What problem does it solve? Web applications often encrypt request bodies, sign parameters, or return encrypted responses, which blocks fuzzing and manual testing in Yakit Web Fuzzer. This Skill teaches how to write Yaklang hot-patch hooks so the Fuzzer works on plaintext while outbound traffic is automatically encrypted, signed, retried, and judged. ## Core Features & Use Cases - Request/Response Transformation: Use beforeRequest and afterRequest hooks to encrypt outbound requests, inject HMAC signatures, and decrypt responses so plaintext is visible in the Fuzzer. - Automated Decision Logic: Use retryHandler for status-code-driven retries, customFailureChecker to flag business-level failures behind HTTP 200, and mockHTTPRequest for offline debugging. - Dynamic Payloads & Correlation: Use {{yak(...)}} fuzztags to compute payloads like hashes, and mirrorHTTPFlow to extract tokens for multi-step sequences via {{params(name)}}. - Use Case: Facing a login API protected by AES-CBC encryption plus HMAC signature, combine beforeRequest and afterRequest so you write plaintext payloads in the Fuzzer while the wire traffic stays encrypted and signed. ## Quick Start Ask the AI to write a Web Fuzzer hot-patch script that encrypts the request body with AES-CBC in beforeRequest and decrypts the response in afterRequest, including a YAK_MAIN self-test.
