yakit-basic

SKILL: Yakit Basic Usage

AI LOAD INSTRUCTION: Yakit is the graphical security testing platform of the Yak Project, composed of an Electron frontend + yaklang engine backend, the two communicating via gRPC. This page is the entry guide to "what is on the Yakit interface, what each functional area does, and how the engine connects". To write plugins/hot-load scripts please route to the corresponding specialized skill (see the route table in Section 6); this page only covers the UI and basic usage.

0. Related Routes

Main entry:yak
Script and UI interaction mechanism (yakit.* how library functions drive the interface display):yakit-ui-binding
Hot-load and plugin programming:mitm-hotpatch / webfuzzer-hotpatch / global-hotpatch
Native plugins + cli parameter forms:yakit-native-plugin
Right-click codec plugins:yakit-rightclick-plugin

1. Architecture Overview (understand the three-layer structure first)

flowchart LR
    subgraph Frontend["Yakit 前端 (Electron + React)"]
        UI["界面交互<br/>MITM/Fuzzer/Codec/扫描/插件..."]
    end
    subgraph Engine["yaklang 引擎 (本地进程)"]
        GRPC["gRPC Server<br/>yakgrpc"]
        Lang["Yaklang 脚本引擎<br/>common/yak"]
        Libs["内置库<br/>poc/codec/db/risk/synscan..."]
    end
    UI <-->|"gRPC 双向流<br/>ExecResult / 请求响应"| GRPC
    GRPC --> Lang
    Lang --> Libs
    Libs -->|"SQLite/GORM"| DB[("项目数据库<br/>profile/project")]

Key understanding:

The engine is an independent process: the yaklang engine is a locally launched gRPC service (the default port is automatically selected by the engine), and the frontend Electron application communicates with it through a gRPC bidirectional stream. The engine is responsible for executing all the "heavy work" such as yak scripts, scanning, MITM proxying, and packet sending.
The frontend is the display and interaction layer: the Yakit frontend (React + Electron) does not execute security logic; it translates user operations into gRPC requests, and renders the ExecResult streams returned by the engine into UI components such as logs, tables, charts, and risk cards.
The database has two layers：
- profile database: global configuration, plugin scripts (YakScript), Payload dictionaries, global KV, fingerprint library, etc.
- project database: historical traffic (HTTPFlow) that switches with the project, risks (Risk), port assets, domain assets, etc.

Source location: engine entry yaklang/common/yakgrpc/; frontend gRPC stream consumption yakit/app/renderer/src/main/src/hook/useHoldGRPCStream/; frontend route definition yakit/app/renderer/src/main/src/routes/newRoute.tsx。

2. Three UI Modes

The Yakit Community Edition has three modes, distinguished by the left menu form (yakit/app/renderer/src/main/src/routes/newRoute.tsx defined by YakitModeEnum in YakitModeEnum ):

Mode	Menu Form	Suitable Audience	Fixed Tab
Security Expert	Left icon bar + right-side "More" collapse	Experienced penetration testers	MITM / Web Fuzzer / History
Classic	Left tree-style collapsible menu	Beginners / those accustomed to traditional menus	Home / History
Scan	Left tree-style menu (simplified)	Only need batch scanning	-

The mode switch is in "System Settings"; after switching, the left menu and fixed tabs change accordingly.

3. Core Functional Area Route Table

Core pages extracted from the frontend YakitRouteToPageInfo and RouteToPage (grouped by function):

3.1 Penetration Testing

Function	Route key	Interface Purpose	Related skill
MITM interactive hijacking	`mitm-hijack`	Start the MITM proxy to view/modify/forward HTTP traffic in real time and load hot-reload hooks	mitm-hotpatch
Web Fuzzer	`httpFuzzer`	Single-tab packet sending and debugging, supporting fuzztag, hot reload, sequential packet sending, and data extraction	webfuzzer-hotpatch
Websocket Fuzzer	`websocket-fuzzer`	WebSocket protocol packet sending and fuzzing	-
Codec	`codec`	Encoding/decoding tool with built-in base64/url/hex/hash, etc. + custom codec plugins	yakit-rightclick-plugin
Data comparison	`dataCompare`	Compare differences between two pieces of data	-
Yak Runner	`yakScript`	Write/run yak scripts online, equivalent to an IDE	yaklang-syntax

3.2 Security Tools

Function	Route key	Interface purpose	Associated skill
Port/fingerprint scanning	`scan-port`	Port scanning + fingerprint identification	-
Specialized vulnerability detection	`poc`	Batch detection based on PoC plugins	yakit-native-plugin
Weak password detection	`brute`	Weak password brute-forcing	-
Cyberspace engine	`space-engine`	Cyberspace mapping engine search (Fofa/Hunter/Quake, etc.)	-
Subdomain collection	`plugin-op`(built-in)	Invoke the "Subdomain Collection" plugin	yakit-native-plugin
Basic crawler	`plugin-op`(built-in)	Invoke the "Basic Crawler" plugin	yakit-native-plugin
Directory scanning	`plugin-op`(built-in)	Invoke the "Comprehensive Directory Scanning and Brute-forcing" plugin	yakit-native-plugin

3.3 Plugins

Function	Route key	Interface purpose	Associated skill
Plugin repository	`plugin-hub`	Online plugin store with one-click download and installation	-
Batch execution	`batch-executor-page-ex`	Execute multiple plugins in batches	yakit-native-plugin
Plugin management	`plugin-audit`	Manage installed plugins (enable/disable/edit/review)	-
Create plugin	`add-yakit-script`	Create a new plugin (yak/mitm/codec types)	yakit-native-plugin

3.4 Reverse Connection

Function	Route key	Interface purpose
DNSLog	`dnslog`	DNS reverse connection detection
ICMP-SizeLog	`icmp-sizelog`	ICMP echo detection
TCP-PortLog	`tcp-portlog`	TCP port callback detection
Yso-Java Hack	`PayloadGenerater_New`	Java deserialization payload generation
Reverse connection server	`ReverseServer_New`	Unified reverse connection server management
Port listener	`shellReceiver`	Reverse shell listener

3.5 Database (Project Data)

Function	Route key	Interface purpose	Associated skill
History	`db-http-request`	All historical traffic generated by MITM/Fuzzer	yakit-data-extract-plugin
Traffic analyzer	`db-http-request-analysis`	Advanced analysis of historical traffic	-
Vulnerabilities and risks	`db-risks`	List of vulnerabilities/risks produced by scanning	-
Report	`db-reports-results`	View scan reports	-
Port	`db-ports`	Port asset list	-
Domain	`db-domains`	Domain asset list	-
Fingerprint library	`fingerprint-manage`	Web fingerprint rule management	-
CVE management	`cve`	CVE data query	-
Dictionary management	`payload-manager`	Payload dictionary management (linked with `db.SavePayload` linkage)	yaklang-database
Configuration management	`config-management`	Global configuration (proxy/Payload/hot-load templates)	global-hotpatch

3.6 AI features

Feature	Route key	UI purpose
AIAgent	`ai-agent`	AI chat and automation tasks
Knowledge base	`ai-repository`	AI knowledge base management
Tool library	`ai-tool`	AI tool management
Skill library	`ai-forge`	AI skill (Forge) management
Memory library	`ai-memory`	AI memory library

3.7 Code audit

Feature	Route key	UI purpose
Code scan	`yakrunner-code-scan`	Scan code based on SyntaxFlow rules
Code audit	`yakrunner-audit-code`	Code audit
AI code audit	`irify-ai-code-audit`	AI-assisted code audit
Audit vulnerabilities	`yakrunner-audit-hole`	Vulnerabilities found by code audit
Rule management	`rule-management`	Custom audit rules
Project management	`yakrunner-project-manager`	Audit project management
Java decompilation	`yak-java-decompiler`	Java class file decompilation

4. Engine connection and project switching

4.1 Engine connection

When starting the Yakit frontend for the first time, you need to connect to the engine:

Local engine: On the frontend "Engine Connection" page, select the local engine, and the frontend will automatically start the yaklang engine process.
Remote engine: Enter the gRPC address of the remote engine (host:port), and the frontend will connect via gRPC.

Engine startup entry:yaklang/common/yakgrpc/, the gRPC service port is automatically selected by the engine and notified to the frontend via IPC. Frontend gRPC client wrapper:yakit/app/renderer/src/main/src/services/electronBridge.ts。

4.2 Project switching

Yakit's "project" concept corresponds to an independent project database:

Switching projects = switching the project database, and data such as History/Risk/Port/Domain is isolated accordingly.
profile The database does not switch with the project (plugins, Payload dictionaries, and global configuration are always shared).
In scripts, use db.SetProjectKey / db.GetProjectKey The project-level configuration stored and retrieved also switches with the project. See yaklang-database。

5. Quick start path for beginners

flowchart TD
    A[安装 Yakit + 连接引擎] --> B[MITM 劫持: 配置代理, 浏览流量]
    B --> C[Web Fuzzer: 重放/修改请求]
    C --> D[Codec: 编解码/数据变换]
    D --> E[插件仓库: 下载社区插件]
    E --> F[写自己的插件: yak/mitm/codec]
    F --> G[热加载: 内联改流量]

Step	Operation	Corresponding functional area
1. Connect engine	Start Yakit → connect to local/remote engine	Engine connection page
2. MITM packet capture	Open MITM → set proxy → configure browser proxy → browse target	MITM interactive hijacking
3. Replay/modify	Right-click in History or MITM → send to Web Fuzzer	Web Fuzzer
4. Encode/decode	Select data → right-click encode/decode, or open the Codec page	Codec
5. Install plugins	Open plugin repository → search → install	Plugin repository
6. Write plugins	New plugin → select type (yak/mitm/codec) → write code → save	New plugin
7. Hot loading	MITM configuration → paste code in hot-load window → enable	MITM hot loading

6. Complete routing table (to each topic skill)

Requirements	Enter skill
MITM proxy hijacking/modifying request responses	mitm-hotpatch
Web Fuzzer single Tab packet sending, encryption/decryption/signing/retry	webfuzzer-hotpatch
Global hot reload (shared by MITM + Fuzzer)	global-hotpatch
Write/understand Yaklang syntax	yaklang-syntax
Data persistence and querying	yaklang-database
Write yak/mitm plugins with parameter forms	yakit-native-plugin
Write right-click codec plugins	yakit-rightclick-plugin
Extract data from History to drive scanning	yakit-data-extract-plugin
Validate plugins/hot-reload scripts	yaklang-toolchain
How yak scripts interact with the Yakit UI	yakit-ui-binding

Reference sources

Frontend route definition:yakit/app/renderer/src/main/src/routes/newRoute.tsx（YakitRouteToPageInfo / RouteToPage）
Frontend gRPC stream consumption:yakit/app/renderer/src/main/src/hook/useHoldGRPCStream/useHoldGRPCStream.ts
Engine gRPC service:yaklang/common/yakgrpc/
Script engine injection:yaklang/common/yak/yaklib/yakit_client.go（SetEngineClient override yakit global variable)
Pattern enumeration:yakit/app/renderer/src/main/src/store/softMode.ts（YakitModeEnum）