YAK-SSA，古希腊掌管PHP代码审计的神

Db::table()xx->insert()xx->update()xx->delete()$model::where()Db::transaction()

$file->move()$file->check()$file->save()Filesystem()等$file->error()$file->getError()

$source #-> as $sink  //顶级定义$source --> as $sink  //底级实用其次：比较重要的两个configinclude: 路径上有（包含）exclude: 路径上无（排除）

<?php$a = 1;if($a){    $a = filter($a);}else{    $a = unsafe($a);}eval($a);

*a #{exclude: `*?{have: filter}`}-> as $sink/* $sink: t75: Undefined-unsafe .:7:10 - 7:16 t66: 1 .:3:6 - 3:7*/

// 寻找顶级定义的过程中，路径上包含与_POST相交的点，并且排除filter_POST as $source*a #{exclude: <<<CODE*?{have: filter}CODE,include: <<<CODE* & $sourceCODE}-> as $sink

request() as $source1input() as $source3i() as $source4*request.get() as $source5*request.post() as $source6.input() as $source7.param() as $source8.post() as $source9$source1+$source3+$source4+$source5+$source6+$source7+$source8+$source9 as $source

request() as $source1input() as $source3i() as $source4*request.get() as $source5*request.post() as $source6.input() as $source7.param() as $source8.post() as $source9$source1+$source3+$source4+$source5+$source6+$source7+$source8+$source9 as $source.add() as $func5.save() as $func6$func5 +$func6 as $func$func #{include: `* & $source`}-> as $sink

POST /index.php/admin/sys.Auth/groupAdd HTTP/1.1Host: 10.211.55.11:8092Upgrade-Insecure-Requests: 1Accept-Language: zh-CN,zh;q=0.9Referer: http://10.211.55.11:8092/index.php/admin/indexUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Cookie: think_lang=zh-cn; PHPSESSID=655381238c1f39ebb2ccbc7cb5d7830e; Hm_lvt_d7fcc824c81abdf6e6d33ffc0e10c071=1736077733,1736168831; Hm_lpvt_d7fcc824c81abdf6e6d33ffc0e10c071=1736168831; HMACCOUNT=8C60E645EC57F215Connection: keep-aliveAccept-Encoding: gzip, deflateContent-Type: application/x-www-form-urlencodedtitle=<script>alert(1)</script>

.request().file() as $source1request().file() as $source2$source1+$source2 as $source$source

// 使用标签 {{yak(handle|param)}} 可触发热加载调用handle = func(param) {    // 在这里可以直接返回一个字符串}// 使用标签 {{yak(handle1|...)}} 可触发热加载调用handle1 = func(param) {    // 这个特殊的 Hook 也支持返回数组    return ["12312312", "abc", "def"]}// beforeRequest 允许发送数据包前再做一次处理，定义为 func(origin []byte) []bytebeforeRequest = func(req) {    /*        // 我们可以提供一些基础用法，比如说单纯就是替换一个时间戳～        req = str.ReplaceAll(req, "TIMESTAMP_INT64", sprint(time.Now().Unix()))    */ params = poc.GetAllHTTPPacketPostParams(req)params.Delete("sign")params["key"] = "123456"var buildSign = ""for k,v in params{    buildSign = buildSign+sprintf("%s=%s", k,v)    buildSign = buildSign+ "&"}buildSign = buildSign[:-1]params.Set("sign", codec.Md5(buildSign))println(params)return poc.ReplaceAllHTTPPacketPostParams(req, params)}// afterRequest 允许对每一个请求的响应做处理，定义为 func(origin []byte) []byteafterRequest = func(rsp) {    return []byte(rsp)}// mirrorHTTPFlow 允许对每一个请求的响应做处理，定义为 func(req []byte, rsp []byte, params map[string]any) map[string]any// 返回值回作为下一个请求的参数，或者提取的数据，如果你需要解密响应内容，在这里操作是最合适的mirrorHTTPFlow = func(req, rsp, params) {    return params}