blitzstrike 1.0.18 → 1.0.19

package/dist/index.js

@@ -49762,13 +49762,336 @@ function nextSteps(ctx) {
   return steps;
 }
 
+// src/live-recon.ts
+import { connect } from "node:net";
+var HTTP_TIMEOUT_MS = 20000;
+async function httpGet(url) {
+  const controller = new AbortController;
+  const t = setTimeout(() => controller.abort(), HTTP_TIMEOUT_MS);
+  try {
+    const res = await fetch(url, { signal: controller.signal, redirect: "follow" });
+    const body = await res.text();
+    const headers = {};
+    res.headers.forEach((v, k) => {
+      headers[k] = v;
+    });
+    return { status: res.status, headers, body: body.slice(0, 50000), ok: res.ok };
+  } catch (e) {
+    return { status: 0, headers: {}, body: String(e), ok: false };
+  } finally {
+    clearTimeout(t);
+  }
+}
+function normalizeTarget2(target) {
+  let t = target.trim();
+  if (!/^https?:\/\//i.test(t))
+    t = `https://${t}`;
+  return t.replace(/\/+$/, "");
+}
+function crawlLinks(base, body) {
+  const links = [];
+  const scripts = [];
+  const hrefRe = /<a[^>]+href=["']([^"'#]+)["']/gi;
+  const scriptRe = /<script[^>]+src=["']([^"'#]+)["']/gi;
+  let m;
+  while ((m = hrefRe.exec(body)) !== null) {
+    let u = m[1];
+    if (u.startsWith("/"))
+      u = base + u;
+    else if (!/^https?:\/\//i.test(u))
+      u = base + "/" + u;
+    links.push(u);
+  }
+  while ((m = scriptRe.exec(body)) !== null) {
+    let u = m[1];
+    if (u.startsWith("/"))
+      u = base + u;
+    else if (!/^https?:\/\//i.test(u))
+      u = base + "/" + u;
+    scripts.push(u);
+  }
+  return { links, scripts };
+}
+async function fetchRobotsAndSitemap(base) {
+  const robots = [];
+  const sitemap = [];
+  const rob = await httpGet(`${base}/robots.txt`);
+  if (rob.status === 200) {
+    for (const line of rob.body.split(`
+`)) {
+      const sm = line.match(/^Sitemap:\s*(.+)$/i);
+      if (sm)
+        sitemap.push(sm[1].trim());
+      const allow = line.match(/^(?:Allow|Disallow):\s*(.+)$/i);
+      if (allow && !allow[1].includes("*"))
+        robots.push(base + allow[1].trim());
+    }
+  }
+  const sm = await httpGet(`${base}/sitemap.xml`);
+  if (sm.status === 200 && sm.body.includes("<loc>")) {
+    const locRe = /<loc>([^<]+)<\/loc>/gi;
+    let m;
+    while ((m = locRe.exec(sm.body)) !== null)
+      sitemap.push(m[1].trim());
+  }
+  return { robots, sitemap };
+}
+function extractParams(urls) {
+  const params = new Set;
+  for (const u of urls) {
+    try {
+      const q = new URL(u).searchParams;
+      for (const k of q.keys())
+        params.add(k);
+    } catch {}
+  }
+  return [...params];
+}
+async function subdomainEnum(domain) {
+  const out = new Set;
+  try {
+    const url = `https://crt.sh/?q=%25.${encodeURIComponent(domain)}&output=json`;
+    const r = await httpGet(url);
+    if (r.status === 200 && r.body.startsWith("[")) {
+      const data = JSON.parse(r.body);
+      for (const entry of data) {
+        for (const field of (entry.name_value ?? "").split(`
+`)) {
+          const name = field.trim().toLowerCase();
+          if (name && name.endsWith(domain.toLowerCase()) && !name.includes("*"))
+            out.add(name);
+        }
+      }
+    }
+  } catch {}
+  return { subdomains: [...out].sort(), source: "crt.sh (certificate transparency)" };
+}
+var COMMON_PORTS = [
+  [21, "ftp"],
+  [22, "ssh"],
+  [25, "smtp"],
+  [53, "dns"],
+  [80, "http"],
+  [110, "pop3"],
+  [135, "msrpc"],
+  [139, "netbios"],
+  [143, "imap"],
+  [443, "https"],
+  [445, "smb"],
+  [993, "imaps"],
+  [995, "pop3s"],
+  [1433, "mssql"],
+  [1521, "oracle"],
+  [3306, "mysql"],
+  [3389, "rdp"],
+  [5432, "postgres"],
+  [6379, "redis"],
+  [8080, "http-alt"],
+  [8443, "https-alt"],
+  [9000, "app"],
+  [9090, "app"],
+  [9200, "elasticsearch"],
+  [11211, "memcached"],
+  [27017, "mongodb"]
+];
+function tcpProbe(host, port, timeout = 2000) {
+  return new Promise((resolve) => {
+    const socket = connect({ host, port, timeout });
+    socket.once("connect", () => {
+      socket.destroy();
+      resolve(true);
+    });
+    socket.once("timeout", () => {
+      socket.destroy();
+      resolve(false);
+    });
+    socket.once("error", () => {
+      socket.destroy();
+      resolve(false);
+    });
+  });
+}
+async function scanPorts(host) {
+  const results = [];
+  for (const [port, service] of COMMON_PORTS) {
+    const open = await tcpProbe(host, port);
+    if (open) {
+      const corr = portCorrelation(port);
+      results.push({ port, service, open: true, correlation: corr });
+    }
+  }
+  return results;
+}
+var API_PATHS = [
+  "/swagger.json",
+  "/swagger-ui.html",
+  "/openapi.json",
+  "/api-docs",
+  "/v2/api-docs",
+  "/v3/api-docs",
+  "/graphql",
+  "/graphiql",
+  "/actuator",
+  "/actuator/health",
+  "/actuator/env",
+  "/api/swagger.json",
+  "/docs",
+  "/redoc"
+];
+async function discoverApi(base) {
+  const out = [];
+  for (const p of API_PATHS) {
+    const r = await httpGet(`${base}${p}`);
+    if (r.status >= 200 && r.status < 400) {
+      out.push({ path: p, status: r.status, body_size: r.body.length });
+    }
+  }
+  return out;
+}
+function extractVersion(headers, body) {
+  const out = [];
+  const server = headers["server"] ?? headers["x-powered-by"] ?? "";
+  const serverVer = /^(nginx|apache|microsoft-iis|openresty|liteSpeed|caddy)\/?([0-9][0-9.\-]*)?/i.exec(server);
+  if (serverVer) {
+    out.push({ product: serverVer[1].toLowerCase(), version: serverVer[2] ?? "unknown", evidence: server });
+  }
+  const phpVer = /php\/([0-9][0-9.\-]*)/i.exec(server);
+  if (phpVer)
+    out.push({ product: "php", version: phpVer[1], evidence: server });
+  const wpVer = /content="WordPress\s+([0-9][0-9.]*)/i.exec(body);
+  if (wpVer)
+    out.push({ product: "wordpress", version: wpVer[1], evidence: `meta generator: WordPress ${wpVer[1]}` });
+  const joomlaVer = /Joomla!?\s*([0-9][0-9.]*)/i.exec(body);
+  if (joomlaVer)
+    out.push({ product: "joomla", version: joomlaVer[1], evidence: `body: Joomla ${joomlaVer[1]}` });
+  const drupalVer = /Drupal\s+([0-9][0-9.]*)/i.exec(body);
+  if (drupalVer)
+    out.push({ product: "drupal", version: drupalVer[1], evidence: `body: Drupal ${drupalVer[1]}` });
+  const powered = headers["x-powered-by"] ?? "";
+  if (powered && !out.some((o) => powered.includes(o.product))) {
+    out.push({ product: powered.split("/")[0].toLowerCase(), version: powered.split("/")[1] ?? "unknown", evidence: powered });
+  }
+  return out;
+}
+function correlateIntel(techs, versionList, portList) {
+  const tech = techs.map((t) => ({ tech: t, ...techCorrelation(t) }));
+  const versions = versionList.map((v) => ({
+    product: v.product,
+    version: v.version,
+    correlation: techCorrelation(v.product),
+    payload_lookup: payloadLookup(v.product),
+    template_lookup: templateLookup(v.product, 5)
+  }));
+  const ports = portList.map((p) => ({ port: p.port, service: p.service, ...portCorrelation(p.port) }));
+  return { tech, versions, ports };
+}
+async function liveRecon(target, includeActive = false) {
+  const base = normalizeTarget2(target);
+  const host = (() => {
+    try {
+      return new URL(base).hostname;
+    } catch {
+      return target;
+    }
+  })();
+  const root = await httpGet(base);
+  const interestingHeaders = {};
+  for (const k of ["server", "x-powered-by", "x-aspnet-version", "x-drupal-cache", "x-generator", "via", "x-cache", "cf-ray"]) {
+    if (root.headers[k])
+      interestingHeaders[k] = root.headers[k];
+  }
+  const fingerprint = {
+    status: root.status,
+    title: (root.body.match(/<title[^>]*>([^<]+)<\/title>/i) ?? [])[1]?.trim().slice(0, 200) ?? "",
+    server: root.headers["server"] ?? root.headers["x-powered-by"] ?? "",
+    headers: interestingHeaders,
+    body_size: root.body.length
+  };
+  const waf = detectWaf(root.headers, root.body);
+  const techSig = [
+    [/wp-content|wp-includes|wp-json/i, "wordpress"],
+    [/wp-login\.php|wp-admin/i, "wordpress"],
+    [/powered by joomla|com_content/i, "joomla"],
+    [/laravel|_token|csrf-token/i, "laravel"],
+    [/react|__NEXT_DATA__|next\/static/i, "nextjs"],
+    [/angular|ng-version/i, "angular"],
+    [/vue|__vue__|v-data/i, "vue"],
+    [/django|csrftoken|__debug__/i, "django"],
+    [/ruby on rails|rails/i, "rails"],
+    [/asp\.net|__VIEWSTATE|__EVENTVALIDATION/i, "aspnet"],
+    [/phpBB|phpbb/i, "phpbb"],
+    [/mybb|mybb/i, "mybb"],
+    [/drupal|Drupal\.settings/i, "drupal"],
+    [/magento|Mage\./i, "magento"],
+    [/shopify|cdn\.shopify/i, "shopify"],
+    [/grafana|kibana|elastic/i, "grafana-kibana"],
+    [/node\.js|express/i, "nodejs"],
+    [/flask|werkzeug/i, "flask"],
+    [/spring|actuator/i, "spring"]
+  ];
+  const techs = [...new Set(techSig.filter(([re]) => re.test(root.body)).map(([, t]) => t))];
+  const versions = extractVersion(root.headers, root.body);
+  const { links, scripts } = crawlLinks(base, root.body);
+  const { robots, sitemap } = await fetchRobotsAndSitemap(base);
+  const allUrls = [...links, ...scripts, ...robots, ...sitemap];
+  const crawl = { links, scripts, endpoints: [...new Set(allUrls)], robots, sitemap, count: allUrls.length };
+  const params = extractParams(allUrls);
+  const { subdomains } = await subdomainEnum(host);
+  const apiEndpoints = (await discoverApi(base)).map(({ path, status }) => ({ path, status }));
+  let openPorts = [];
+  if (includeActive && root.status > 0) {
+    const scan = await scanPorts(host);
+    openPorts = scan.map(({ port, service }) => ({ port, service }));
+  }
+  const intel = correlateIntel(techs, versions, openPorts);
+  const nextSteps = [];
+  if (waf.detected)
+    nextSteps.push(`WAF detected (${waf.wafs?.map((w) => w.waf).join(", ")}) — consult detect_waf + WAF bypass playbook before exploitation.`);
+  for (const t of techs) {
+    const c = techCorrelation(t);
+    if (c.found)
+      nextSteps.push(`Tech '${t}' maps to known vuln classes — read tech_correlation('${t}') and fetch nuclei templates with template_lookup('${t}').`);
+  }
+  for (const v of versions) {
+    nextSteps.push(`Version ${v.product}/${v.version} detected — check cve_correlation + nvd_lookup for known CVEs affecting ${v.product} ${v.version}.`);
+  }
+  if (crawl.endpoints.length > 0)
+    nextSteps.push(`Found ${crawl.endpoints.length} endpoints — feed them to taint_file/blitz_scan for source analysis, or strike_verify for live validation.`);
+  if (params.length > 0)
+    nextSteps.push(`Discovered input params: ${params.join(", ")} — these are attack-surface entry points; fuzz them with payload_lookup after scope confirms.`);
+  if (subdomains.length > 0)
+    nextSteps.push(`Found ${subdomains.length} subdomains — each is a separate scope surface; enumerate further with fofa_search.`);
+  if (openPorts.length > 0)
+    nextSteps.push(`Open ports: ${openPorts.map((p) => `${p.port}/${p.service}`).join(", ")} — map services via port_correlation and probe each with the relevant tool manual.`);
+  if (apiEndpoints.length > 0)
+    nextSteps.push(`API endpoints exposed (${apiEndpoints.map((e) => e.path).join(", ")}) — audit them with api-security playbook; check for BOLA/IDOR/auth gaps.`);
+  if (nextSteps.length === 0)
+    nextSteps.push("Nothing exposed on the surface — try subdomain enumeration, port scan (active), or request source access for EAGLE-EYE analysis.");
+  nextSteps.push("Every confirmed finding: record with finding_create, attach confidence_score, redact secrets. A hit is a hypothesis until verified.");
+  return {
+    target: base,
+    host,
+    fingerprint,
+    waf,
+    tech: { detected: techs, server: fingerprint.server },
+    versions,
+    crawl,
+    params,
+    subdomains,
+    api_endpoints: apiEndpoints,
+    open_ports: openPorts,
+    intel,
+    next_steps: nextSteps
+  };
+}
+
 // src/server.ts
 function createServer() {
   const server = new McpServer({
     name: "blitzstrike",
     version: "1.0.0"
   }, {
-    instructions: "Blitz Strike is a universal penetration-testing toolbelt with three tiers — " + "BLITZ (reconnaissance / attack-surface mapping), EAGLE-EYE (source-to-sink " + "analysis), STRIKE (live validation) — plus a canonical evidence-first finding " + "engine and a multi-language taint engine.\\n\\n" + "CORE MENTAL MODEL:\\n" + "- A scanner hit is a HYPOTHESIS, not a finding. Live verification (or data-flow " + "  proof) is the verdict. Never report an unverified hit as a vulnerability.\\n" + "- Distinguish REACHABLE from mere PRESENT: a sink is only a finding when tainted " + "  input reaches it AND it is not neutralized by a sanitizer and not guarded by an " + "  auth gate.\\n\\n" + "HOW TO RUN AN AUDIT (start here):\\n" + "1. SCOPE FIRST. Call scope_check(target, scope, mode) before ANY active testing. " + "   Passive analysis (reading source, fingerprinting public pages) needs no gate; " + "   active probing (exploitation, fuzzing, path brute-force) is blocked until scope " + "   authorizes it.\\n" + "2. MAP THE SURFACE (BLITZ). For a source tree use blitz_scan (tree) or blitz_file " + "   (single file) then enrich_scan to match sinks to escalation chains. For a live " + "   URL use active_scan (it re-checks scope internally): it fingerprints the stack, " + "   detects WAF, identifies tech, and probes common endpoints.\\n" + "3. TRACE REACHABILITY (EAGLE-EYE). For every sink, determine whether attacker " + "   input actually reaches it:\\n" + "   - PHP/JS/TS/Python/Java source: taint_file (auto-detects language) or " + "     taint_scan/taint_tree (PHP AST). list_languages shows what's supported.\\n" + "   - Any language: trace_data_flow (window heuristic) and eagle_eye/eagle_grep " + "     (function-scoped view of sinks + auth gates).\\n" + "   A sink counts only if tainted input reaches it unsanitized and unguarded.\\n" + "4. VALIDATE (STRIKE). Confirm live with strike_verify using a MARKER plus a " + "   NEGATIVE CONTROL; the finding is confirmed only when your marker reflects AND " + "   the negative control stays inert. Use read_tool_manual for the exploit tool's " + "   manual, payload_lookup for payloads, detect_waf/tech_correlation for context.\\n" + "5. RECORD + REPORT. Create a canonical finding with finding_create, advance it " + "   through the lifecycle with finding_transition, attach confidence_score, and " + "   redact any secrets before persisting. Only report findings that survived " + "   verification.\\n\\n" + "SUPPORTING LAYERS:\\n" + "- run_engagement: full one-call audit (scope gate -> triage -> chain enrichment " + "  -> findings with tool manuals attached).\\n" + "- list_languages / taint_file: multi-language taint (PHP, JS/TS, Python, Java).\\n" + "- list_chains: 57 escalation chains (source -> sink -> impact).\\n" + "- tool_lookup / ensure_tool / list_tools: 130-tool catalog, auto-install.\\n" + "- skill_lookup / read_skill / list_skills: 85 playbooks (WP/PHP 0-day, AD, " + "  malware, mobile, cloud, etc.).\\n" + "- read_playbook / read_tool_manual / list_manuals: 270 tool manuals + engagement " + "  playbooks.\\n" + "- detect_waf / tech_correlation / cve_correlation / port_correlation: signature " + "  + correlation intelligence.\\n" + "- nvd_lookup / fofa_search: CVE + asset reconnaissance (FOFA needs env creds).\\n" + "- remember / memory_lookup / memory_list: persist + recall verified knowledge.\\n\\n" + "IRON RULES:\\n" + "- Scope first; authorized targets only. Refuse out-of-scope or destructive/DoS work.\\n" + "- A hit is a hypothesis; a verified exploit (or proven data-flow) is the finding.\\n" + "- Prefer the one-call run_engagement path; fall back to granular tools when you " + "  need finer control."
+    instructions: "Blitz Strike is a universal penetration-testing toolbelt with three tiers — " + "BLITZ (reconnaissance / attack-surface mapping), EAGLE-EYE (source-to-sink " + "analysis), STRIKE (live validation) — plus a canonical evidence-first finding " + "engine and a multi-language taint engine.\\n\\n" + "CORE MENTAL MODEL:\\n" + "- A scanner hit is a HYPOTHESIS, not a finding. Live verification (or data-flow " + "  proof) is the verdict. Never report an unverified hit as a vulnerability.\\n" + "- Distinguish REACHABLE from mere PRESENT: a sink is only a finding when tainted " + "  input reaches it AND it is not neutralized by a sanitizer and not guarded by an " + "  auth gate.\\n\\n" + "HOW TO RUN AN AUDIT (start here):\\n" + "1. SCOPE FIRST. Call scope_check(target, scope, mode) before ANY active testing. " + "   Passive analysis (reading source, fingerprinting public pages) needs no gate; " + "   active probing (exploitation, fuzzing, path brute-force) is blocked until scope " + "   authorizes it.\\n" + "2. MAP THE SURFACE (BLITZ). For a source tree use blitz_scan (tree) or blitz_file " + "   (single file) then enrich_scan to match sinks to escalation chains. For a live " + "   URL use live_recon for a full pass (fingerprint/WAF/tech/version/crawler/params/" + "   subdomains/API endpoints/intel correlation) — it returns next_steps. active_scan " + "   is the lighter gated alternative. Both re-check scope internally.\\n" + "3. TRACE REACHABILITY (EAGLE-EYE). For every sink, determine whether attacker " + "   input actually reaches it:\\n" + "   - PHP/JS/TS/Python/Java source: taint_file (auto-detects language) or " + "     taint_scan/taint_tree (PHP AST). list_languages shows what's supported.\\n" + "   - Any language: trace_data_flow (window heuristic) and eagle_eye/eagle_grep " + "     (function-scoped view of sinks + auth gates).\\n" + "   A sink counts only if tainted input reaches it unsanitized and unguarded.\\n" + "4. VALIDATE (STRIKE). Confirm live with strike_verify using a MARKER plus a " + "   NEGATIVE CONTROL; the finding is confirmed only when your marker reflects AND " + "   the negative control stays inert. Use read_tool_manual for the exploit tool's " + "   manual, payload_lookup for payloads, detect_waf/tech_correlation for context.\\n" + "5. RECORD + REPORT. Create a canonical finding with finding_create, advance it " + "   through the lifecycle with finding_transition, attach confidence_score, and " + "   redact any secrets before persisting. Only report findings that survived " + "   verification.\\n\\n" + "SUPPORTING LAYERS:\\n" + "- run_engagement: full one-call audit (scope gate -> triage -> chain enrichment " + "  -> findings with tool manuals attached).\\n" + "- list_languages / taint_file: multi-language taint (PHP, JS/TS, Python, Java).\\n" + "- list_chains: 57 escalation chains (source -> sink -> impact).\\n" + "- tool_lookup / ensure_tool / list_tools: 130-tool catalog, auto-install.\\n" + "- skill_lookup / read_skill / list_skills: 85 playbooks (WP/PHP 0-day, AD, " + "  malware, mobile, cloud, etc.).\\n" + "- read_playbook / read_tool_manual / list_manuals: 270 tool manuals + engagement " + "  playbooks.\\n" + "- detect_waf / tech_correlation / cve_correlation / port_correlation: signature " + "  + correlation intelligence.\\n" + "- nvd_lookup / fofa_search: CVE + asset reconnaissance (FOFA needs env creds).\\n" + "- remember / memory_lookup / memory_list: persist + recall verified knowledge.\\n\\n" + "IRON RULES:\\n" + "- Scope first; authorized targets only. Refuse out-of-scope or destructive/DoS work.\\n" + "- A hit is a hypothesis; a verified exploit (or proven data-flow) is the finding.\\n" + "- Prefer the one-call run_engagement path; fall back to granular tools when you " + "  need finer control."
   });
   server.registerTool("blitz_scan", {
     title: "BLITZ scan",
@@ -49930,6 +50253,19 @@ function createServer() {
       content: [{ type: "text", text: JSON.stringify({ scope_gate: gate, ...result }) }]
     };
   });
+  server.registerTool("live_recon", {
+    title: "Full live reconnaissance (multi-phase)",
+    description: "STRIKE: comprehensive live recon — fingerprint, WAF, tech+version detection, crawler (links/scripts/robots/sitemap), parameter discovery, subdomain enumeration (crt.sh), API endpoint discovery, and intel correlation (tech/CVE/port/payloads/templates). " + "Returns next_steps so you know exactly what to do after each result. " + "ACTIVE port scanning only runs when authorize=true (scope gate). " + "USE WHEN: you have a live URL and need to map its full attack surface before source analysis or exploitation.",
+    inputSchema: {
+      target: string2().describe("Target URL/host"),
+      authorize: boolean2().optional().describe("Explicit authorization to run ACTIVE phases (TCP port scan)")
+    }
+  }, async ({ target, authorize }) => {
+    const result = await liveRecon(target, authorize === true);
+    return {
+      content: [{ type: "text", text: JSON.stringify(result) }]
+    };
+  });
   server.registerTool("run_engagement", {
     title: "STRIKE full engagement",
     description: "STRIKE: run a full 3-tier audit server-side (scope gate -> triage -> chain enrichment -> findings). One call.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.18",
+  "version": "1.0.19",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {