SuperAPI AI Directory
Partner中文AI newsFavorites
Skillsglobal-hotpatch

global-hotpatch

General & other

View repository

Updated 10-16 01:33

About this skill

SKILL: Yakit Global Hot Patch

AI LOAD INSTRUCTION: This is the "global layer" in the three-layer hot patch system. The global hot patch is a system-wide hook shared by MITM and Web Fuzzer; the execution order is 全局 HotPatch -> 模块 HotPatch, and only 1 can be enabled at a time. It is best suited for "protocol normalization"—define site-wide encryption/decryption/signing/coloring in one place, and MITM and all Fuzzer Tabs take effect automatically. First read the global vs module comparison, then look at examples/ for examples named by Hook.

0. Related Routes

1. Global vs Module

Dimension Global Hot Patch Module (MITM / Fuzzer) Hot Patch
Entry Config Management → Global Template MITM Config / Fuzzer Hot Patch window
Scope All MITM/Fuzzer traffic system-wide Only the current MITM task or Fuzzer Tab
Execution order Before module hook execution After global hook execution
Number enabled Only 1 can be enabled at a time Independent per MITM/Tab
Suitable scenarios Protocol normalization, unified signing, site-wide coloring, guardrails for dangerous operations Specialized handling for a single task/single endpoint 
flowchart TB
    Flow["一个 HTTP 请求/响应"] --> G["全局 HotPatch (beforeRequest/afterRequest/...)"]
    G --> M["模块 HotPatch (MITM 或当前 Fuzzer Tab)"]
    M --> Done["出站 / 回显 / 入库"]

2. Available Hooks (same set as MITM, global executes first)

Global hot patch shares with MITMthe same MixPluginCaller execution pipeline and Hook set(backend mitm_global_hotpatch_pipeline.go: at each hook point first globalCaller then moduleCaller). Therefore mitm-hotpatch 's 12 Hooks at the global layer areall available, with completely identical signatures, the only difference being: global executes before module, and takes effect across MITM+Fuzzer.

The yakit default global template uses hijackHTTPRequest + beforeRequest + hijackSaveHTTPFlow to stamp the whole site with the X-Yakit-Global-HotPatch marker.

3. Index of All Hook Examples (examples/, one example per function)

In the table,every Hook has an independent global-style example + YAK_MAIN self-test, plus 2 advanced multi-Hook examples reproducing real articles.

Hook Global example scenario File
hijackHTTPRequest Stamp all outbound requests with a global marker examples/hijack-request.yak
hijackHTTPResponse Stamp all responses with a global marker examples/hijack-response.yak
hijackHTTPResponseEx Conditionally rewrite responses based on request context examples/hijack-response-ex.yak
beforeRequest Automatic injection of default Authorization Bearer examples/before-request.yak
afterRequest Site-wide unified response audit marker examples/after-request.yak
mirrorHTTPFlow Site-wide traffic audit count examples/mirror-http-flow.yak
mirrorFilteredHTTPFlow Site-wide focused audit after traffic filtering examples/mirror-filtered-http-flow.yak
mirrorNewWebsite Site-wide asset inventory examples/mirror-new-website.yak
mirrorNewWebsitePath Site-wide path inventory examples/mirror-new-website-path.yak
mirrorNewWebsitePathParams Site-wide inventory of Fuzzable endpoints examples/mirror-new-website-path-params.yak
hijackSaveHTTPFlow Site-wide coloring + tagging by status code examples/hijack-save-http-flow.yak
mockHTTPRequest Global kill-switch intercepts blacklisted domains examples/mock-http-request.yak

Advanced (real article reproduction, multiple Hook combinations):

Scenario Hook combination File
Site-wide SM4-CBC transparent encryption/decryption + plaintext stored in database beforeRequest + afterRequest + hijackSaveHTTPFlow examples/advanced-sm4-transparent.yak
Dynamic Challenge + HMAC signature injection + response decryption beforeRequest + afterRequest + hijackSaveHTTPFlow examples/advanced-challenge-sign.yak

Key point: the dynamic challenge chain in article 009

examples/advanced-challenge-sign.yak Fully reproduces the scenario of official account 009; for self-testing use thereal packet capture dataoffline assertions:

  1. beforeRequest: when it hits /api/user/info , proactively GET /api/get-challenge, decrypt to get the nonce, compute the HMAC signature, and write X-Auth-Signature。
  2. afterRequest: when the request carries X-Yak-Force-Plaintext: 1 , decrypt the response with AES-CBC into plaintext (to avoid unconditional rewriting breaking the browser frontend decryption).
  3. hijackSaveHTTPFlow: MITM does not touch online traffic, it only rewrites the responses stored in the database into plaintext for easier analysis.
sequenceDiagram
    participant F as Fuzzer/浏览器
    participant H as 全局热加载
    participant C as /api/get-challenge
    participant T as /api/user/info
    F->>H: 发起 /api/user/info (无签名)
    H->>C: beforeRequest 主动 GET challenge
    C-->>H: 加密 challenge + iv
    H->>H: 解密得 nonce, HMAC 算签名
    H->>T: 带 X-Auth-Signature 重新发出
    T-->>H: AES-CBC 密文响应
    H-->>F: afterRequest 解密 (按需) / 入库存明文

4. Standard approach: hook function + YAK_MAIN self-test

Exactly the same as MITM/Fuzzer—register the hook, then use if YAK_MAIN { runSelfTest() } as a guard.

  • yak xxx.yak：YAK_MAIN = true, run the self-test.
  • yakit global hot-reload window:YAK_MAIN = false, only register the hook.

Online hooks (such as the fetchChallengeSignature in the challenge chain, which requires poc.HTTP to send a secondary request) can, during self-testing, verify only thepure functionsthey depend on (signature computation, response decryption), avoiding self-tests that depend on a real target.

Concurrency and global variables (important): global hot-reloading has a broader scope and higher concurrency. At the top level, put only read-only constants(keys/IV/rules, not modified after being loaded once),never write shared mutable globals inside a hook, otherwise concurrent writes from multiple requests will cause a data race crash. For cross-request aggregation use sync.Map/sync.NewMutex() or db.*/risk.*. See webfuzzer-hotpatch section 6。

5. Verification

cd /Users/v1ll4n/Projects/yaklang
go run common/yak/cmd/yak.go skills/global-hotpatch/examples/advanced-challenge-sign.yak

# 与 Yakit gRPC 同款执行路径 (全局管线顺序: beforeRequest -> hijack -> afterRequest):
go build -o /tmp/yak ./common/yak/cmd/yak.go
printf 'GET / HTTP/1.1\r\nHost: t.example.com\r\n\r\n' > /tmp/req.txt
printf 'HTTP/1.1 500 Internal Server Error\r\nContent-Length: 4\r\n\r\nboom' > /tmp/rsp.txt
/tmp/yak hotpatch-global --script skills/global-hotpatch/examples/hijack-save-http-flow.yak --request /tmp/req.txt --response /tmp/rsp.txt

Each example should: complete within 10 seconds, pass all asserts, have all-English logs, and produce ... self test passed。

References

  • yak-project-public 009 (2026-03-18) Frontend encryption can't be tested, global hot-reloading helps you automatically take over the signature process
  • yak-project-public 030 (2025-10-24) Yakit hot-reloading practical tips
  • yak-project-public 085 (2024-11-27) Global configuration plugin environment variables
  • Engine implementation:common/yakgrpc/grpc_global_hotpatch_test.go