52 posts tagged with "漏洞检测与插件"

Content Overview​

• Target scenario: Plugin authors and platform maintainers who want their security plugins to be searched, selected, orchestrated, and executed by an AI Agent.
• How it works: Plugins, Tools, Blueprints, Skills, and Focus Mode are abstracted into a unified Capability set, then executed through layered intent routing, progressive disclosure, capability-catalog Grounding, and a unified dispatcher.
• Key conclusion: A plugin store is not only a script download entry point; it can also become the Agent's capability catalog. Discoverability, constraints, and result verification matter just as much as model capability.

FAQ​

Does integrating a plugin with AI require rewriting an adaptation layer?​

No. Following the flow described in this article, a plugin author only needs to enable "Expose to AI" and add an accurate plugin description to enter the unified capability catalog.

How does the system reduce the chance of the AI picking the wrong plugin?​

Capabilities first pass through intent routing and catalog Grounding, then the candidate set is progressively narrowed. The execution phase is still managed and verified by the unified dispatch pipeline.

Background​

In the past, if you wanted to expand the security capabilities of an AI, there were usually two approaches:

Quick Overview​

• Applicable scenarios: Security teams that need to perform phased code audits on large projects, organize vulnerability evidence, and get assisted SyntaxFlow rule generation.
• Implementation approach: First explore the project and build a scan plan, then audit by category, verify each piece of evidence one by one, generate a report, and produce PoC examples or rule suggestions driven by risk.
• Key conclusion: The value of AI lies in organizing exploration, verification, and reporting into a traceable workflow; high-risk conclusions and PoCs still need to be reviewed in isolated, authorized environments.

FAQ​

Does AI audit jump straight to vulnerability conclusions?​

No. The workflow described breaks project exploration, scan planning, categorized audit, evidence recording, and report generation into independent phases, requiring conclusions to trace back to specific evidence.

Can auto-generated PoCs be used directly against production targets?​

No. PoCs are intended for risk reproduction and verification within an authorized scope; their inputs, impact, and execution boundaries should be reviewed in an isolated environment.

As Memfit AI's new features expand and the related mechanisms mature, we can now extend existing AI capabilities to our other products. This article focuses on the new attempts we have made in the AI-powered extension of the IRify tool.

在之前的文章中有提到我们为处理超长输入的上下文，进行一些知识蒸馏萃取的功能，在最近的一段时间里这部分的工程有了一些的应用，也就是在 yakit 中新增的两个内置插件——知识构建与知识检索。

PluginTrace 功能介绍​

在渗透测试和自动化工作流程中，YAK 插件是实现自定义安全逻辑、扩展 Yakit 功能的核心工具。然而，随着插件数量和复杂度的增加，如何有效监控其执行状态、诊断潜在问题，成为保障工作流高效顺畅的关键。

SQL 注入是一种常见且危险的网络安全攻击技术，将恶意的 SQL 代码“注入”到原本合法的数据库查询请求中。本文围绕 YAK 靶场的 SQL 注入教程，详细介绍分析过程和利用方式。

今天我们将通过一个实际案例，展示如何通过 IRify 辅助定位并最终验证某 admin 中的一个组合漏洞。

某 Admin 是一款基于 webman + Layui 开发的高性能 HTTP 服务框架，提供了简单易用的权限后台管理系统。它具有以下特点：

做 ssa 的开发和维护至今，从 ssa 的底层到 syntaxflow 的语法构建，ssa 的能力也逐渐提升，在上一阶段中，我也提供了一些 ssa 的漏洞挖掘案例。在最近的一段时间内，对 ssa 优化和增加新语法的同时，我也对 webshell 做了一些分析和审计。

接下来，我将会从两个方面进行展开讲解。

在代码审计产品从yakit分离出来作为单独产品的这一段时间中，除了底层ssa bug的修复和syntaxflow规则编写之外，我还利用irify做了一些新尝试，比如：

·对某些CVE进行复现，并且进行指定框架/某些漏洞的查缺补漏。

·进行未知的漏洞挖掘，并且进行CVE漏洞提交。

在开始读取文章之前，你可以对代码审计是弱基础，基于irify工具进行漏洞挖掘，会对代码审计流程进行优化，简化审计流程。希望读者也可以通过irify的助力去进行深入的代码审计。

之前的文章为大家介绍过

YAK在渗透测试过程中，已经集成了一系列插件，无论是主动扫描部分，还是被动扫描部分，都在逐渐完善，在前段时间中上线了 MITM 越权插件，使得对越权的检测也变得更为简单起来。

在今天的文章中，我将详细介绍主动扫描和被动扫描的区别和一些插件/功能的使用技巧。