → Fingerprint detection: then fingerprints
README.md - Fingerprint detection → URL collection: then collects URLs
README.md - Fingerprint detection → Directory scanning: then scans directories
README.md - Fingerprint detection → Site screenshots: then captures screens
README.md - URL collection → Vulnerability scanning: then checks risks
README.md - Directory scanning → Vulnerability scanning: then checks risks
README.md - Site screenshots → Vulnerability scanning: then checks risks
README.md - Asset and findings UI → Asset records: views assets
- Asset and findings UI → Asset snapshots: compares snapshots
- Search UI → Asset search: queries assets
- Scan control → Scan engines: uses configuration
- Flow orchestrator → Scan target provider: gets targets
- Flow orchestrator → Worker scheduling: dispatches work
- Flow orchestrator → Notifications: reports progress