Yakit: A BurpSuite Alternative Built on a Custom Security Language and gRPC

The Problem: Fragmented Security Tools and a Language Gap

Security teams often juggle multiple tools: a proxy for interception, a fuzzer for parameter testing, a reverse shell listener, and a scanner. Each tool has its own interface, data format, and scripting language. Yaklang.io built Yakit to unify these workflows under one client. The core idea is that Yaklang, a domain-specific language for cybersecurity, can replace or reimplement tools that do not integrate natively. Yakit provides a GUI for all Yaklang capabilities, so users who do not want to write code can still use the underlying engine. The project targets both security practitioners who script and those who prefer clicking through a visual interface. The README claims that Yakit can fully replace BurpSuite for MITM interception, which is a bold statement but sets the scope clearly.

Architecture: A gRPC Server Between GUI and Engine

Yakit is not a standalone scanner. It is a client that connects to a gRPC server, which hosts the Yaklang runtime. The README explains that the team wrote a gRPC server for Yaklang and then built Yakit on top of it. This design allows the engine to run locally or remotely, making deployment platform-independent. The client sends commands to the server, which executes Yaklang scripts and returns results. The GUI is written in TypeScript, and the repository shows a modular client structure. This separation means that the heavy lifting, such as HTTP parsing and protocol handling, happens in the Yaklang engine, not in the client. For users, this means Yakit is a thin front-end, and the real behavior depends on the engine's implementation. The gRPC approach also enables remote deployment, which can be useful for scanning from a separate machine, but it also introduces a network dependency that local tools like BurpSuite do not have.

MITM Interception: How It Works and What It Offers

The MITM module in Yakit operates as an HTTP proxy. When manual interception is enabled, the proxy stops forwarding traffic, blocks the request, and processes it for readability: decompressing Gzip, handling chunked encoding, and decoding. The user can then view, modify, or replay the request. The README states that the Yak engine manually implements an HTTP library, which allows users to craft malformed request and response packets for special vulnerability exploitation. This is a significant departure from BurpSuite, which relies on the underlying HTTP parser. The workflow is interception to History to Repeater or Intruder, similar to Burp. The documentation mentions features like plugin passive scanning, hot reload, packet replacement, and tagging. However, the README does not provide specific configuration steps for setting up the proxy or installing certificates. Users would need to consult the official documentation for those details, which are not in the repository material.

Web Fuzzer and Fuzztag: Reducing Repetitive Steps

The Web Fuzzer module lets users send raw HTTP requests. The backend automatically repairs missing fields like CRLF, Content-Type, chunked transfer, boundary, and Content-Length. This is meant to keep the user focused on data rather than protocol details. The distinctive feature is fuzztag, a template syntax that generates payloads directly in the request. For example, {{int(1-10)}} generates a range of IDs for a single parameter. For multiple parameters, it uses a Cartesian product, which the README claims eliminates the need to choose an attack type or import a wordlist, as BurpSuite's Intruder requires. Fuzztag also supports external dictionaries via {{file(/tmp/username.txt)}} and hot-loaded scripts for complex data generation, such as generating ID card numbers for a region. This approach reduces the number of steps for common fuzzing tasks, but it introduces a learning curve for the fuzztag syntax. Users who are accustomed to Burp's point-and-click Intruder may find the tag-based approach less intuitive at first.

Reverse Connection and Protocol Reuse: One Port for Many Services

Traditional exploit tools need a separate port for each protocol service, like HTTP and LDAP for a typical attack. Yakit uses a port protocol reuse technique: it listens on a single port, identifies the incoming protocol, and responds accordingly. The README explains that this is based on manual protocol header recognition and implementation, which allows for crafting malformed protocol packets. This technique is used in the reverse connection module, which includes Reverse Shell, reverse connection exploitation, and reverse connection detection. Reverse Shell lets a user listen on a port and receive a shell, with an experience similar to native SSH, unlike the raw nc listener that often has issues with backspace and arrow keys. The exploitation part can set payloads for different protocols, and the detection part supports TCP, DNSLog, and ICMP. This is a practical feature for post-exploitation and command injection detection, but it requires understanding the protocol reuse mechanism to use it effectively.

Running Yakit: Installation and Configuration Gaps

The README directs users to the official website for downloads and to the official documentation for learning. It does not provide any command-line installation steps, such as apt-get or npm install. The repository is a client, and the core engine is Yaklang, which is likely a separate component. Based on the architecture, a user would need to install both the Yakit client and the Yaklang engine, and then configure the gRPC connection. The README mentions that the gRPC server can be deployed remotely or locally, but it does not give example commands or configuration keys. This is a notable gap for a technical audience. The project is under active development, with recent releases like v1.4.8-0828, but the lack of setup instructions in the README means users must rely on external documentation, which is not included in the material. For a security tool, this could be a barrier to adoption, especially for teams that want to evaluate it quickly.

Limitations and Trade-offs: When Yakit Is the Wrong Tool

One clear limitation is the language barrier. The README is primarily in Chinese, with an English version linked but not provided. The documentation and community may also be Chinese-centric, which can be a problem for international teams. Another trade-off is the dependency on the gRPC server. If the server is not running or is misconfigured, the GUI client is useless. This adds an operational layer that a tool like BurpSuite does not have. The README also includes a disclaimer that the tool is for authorized testing only, and it prohibits reverse engineering and commercial use without official authorization. This is a legal constraint that could affect how teams deploy it in a corporate environment. Additionally, the claim of being a full BurpSuite replacement is ambitious. While the MITM and fuzzer features look comprehensive, the documentation does not show support for all Burp extensions or advanced features like session handling rules. Teams with complex proxy requirements may find Yakit lacking until they test it in their specific workflows.

Alternatives: BurpSuite and Custom Scripts

The most direct alternative is BurpSuite, which Yakit explicitly aims to replace. BurpSuite offers a mature GUI, a vast extension ecosystem, and extensive documentation. The key difference is that BurpSuite uses Java and its own extension API, while Yakit uses the Yaklang language and a gRPC backend. BurpSuite's Intruder requires selecting attack types and importing wordlists, whereas Yakit's fuzztag generates payloads inline. For teams that need a proven tool with a large community, BurpSuite is a safer choice. Another alternative is writing custom scripts with tools like mitmproxy or custom Python scripts, which gives full control but requires more development effort. Yakit sits in between: it offers a GUI and scripting, but the scripting language is Yaklang, which is specific to this ecosystem. If a team already knows Python or Burp's extensions, they may prefer those over learning a new language.

Editorial conclusion

Adopt Yakit if you are a security team that wants a single tool for MITM interception, fuzzing, and reverse connection workflows, especially if you are already comfortable with Yaklang scripts. Do not adopt it if you require a purely GUI-driven tool with no scripting, or if you need extensive English documentation, as the README and much of the material are in Chinese. Before committing, verify that your target environments allow the installation of a custom gRPC server and that your team can manage the learning curve of fuzztag syntax and Yaklang. Also check the AGPL-3.0 license implications if you plan to redistribute or modify the client. The project is actively maintained with recent releases, but you should test the MITM and Web Fuzzer workflows against your own lab targets first, as the documentation does not provide detailed configuration examples.

Official sources

1. Official README
2. Project repository
3. Release notes