Pentest Proxy

---
description: "Pentest temporary-use workflow using yorishiro-proxy as an MITM proxy via CLI"
user-invokable: true
---

# /pentest-proxy

Use yorishiro-proxy as an MITM proxy during penetration testing via CLI.
All commands use the `yorishiro-proxy client` subcommand over Bash.

## Prerequisites

- `yorishiro-proxy` binary is available on PATH
- Target application is accessible from the proxy host

## 1. Server Startup

Check if a server is already running:

```bash
yorishiro-proxy client list-servers
```

If no active server is found, start one:

```bash
yorishiro-proxy server -mcp-http-addr 127.0.0.1:9090 &
```

Verify it is ready:

```bash
yorishiro-proxy client query resource=status
```

## 2. Start Proxy Listener

```bash
yorishiro-proxy client proxy_start listen_addr=127.0.0.1:8080
```

Configure the target application or browser to use `127.0.0.1:8080` as its HTTP proxy.

## 3. Install CA Certificate

Export the CA certificate for HTTPS interception:

```bash
yorishiro-proxy client query resource=ca_cert
```

Install the output PEM into the target's trust store.

## 4. Configure TLS Passthrough (Optional)

Bypass TLS interception for specific upstream hosts (these hosts will NOT be intercepted):

```bash
yorishiro-proxy client configure tls_passthrough.add='*.cdn.example.com,static.example.com'
```

## 5. Capture Traffic

Send requests through the proxy (e.g., curl, browser, or the target app) and list captured flows:

```bash
yorishiro-proxy client query resource=flows limit=20
```

## 6. Inspect a Flow

```bash
yorishiro-proxy client query flow FLOW_ID
yorishiro-proxy client query messages FLOW_ID
```

> **Note**: `query` supports positional args: first arg is `resource`, second is `id`.

## 7. Resend a Request

Replay a recorded request as-is:

```bash
yorishiro-proxy client resend action=resend params.flow_id=FLOW_ID
```

Compare the original and replayed responses:

```bash
yorishiro-proxy client resend action=compare params.flow_id_a=ORIGINAL_ID params.flow_id_b=REPLAYED_ID
```

## 8. Fuzz a Parameter

Launch a fuzz campaign against a captured flow. The fuzz tool requires structured JSON for positions and payload sets, so use `@-` (stdin) or a JSON file for complex configurations:

```bash
yorishiro-proxy client fuzz action=fuzz params.flow_id=FLOW_ID \
  params.attack_type=sequential \
  params.positions='[{"id":"pos-0","location":"query","name":"search","payload_set":"payloads"}]' \
  params.payload_sets='{"payloads":{"type":"wordlist","values":["test1","test2","test3"]}}'
```

Check fuzz job status and retrieve results:

```bash
yorishiro-proxy client query resource=fuzz_jobs
yorishiro-proxy client query resource=fuzz_results fuzz_id=FUZZ_ID
```

Control a running fuzz job:

```bash
yorishiro-proxy client fuzz action=fuzz_pause params.fuzz_id=FUZZ_ID
yorishiro-proxy client fuzz action=fuzz_resume params.fuzz_id=FUZZ_ID
yorishiro-proxy client fuzz action=fuzz_cancel params.fuzz_id=FUZZ_ID
```

## 9. Export Results

Export flows as HAR for reporting:

```bash
yorishiro-proxy client manage action=export_flows params.format=har params.output_path=flows.har
```

## 10. Cleanup

Stop the proxy listener and delete flow data:

```bash
yorishiro-proxy client proxy_stop
yorishiro-proxy client manage action=delete_flows params.flow_id=FLOW_ID
```

To delete all flows:

```bash
yorishiro-proxy client manage action=delete_flows params.confirm=true
```

---

## Typical Scenarios

### IDOR Detection

1. Authenticate as User A, browse the target to capture flows:
   ```bash
   yorishiro-proxy client query resource=flows limit=50
   ```
2. Identify a flow containing a user-specific resource ID (e.g., `/api/users/123/profile`):
   ```bash
   yorishiro-proxy client query flow FLOW_ID
   ```
3. Resend the request (still as User A) to confirm baseline:
   ```bash
   yorishiro-proxy client resend action=resend params.flow_id=FLOW_ID
   ```
4. Switch to User B credentials and resend the same flow. Compare responses:
   ```bash
   yorishiro-proxy client resend action=compare params.flow_id_a=USER_A_FLOW params.flow_id_b=USER_B_FLOW
   ```
5. If the response contains User A's data, an IDOR vulnerability exists.

### SQL Injection Testing

1. Capture a flow containing a parameter of interest:
   ```bash
   yorishiro-proxy client query resource=flows limit=20
   yorishiro-proxy client query messages FLOW_ID
   ```
2. Launch a fuzz campaign against the flow:
   ```bash
   yorishiro-proxy client fuzz action=fuzz params.flow_id=FLOW_ID \
     params.attack_type=sequential \
     params.positions='[{"id":"pos-0","location":"query","name":"id","payload_set":"sqli"}]' \
     params.payload_sets='{"sqli":{"type":"wordlist","values":["'\''","1 OR 1=1","1; DROP TABLE--"]}}'
   ```
3. Monitor and retrieve results:
   ```bash
   yorishiro-proxy client query resource=fuzz_jobs
   yorishiro-proxy client query resource=fuzz_results fuzz_id=FUZZ_ID
   ```
4. Inspect any anomalous responses (e.g., status code changes, error messages, timing differences) to confirm injection points.

### Authentication Bypass Testing

1. Capture an authenticated request flow:
   ```bash
   yorishiro-proxy client query resource=flows limit=20
   ```
2. Inspect the flow to identify auth headers/cookies:
   ```bash
   yorishiro-proxy client query messages FLOW_ID
   ```
3. Resend without auth tokens (by replaying from an unauthenticated session) and compare:
   ```bash
   yorishiro-proxy client resend action=resend params.flow_id=FLOW_ID
   yorishiro-proxy client resend action=compare params.flow_id_a=AUTH_FLOW params.flow_id_b=NO_AUTH_FLOW
   ```
4. If the unauthenticated response still returns protected data, an auth bypass exists.

---

## Quick Reference

| Task | Command |
|------|---------|
| Docs (offline) | `yorishiro-proxy docs` / `yorishiro-proxy docs <topic>` — no server needed |
| List flows | `yorishiro-proxy client query resource=flows limit=N` |
| Flow detail | `yorishiro-proxy client query flow ID` |
| Flow messages | `yorishiro-proxy client query messages ID` |
| Proxy status | `yorishiro-proxy client query resource=status` |
| Resend | `yorishiro-proxy client resend action=resend params.flow_id=ID` |
| Compare | `yorishiro-proxy client resend action=compare params.flow_id_a=A params.flow_id_b=B` |
| Fuzz start | `yorishiro-proxy client fuzz action=fuzz params.flow_id=ID ...` |
| Fuzz results | `yorishiro-proxy client query resource=fuzz_results fuzz_id=ID` |
| Export HAR | `yorishiro-proxy client manage action=export_flows params.format=har params.output_path=FILE` |
| CA cert | `yorishiro-proxy client query resource=ca_cert` |
| Delete flow | `yorishiro-proxy client manage action=delete_flows params.flow_id=ID` |
| Delete all | `yorishiro-proxy client manage action=delete_flows params.confirm=true` |