Widely Used Open-Source CybersecurityInfrastructure

“Deep data fusion in penetration tools is the inevitable trend in security tooling. Customizability and extensibility are basic needs for every senior penetration engineer, and excellent UI interaction is the catalyst for wide adoption. To build a tool covering the full penetration-test workflow, you need to understand every stage of the process. It is, however, a huge and long-term project requiring: 1) coders familiar with penetration processes and interaction design, 2) a company that unconditionally supports it, and 3) an operation team that constantly responds to user needs and feedback. The Yaikit project grew from this purpose and has the conditions to achieve it. I hope everyone uses it and offers fixes and optimization suggestions to make the project more complete and excellent.”

“For me, Yak is an excellent fusion language with strong security-development attributes; you can use it to efficiently develop security scripts, platforms, and tools. The Yak project not only created Yak but also thoughtfully built Yakit, a solo-operation platform for security practitioners. The birth of Yakit actually represents a kind of "unification" that brings many capabilities together, avoiding constant switching between tools and compatibility headaches. Although it is not a BurpSuite competitor, it has many similar features and is more practical. For example, Web Fuzz innovates by bringing real fuzzing thinking into web security, also reducing unnecessary dictionary collection. The Yak team made a bold attempt that many would not dare to make, requiring huge human investment, which I deeply admire and find inspiring. I believe Yak and Yakit will forge their own path in the future. Keep going — the future is bright!”

“Yakit is a very useful network solo-operation tool. It covers Burp Suite's most frequently used features and adds its own innovations. The Web Fuzzer tag greatly raises the ceiling for penetration testers, making tests more capable and convenient. Thanks to Yakit's Yaklang foundation and Go-like syntax, users can hook MITM with simpler code to implement a wide variety of plugins.”

“Yakit is a young, integrated platform with front-line attack-defense experience. It engineers excellent offensive experience into practical tooling, making life easier for front-line red-teamers. UI and polish still have room to improve. I hope Yakit keeps getting better!”

“The scanning interface is very convenient, and the built-in dynamic Yak-script parsing is also advanced. The team is awesome.”

“For the Yakit/Yak project, I was initially curious about how the Yak scripting language was implemented. But in use, I found the plugin architecture, Yak built-in security functions, and Yakit GUI combined are the project's highlights. Since the project is young, design bugs are inevitable, but author V1ll4n's update frequency is amazing.”

“Yak is the best security-capability foundation in China I have seen, with a lot of effort put into heterogeneous multi-source data integration, letting security practitioners truly focus on solving security problems.”

“Overall, I really like this tool: it scans ports, detects vulnerabilities, and brute-forces credentials, integrating many capabilities in an easy-to-use way that greatly improves efficiency. Yakit does not target Burp, but has many of Burp's features and bundles common penetration-test functions in one place. Practitioners can also use Yakit's customization to build their own offensive tools. Yakit did what many dared not do, and I hope Yakit can do what others cannot.”

“In my eyes, Yak's significance is far greater than Yakit; Yakit is only a collection of scenario implementations for security needs built on Yak. From Yakit's open source to now, it keeps covering more security scenarios, which makes me feel Yak is, as the original docs said, constantly proving to security people that Yak is indeed the most suitable language for security, and makes people expect it to truly become the "base" of security. What amazes me most about Yakit is the reverse-connection platform expansion; I have been talking with V about extending the OAST detection model and have tried building a similar product. During my own implementation, I felt Yakit's direction on reverse connection kept validating my own work, and I deeply appreciate how hard it is to make a product that satisfies both yourself and others. In short, I very much look forward to Yak covering more security scenarios in the future.”

“I was moved by the Yak team's vision the first time I touched Yak. As a security-domain scripting language, Yak integrates common security capabilities. Not long ago I tested a workflow, and after a little learning I quickly designed a detection process the way I wanted. The official Yakit implementation provides many practical tools such as MITM and codec-specific vulnerability detection. Yakit is still under rapid development, the WeChat community is very active, many interesting technologies and ideas are landing, and the team fixes bugs and iterates features incredibly fast. I sincerely hope the Yak ecosystem and community grow stronger and become the MATLAB of security.”