yakit-data-extract-plugin

Q: What does the yakit-data-extract-plugin skill do?

解决一个高频实战痛点：在 Yakit History 里积累了某站点大量流量后，如何一键按域名捞取所有唯一 路径、拿到登录 Cookie，并把这些路径沉淀成可复用的 Payload 字典，再带着登录态逐路径发包扫描/Fuzz。 覆盖 db.QueryHTTPFlowsByKeyword 捞 History、URI 去重、Cookie 提取、db.SavePayload/YieldPayload 字典管理、poc.HTTP 登录态发包。当用户想"从历史流量提取数据驱动后续扫描"时使用。

Q: How do I install yakit-data-extract-plugin?

Run npx skills add https://github.com/yaklang/yak-skills --skill yakit-data-extract-plugin in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/yakit-data-extract-plugin/ (personal) or .claude/skills/yakit-data-extract-plugin/ (project).

by yaklang

解决一个高频实战痛点：在 Yakit History 里积累了某站点大量流量后，如何一键按域名捞取所有唯一路径、拿到登录 Cookie，并把这些路径沉淀成可复用的 Payload 字典，再带着登录态逐路径发包扫描/Fuzz。覆盖 db.QueryHTTPFlowsByKeyword 捞 History、URI 去重、Cookie 提取、db.SavePayload/YieldPayload 字典管理、poc.HTTP 登录态发包。当用户想"从历史流量提取数据驱动后续扫描"时使用。

Installs: 121
Last 24h: —
Trending rank: —
Security: Not audited

Install

Works with every agent the skills CLI supports.

npx skills add https://github.com/yaklang/yak-skills --skill yakit-data-extract-plugin

01
Install
Run the command in your project. The CLI asks which agents to install for.
02
Describe the task
Ask your agent for something this skill covers. It loads yakit-data-extract-plugin automatically when relevant.
03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.

SKILL.md

The instructions your agent reads when the skill is triggered.

SKILL: Yakit 历史数据提取与字典驱动扫描

AI LOAD INSTRUCTION: 本 skill 针对一个具体痛点——“在 History 里堆了一堆某域名的流量，想把唯一路径全捞出来、拿到登录 Cookie，然后接着扫/Fuzz”。给出两个端到端可运行示例：按域名捞流量并去重提 Cookie、把去重路径接入 Payload 字典并带登录态真实发包扫描。两个示例都 yak <file> 自测通过，其中扫描示例会起本地真实靶站发真实 HTTP 请求作为证据。

0. 相关路由

总入口：yak
数据库 API（KV / Payload / 查询）：yaklang-database
想在 MITM 阶段直接采集而非事后捞库：mitm-hotpatch
训练材料交叉引用：yaklang-ai-training-materials/library-usage/db/db-practice.yak

1. 痛点拆解

一个常见的工作流被卡在“数据搬运”上：

flowchart LR
    H[History 大量流量] --> Q[按 domain 捞取]
    Q --> D[URI 去重]
    Q --> C[提取登录 Cookie]
    D --> P[沉淀 Payload 字典]
    P --> S[带 Cookie 逐路径发包扫描]
    C --> S

手工做这件事很痛：路径重复、query 干扰去重、Cookie 散落在不同请求里、扫描时忘了带登录态。本 skill 用 db + poc 把每一步都脚本化。

2. 按 domain 捞 History + URI 去重 + 提取 Cookie

核心数据形态（先核实，勿臆测）：

来源	形态
`db.QueryHTTPFlowsByKeyword(domain)`	返回 `*HTTPFlow` 迭代器（channel）
`flow.Url`	完整 URL 字符串
`flow.Request`	`codec.StrconvQuote` 后的字符串，需 `codec.StrconvUnquote` 取原始字节
登录 Cookie	`poc.GetHTTPPacketHeader(req, "Cookie")`

collectFromHistory = func(domain) {
    pairs = []
    for flow in db.QueryHTTPFlowsByKeyword(domain) {
        req = codec.StrconvUnquote(flow.Request)~
        pairs = append(pairs, {"url": flow.Url, "req": []byte(req)})
    }
    return analyzePairs(pairs)   // 归一化去重 + 收集 cookie
}

去重 key 用“去掉 scheme 与 query 后的 host+path”，避免 ?page=1 / ?page=2 被当成两条。

完整示例：examples/collect-domain-urls.yak

3. 去重路径接 Payload 字典 + 带登录态发包扫描

把路径沉淀成 Yakit Payload 字典（持久化、可在 Web Fuzzer / 扫描器里复用），再带 Cookie 逐条发包，用状态码区分存活/不存在：

db.SavePayload(group, dedupPaths(paths))~        // 去重后入库
for path in db.YieldPayload(group) {             // 迭代字典逐条扫描
    raw = sprintf("GET %s HTTP/1.1\r\nHost: %s\r\nCookie: %s\r\nConnection: close\r\n\r\n", path, hostport, cookie)
    rsp, _ = poc.HTTP(raw, poc.timeout(5), poc.save(false))~
    code = poc.GetStatusCodeFromResponse(rsp)    // 200 存活 / 404 不存在
}

完整示例：examples/path-scan-with-payload.yak （自测会在本地随机端口起真实靶站，真正发出 HTTP 请求并校验状态码与 Cookie 透传）

4. 坑（先核实再写）

flow.Request / flow.Response 是 strconv-quote 之后的字符串，直接当原文用会带转义；务必 codec.StrconvUnquote(...)~。
db.YieldPayload(group) 直接产出 payload 内容字符串，不是带 .Content 字段的对象，直接用 p。
db.SavePayload 写的是 profile 持久库；脚本里用唯一前缀的 group 并 defer db.DeletePayloadByGroup(group) 清理，避免污染。
去重一定要先剥掉 query，否则同一接口的不同分页会被当成不同 URI。
发包扫描务必 poc.timeout(...) + poc.save(false)（自测/批量时不写库），避免卡死与污染 History。

5. 如何验证你写的提取/扫描脚本

直接 yak your-script.yak，让 YAK_MAIN 自测块用合成数据 + 本地靶站跑通逻辑。
想验证真实 History 捞取，可先用 mitm-hotpatch 采集几条流量再跑。
工具链与命令行验证方式见 yaklang-toolchain。

FAQ

What does the yakit-data-extract-plugin skill do?

How do I install yakit-data-extract-plugin?

Run npx skills add https://github.com/yaklang/yak-skills --skill yakit-data-extract-plugin in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/yakit-data-extract-plugin/ (personal) or .claude/skills/yakit-data-extract-plugin/ (project).

Which AI agents can use yakit-data-extract-plugin?

Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.

Is yakit-data-extract-plugin safe to install?

No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.

Who maintains yakit-data-extract-plugin?

It is published by yaklang in yaklang/yak-skills. It has 121 recorded installs.

More from yaklang/yak-skills

View all →

mitm-hotpatch

yaklang/yak-skills

Yakit MITM 热加载 (Hot Patch) 专题。当用户需要在 MITM 中间人代理中用代码动态劫持/修改请求与响应、镜像分析流量、入库前打标签染色、或对危险操作做 mock 护栏时使用。覆盖 hijackHTTPRequest / hijackHTTPResponseEx / mirror 系列 / hijackSaveHTTPFlow / mockHTTPRequest 全部 Hook 与 forward/drop 语义。

125 installs

yak

yaklang/yak-skills

Open the skill to read its SKILL.md instructions.

124 installs

global-hotpatch

yaklang/yak-skills

Yakit 全局热加载 (Global Hot Patch) 专题。当用户需要一处配置、让 MITM 与所有 Web Fuzzer Tab 共享同一套 hook 时使用：全站透明加解密、统一签名/认证注入、动态 challenge 应答、全站染色脱敏、危险操作护栏。全局 hook 先于模块 hook 执行，同时只能启用一个。复用 beforeRequest / afterRequest / hijackHTTPRequest / hijackSaveHTTPFlow / mockHTTPRequest。

124 installs

webfuzzer-hotpatch

yaklang/yak-skills

Yakit Web Fuzzer 热加载 (Hot Patch) 专题。当用户需要在 Web Fuzzer 单 Tab 发包时用代码自动加解密请求/响应、注入签名、智能重试、自定义业务失败判定、用 fuzztag 动态生成 payload、或从响应提取参数做关联测试时使用。覆盖 beforeRequest / afterRequest / retryHandler / customFailureChecker / mirrorHTTPFlow / mockHTTPRequest 与 {{yak(...)}} fuzztag。

123 installs

yaklang-database

yaklang/yak-skills

Open the skill to read its SKILL.md instructions.

Data & Databases120 installs

yaklang-toolchain

yaklang/yak-skills

Open the skill to read its SKILL.md instructions.

120 installs

Popular other skills

View category →

hyperframes-cli

heygen-com/hyperframes

The HyperFrames CLI by job - scaffold, check, look at frames, edit the timeline, preview, render locally or in the cloud, publish, project history - plus reading its JSON and recovering from build or render failures.

1.3M installs

triage

mattpocock/skills

Move issues and external PRs through a state machine of triage roles, categorise, verify, grill if needed, and write agent-ready briefs.

1M installs

ask-matt

mattpocock/skills

Ask which skill or flow fits your situation. A router over the skills in this repo.

778.4K installs

to-questionnaire

mattpocock/skills

Turn a decision you can't fully answer into a questionnaire for someone else to fill in.

508.9K installs

wait-what

mattpocock/skills

Stop. That last message did not land: re-pitch it.

459.7K installs

loop-me

mattpocock/skills

Grill me about specs for the workflows I want to build, within this workspace.

447.9K installs

yakit-data-extract-plugin

Install

Install

Describe the task

Review the result

SKILL.md

SKILL: Yakit 历史数据提取与字典驱动扫描

0. 相关路由

1. 痛点拆解

2. 按 domain 捞 History + URI 去重 + 提取 Cookie

3. 去重路径接 Payload 字典 + 带登录态发包扫描

4. 坑（先核实再写）

5. 如何验证你写的提取/扫描脚本

FAQ

More from yaklang/yak-skills

Popular other skills