yaklang/yakit

Features

• Cybersecurity Platforms - Provides a unified environment for conducting comprehensive security assessments, integrating traffic interception and vulnerability scanning.
• Web Application Fuzzers - Ships a comprehensive web application fuzzer using dynamic data generation to identify security vulnerabilities.
• HTTP Traffic Inspection - Runs an HTTP proxy to capture, decode, and modify requests and responses in real time.
• Traffic Interception Tools - Provides utilities for capturing and modifying HTTP traffic in real time to analyze and replay packets.
• Traffic Proxying - Intercepts and hijacks HTTP traffic via a proxy to manually edit, track, and replay packets.
• Security Logic Runtimes - Includes a dedicated high-performance scripting environment for developing and executing custom security logic and plugins.
• Man-in-the-Middle Frameworks - Provides a man-in-the-middle proxy to intercept, decode, and modify HTTP requests and responses in real time.
• Out-of-Band Security Testing - Monitors TCP, DNSLog, and ICMP callbacks to verify command execution or network egress on target systems.
• Parameter Fuzzing - Implements active testing of application input fields using malformed data to find injection points.
• Reverse Shells - Ships a reverse shell manager to control remote server connections and deliver exploitation payloads.
• Security Scripting Frameworks - Provides a dedicated security scripting environment for developing and executing custom logic and plugins.
• Security Tool Development - Supports the development of custom security tools and automation using a specialized high-performance language.
• Out-of-Band Interaction Monitoring - Monitors TCP, DNSLog, and ICMP callbacks to verify remote command execution via out-of-band interaction.
• Vulnerability Assessment and Testing - Automates the identification and verification of security flaws using PoC templates and custom scripts.
• Scanning Template Libraries - Integrates a library of proof-of-concept templates to automate the detection of known security flaws.
• Real-Time Modifications - Intercepts network requests and responses in real-time to view, edit, and replay data packets.
• HTTP Fuzzing - Provides tools for generating permutations of HTTP requests to discover hidden endpoints and test input validation.
• Fuzzing Parameter Tags - Uses a tagging system and external dictionaries to generate malformed data for automated HTTP fuzzing.
• Security Tool Orchestrators - Provides a unified interface to orchestrate and manage various cybersecurity tools during assessments.
• Internal Network Bridging - Maps internal network services to the public internet using reverse-shell tunneling to facilitate lateral movement.
• Multi-Protocol Port Multiplexing - Implements multi-protocol port multiplexing to handle diverse network callbacks on a single listening port.
• Reverse Tunnels - Provides reverse-shell tunneling to map internal network services to the public internet for remote access.
• Automated Vulnerability Detection - Runs proof-of-concept scripts and templates to automatically identify known security flaws in target web services.
• Input Parameter Fuzzers - Includes a web application fuzzer for discovering vulnerabilities via dynamic parameter generation and dictionary attacks.
• Proof of Concept Execution - Integrates an ecosystem of proof-of-concept templates to run security probes and verify vulnerabilities on target systems.
• Remote Security Backend Management - Allows a local client to connect to and manage a remote backend for executing security tasks across networks.
• Remote Security Backends - Connects local clients to remote backends to facilitate security tasks across different network environments.
• Connection Control - Controls remote servers through reverse shells and delivers protocol payloads to exploit vulnerabilities upon connection.
• Shell Management - Controls remote server shells through a listener that provides a native terminal experience.
• HTTP Parameter Brute Forcing - Provides automated brute-forcing of HTTP parameters using wordlists and dynamic tags to discover accepted parameters.
• Plugin Frameworks - Ships a plugin framework that allows expanding the toolset using a dedicated scripting language.
• Automated Exploitation Frameworks - All-in-one security testing platform for automated penetration testing.

Star history