Yakit抓包规则

在Yakit中可以在MITM中通过配置规则来优化抓包体验

通过配置规则去匹配数据包中的内容（如：upload、身份证、手机号）并给数据包标记颜色，帮助我们快速定位到可能存在安全隐患的数据包，提高效率。

效果展示

完成抓包后可以通过Tags和颜色标记寻找数据包

寻找到数据包后，可以在数据包右侧快速查看字段值（下图的右下角）

如何配置

在MITM中选择规则内容进行配置

其中追加Tag会在history列表展示，规则名称则是在点击数据包后的右方展示，按照从上到下的顺序匹配，染色展示最后一个标记的颜色

配置完后，一定要点击保存

也可以通过json导入，附上一个规则的json

[
    {
        "Rule": "(?i)path.{10}",
        "NoReplace": true,
        "Color": "blue",
        "EnableForRequest": true,
        "EnableForResponse": true,
        "EnableForHeader": true,
        "EnableForBody": true,
        "Index": 1,
        "ExtraTag": [
            "关键字"
        ],
        "VerboseName": "关键字path"
    },
    {
        "Rule": "(?i)select.{10}",
        "NoReplace": true,
        "Color": "blue",
        "EnableForRequest": true,
        "EnableForResponse": true,
        "EnableForHeader": true,
        "EnableForBody": true,
        "Index": 2,
        "ExtraTag": [
            "关键字"
        ],
        "VerboseName": "关键字select"
    },
    {
        "Rule": "(.{7}(?i)key.{10})",
        "NoReplace": true,
        "Color": "blue",
        "EnableForRequest": true,
        "EnableForResponse": true,
        "EnableForHeader": true,
        "EnableForBody": true,
        "Index": 3,
        "ExtraTag": [
            "关键字"
        ],
        "VerboseName": "关键字key"
    },
    {
        "Rule": "(?i)config.{10}",
        "NoReplace": true,
        "Color": "blue",
        "EnableForRequest": true,
        "EnableForResponse": true,
        "EnableForHeader": true,
        "EnableForBody": true,
        "Index": 4,
        "ExtraTag": [
            "关键字"
        ],
        "VerboseName": "关键字config"
    },
    {
        "Rule": "(?i)phone",
        "NoReplace": true,
        "Color": "blue",
        "EnableForRequest": true,
        "EnableForResponse": true,
        "EnableForHeader": true,
        "EnableForBody": true,
        "Index": 5,
        "ExtraTag": [
            "关键字"
        ],
        "VerboseName": "关键字phone"
    },
    {
        "Rule": "((Access-Control-Allow-Method)s.*((DELETE)|(SEARCH)|(COPY)|(MOVE)|(PROPFIND)|(PROPPATCH)|(MKCOL)|(LOCK)|(UNLOCK)|(PUT)|(OPTIONS)|(TRACE)|(TRACK)|(HEAD)))",
        "NoReplace": true,
        "Color": "blue",
        "EnableForResponse": true,
        "EnableForHeader": true,
        "EnableForBody": true,
        "Index": 6,
        "ExtraTag": [
            "水洞"
        ],
        "VerboseName": "水洞"
    },
    {
        "Rule": "(?i)api.{7}",
        "NoReplace": true,
        "Color": "blue",
        "EnableForRequest": true,
        "EnableForResponse": true,
        "EnableForHeader": true,
        "EnableForBody": true,
        "Index": 7,
        "ExtraTag": [
            "api"
        ],
        "VerboseName": "api"
    },
    {
        "Rule": "(\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})",
        "NoReplace": true,
        "Color": "blue",
        "EnableForRequest": true,
        "EnableForResponse": true,
        "EnableForHeader": true,
        "EnableForBody": true,
        "Index": 8,
        "ExtraTag": [
            "IP"
        ],
        "VerboseName": "ip地址"
    },
    {
        "Rule": "(((?i)nginx|(?i)tomcat|(?i)weblogic|(?i)apache|(?i)jboos|(?i)websphere|(?i)iis).{7})",
        "NoReplace": true,
        "Color": "blue",
        "EnableForResponse": true,
        "EnableForHeader": true,
        "EnableForBody": true,
        "Index": 9,
        "ExtraTag": [
            "中间件"
        ],
        "VerboseName": "中间件"
    },
    {
        "Rule": "((http:\\/\\/|https:\\/\\/).{30})",
        "NoReplace": true,
        "Color": "blue",
        "EnableForResponse": true,
        "EnableForHeader": true,
        "EnableForBody": true,
        "Index": 10,
        "ExtraTag": [
            "URL"
        ],
        "VerboseName": "url"
    },
    {
        "Rule": "(?i)upload.{7}",
        "NoReplace": true,
        "Color": "blue",
        "EnableForRequest": true,
        "EnableForResponse": true,
        "EnableForHeader": true,
        "EnableForBody": true,
        "Index": 11,
        "ExtraTag": [
            "上传下载"
        ],
        "VerboseName": "上传下载"
    },
    {
        "Rule": "(?i)download.{7}",
        "NoReplace": true,
        "Color": "blue",
        "EnableForResponse": true,
        "EnableForHeader": true,
        "EnableForBody": true,
        "Index": 12,
        "ExtraTag": [
            "上传下载"
        ],
        "VerboseName": "上传下载"
    },
    {
        "Rule": "\\D1[3456789]\\d{9}\\D",
        "NoReplace": true,
        "Color": "purple",
        "EnableForResponse": true,
        "EnableForHeader": true,
        "EnableForBody": true,
        "Index": 13,
        "ExtraTag": [
            "手机号"
        ],
        "VerboseName": "手机号"
    },
    {
        "Rule": "([1-9]\\d{5}(18|19|20)\\d{2}((0[1-9])|(10|11|12))(([0-2][1-9])|10|20|30|31)\\d{3}[0-9Xx][^\\d])",
        "NoReplace": true,
        "Color": "purple",
        "EnableForResponse": true,
        "EnableForHeader": true,
        "EnableForBody": true,
        "Index": 14,
        "ExtraTag": [
            "身份证"
        ],
        "VerboseName": "身份证"
    },
    {
        "Rule": ".{3}@.{6}",
        "NoReplace": true,
        "Color": "purple",
        "EnableForResponse": true,
        "EnableForHeader": true,
        "EnableForBody": true,
        "Index": 15,
        "ExtraTag": [
            "@符"
        ],
        "VerboseName": "疑似邮箱(截取)"
    }
]