blitzstrike 1.0.19 → 1.0.21

package/dist/index.js

@@ -49763,13 +49763,14 @@ function nextSteps(ctx) {
 }
 
 // src/live-recon.ts
+import { resolve4 } from "node:dns/promises";
 import { connect } from "node:net";
 var HTTP_TIMEOUT_MS = 20000;
-async function httpGet(url) {
+async function httpGet(url, opts = {}) {
   const controller = new AbortController;
   const t = setTimeout(() => controller.abort(), HTTP_TIMEOUT_MS);
   try {
-    const res = await fetch(url, { signal: controller.signal, redirect: "follow" });
+    const res = await fetch(url, { signal: controller.signal, redirect: opts.redirect ?? "follow" });
     const body = await res.text();
     const headers = {};
     res.headers.forEach((v, k) => {
@@ -49866,6 +49867,96 @@ async function subdomainEnum(domain) {
   } catch {}
   return { subdomains: [...out].sort(), source: "crt.sh (certificate transparency)" };
 }
+async function waybackUrls(domain) {
+  const out = new Set;
+  const url = `https://web.archive.org/cdx/search/cdx?url=*.${encodeURIComponent(domain)}/*&output=json&fl=original&collapse=urlkey&limit=500`;
+  try {
+    const controller = new AbortController;
+    const t = setTimeout(() => controller.abort(), 60000);
+    const res = await fetch(url, { signal: controller.signal, redirect: "manual" });
+    const body = await res.text();
+    clearTimeout(t);
+    if (body.startsWith("[[")) {
+      const data = JSON.parse(body);
+      for (let i = 1;i < data.length; i++) {
+        const u = data[i]?.[0];
+        if (u && typeof u === "string" && u.includes(domain))
+          out.add(u);
+      }
+    }
+  } catch {}
+  return { urls: [...out].slice(0, 500), source: "web.archive.org (Wayback CDX)" };
+}
+var COMMON_SUBDOMAINS = [
+  "www",
+  "mail",
+  "ftp",
+  "api",
+  "dev",
+  "staging",
+  "test",
+  "admin",
+  "portal",
+  "app",
+  "blog",
+  "shop",
+  "store",
+  "cdn",
+  "static",
+  "assets",
+  "img",
+  "images",
+  "secure",
+  "vpn",
+  "remote",
+  "webmail",
+  "smtp",
+  "pop",
+  "imap",
+  "ns1",
+  "ns2",
+  "dns",
+  "db",
+  "database",
+  "mysql",
+  "git",
+  "gitlab",
+  "jenkins",
+  "ci",
+  "jira",
+  "wiki",
+  "docs",
+  "help",
+  "support",
+  "status",
+  "monitor",
+  "grafana",
+  "kibana",
+  "backup",
+  "old",
+  "beta",
+  "demo",
+  "sandbox",
+  "internal",
+  "intranet"
+];
+async function dnsBrute(domain) {
+  const found = [];
+  const base = domain.toLowerCase();
+  const seen = new Set([base, "www." + base]);
+  for (const prefix of COMMON_SUBDOMAINS) {
+    const host = `${prefix}.${base}`;
+    if (seen.has(host))
+      continue;
+    seen.add(host);
+    try {
+      const ips = await resolve4(host);
+      if (ips.length > 0)
+        found.push({ host, ips });
+    } catch {}
+  }
+  return { found, source: "DNS resolution (common subdomain prefixes)" };
+}
 var COMMON_PORTS = [
   [21, "ftp"],
   [22, "ssh"],
@@ -50037,6 +50128,8 @@ async function liveRecon(target, includeActive = false) {
   const crawl = { links, scripts, endpoints: [...new Set(allUrls)], robots, sitemap, count: allUrls.length };
   const params = extractParams(allUrls);
   const { subdomains } = await subdomainEnum(host);
+  const { found: dnsFindings } = await dnsBrute(host);
+  const { urls: wayback } = await waybackUrls(host);
   const apiEndpoints = (await discoverApi(base)).map(({ path, status }) => ({ path, status }));
   let openPorts = [];
   if (includeActive && root.status > 0) {
@@ -50061,6 +50154,10 @@ async function liveRecon(target, includeActive = false) {
     nextSteps.push(`Discovered input params: ${params.join(", ")} — these are attack-surface entry points; fuzz them with payload_lookup after scope confirms.`);
   if (subdomains.length > 0)
     nextSteps.push(`Found ${subdomains.length} subdomains — each is a separate scope surface; enumerate further with fofa_search.`);
+  if (dnsFindings.length > 0)
+    nextSteps.push(`DNS-resolved ${dnsFindings.length} hosts (${dnsFindings.map((d) => d.host).slice(0, 8).join(", ")}${dnsFindings.length > 8 ? "…" : ""}) — each is a live subdomain to recon.`);
+  if (wayback.length > 0)
+    nextSteps.push(`Wayback Machine surfaced ${wayback.length} historical URLs — mine them for hidden endpoints, old params, and forgotten pages; feed to taint_file/blitz_scan.`);
   if (openPorts.length > 0)
     nextSteps.push(`Open ports: ${openPorts.map((p) => `${p.port}/${p.service}`).join(", ")} — map services via port_correlation and probe each with the relevant tool manual.`);
   if (apiEndpoints.length > 0)
@@ -50078,6 +50175,8 @@ async function liveRecon(target, includeActive = false) {
     crawl,
     params,
     subdomains,
+    dns_findings: dnsFindings,
+    wayback_urls: wayback,
     api_endpoints: apiEndpoints,
     open_ports: openPorts,
     intel,

package/manuals/active-directory/certipy.md

@@ -0,0 +1,36 @@
+# certipy
+
+- **Category**: Active Directory
+- **Risk Level**: 🔴 High
+
+---
+
+## Description
+
+AD CS abuse. Focus areas: adcs, certificate, ad.
+
+## Installation
+
+```bash
+# linux: pip install --break-system-packages certipy-ad
+# darwin: pip install --break-system-packages certipy-ad
+# win32: pip install --break-system-packages certipy-ad
+```
+
+## Usage
+
+```bash
+certipy -find <find>
+```
+
+## Parameter Reference
+
+| Parameter | Description |
+|------|------|
+| `find` | Mode (required) |
+| `-u` | Username |
+| `-dc-ip` | DC IP |
+
+## Tags
+
+adcs, certificate, ad

package/manuals/blue-team/clamav.md

@@ -0,0 +1,34 @@
+# clamav
+
+- **Category**: Blue Team / Detection
+- **Risk Level**: 🟠 Medium
+
+---
+
+## Description
+
+Antivirus. Focus areas: av, malware.
+
+## Installation
+
+```bash
+# linux: apt install -y clamav
+# darwin: brew install clamav
+# win32: choco install clamav
+```
+
+## Usage
+
+```bash
+clamscan - <>
+```
+
+## Parameter Reference
+
+| Parameter | Description |
+|------|------|
+| `-r` | Recursive |
+
+## Tags
+
+av, malware

package/manuals/blue-team/hayabusa.md

@@ -0,0 +1,39 @@
+# hayabusa
+
+- **Category**: Blue Team / Detection
+- **Risk Level**: 🟠 Medium
+
+---
+
+## Description
+
+Windows event log forensics. Focus areas: windows, eventlog, forensics. Alternatives: chainsaw.
+
+## Installation
+
+```bash
+# linux: download binary from github
+# darwin: manual
+# win32: manual
+```
+
+## Usage
+
+```bash
+hayabusa -csv-timeline <csv-timeline>
+```
+
+## Parameter Reference
+
+| Parameter | Description |
+|------|------|
+| `csv-timeline` | Mode (required) |
+| `-d` | Log dir |
+
+## Tags
+
+windows, eventlog, forensics
+
+## Alternatives
+
+chainsaw

package/manuals/blue-team/osquery.md

@@ -0,0 +1,28 @@
+# osquery
+
+- **Category**: Blue Team / Detection
+- **Risk Level**: 🟠 Medium
+
+---
+
+## Description
+
+SQL-powered host monitoring. Focus areas: host, edr, monitor.
+
+## Installation
+
+```bash
+# linux: apt install -y osquery
+# darwin: brew install --cask osquery
+# win32: choco install osquery
+```
+
+## Usage
+
+```bash
+osqueryi - <>
+```
+
+## Tags
+
+host, edr, monitor

package/manuals/blue-team/sigma.md

@@ -0,0 +1,35 @@
+# sigma
+
+- **Category**: Blue Team / Detection
+- **Risk Level**: 🟠 Medium
+
+---
+
+## Description
+
+Generic detection rules. Focus areas: detection, rules, siem.
+
+## Installation
+
+```bash
+# linux: pip install --break-system-packages sigma-cli
+# darwin: pip install --break-system-packages sigma-cli
+# win32: pip install --break-system-packages sigma-cli
+```
+
+## Usage
+
+```bash
+sigma -convert <convert>
+```
+
+## Parameter Reference
+
+| Parameter | Description |
+|------|------|
+| `convert` | Mode (required) |
+| `-t` | Target |
+
+## Tags
+
+detection, rules, siem

package/manuals/blue-team/snort.md

@@ -0,0 +1,40 @@
+# snort
+
+- **Category**: Blue Team / Detection
+- **Risk Level**: 🟠 Medium
+
+---
+
+## Description
+
+Network IDS/IPS. Focus areas: ids, network. Alternatives: suricata.
+
+## Installation
+
+```bash
+# linux: apt install -y snort
+# darwin: brew install snort
+# win32: manual
+```
+
+## Usage
+
+```bash
+snort -h
+```
+
+## Parameter Reference
+
+| Parameter | Description |
+|------|------|
+| `-i` | Interface |
+| `-c` | Config |
+| `-A` | Alert mode |
+
+## Tags
+
+ids, network
+
+## Alternatives
+
+suricata

package/manuals/blue-team/suricata.md

@@ -0,0 +1,40 @@
+# suricata
+
+- **Category**: Blue Team / Detection
+- **Risk Level**: 🟠 Medium
+
+---
+
+## Description
+
+Network IDS/IPS. Focus areas: ids, ips, network. Alternatives: snort, zeek.
+
+## Installation
+
+```bash
+# linux: apt install -y suricata
+# darwin: brew install suricata
+# win32: choco install suricata
+```
+
+## Usage
+
+```bash
+suricata -h
+```
+
+## Parameter Reference
+
+| Parameter | Description |
+|------|------|
+| `-i` | Interface |
+| `-r` | PCAP |
+| `-c` | Config |
+
+## Tags
+
+ids, ips, network
+
+## Alternatives
+
+snort, zeek

package/manuals/blue-team/velociraptor.md

@@ -0,0 +1,28 @@
+# velociraptor
+
+- **Category**: Blue Team / Detection
+- **Risk Level**: 🟠 Medium
+
+---
+
+## Description
+
+DFIR + monitoring. Focus areas: dfir, edr, monitor.
+
+## Installation
+
+```bash
+# linux: download from github releases
+# darwin: manual
+# win32: manual
+```
+
+## Usage
+
+```bash
+velociraptor - <>
+```
+
+## Tags
+
+dfir, edr, monitor

package/manuals/blue-team/wazuh.md

@@ -0,0 +1,28 @@
+# wazuh
+
+- **Category**: Blue Team / Detection
+- **Risk Level**: 🟠 Medium
+
+---
+
+## Description
+
+SIEM + XDR. Focus areas: siem, xdr, edr.
+
+## Installation
+
+```bash
+# linux: curl -s https://packages.wazuh.com/4.x/install.sh | bash
+# darwin: manual
+# win32: manual
+```
+
+## Usage
+
+```bash
+wazuh -h
+```
+
+## Tags
+
+siem, xdr, edr

package/manuals/blue-team/zeek.md

@@ -0,0 +1,39 @@
+# zeek
+
+- **Category**: Blue Team / Detection
+- **Risk Level**: 🟠 Medium
+
+---
+
+## Description
+
+Network security monitor. Focus areas: network, monitor, nsm. Alternatives: suricata.
+
+## Installation
+
+```bash
+# linux: apt install -y zeek
+# darwin: brew install zeek
+# win32: manual
+```
+
+## Usage
+
+```bash
+zeek -r <r>
+```
+
+## Parameter Reference
+
+| Parameter | Description |
+|------|------|
+| `-r` | PCAP (required) |
+| `-C` | Ignore checksum |
+
+## Tags
+
+network, monitor, nsm
+
+## Alternatives
+
+suricata

package/manuals/cloud-native/cloudfox.md

@@ -0,0 +1,35 @@
+# cloudfox
+
+- **Category**: Cloud Security
+- **Risk Level**: 🟠 Medium
+
+---
+
+## Description
+
+Cloud attack path finder. Focus areas: cloud, attack-path.
+
+## Installation
+
+```bash
+# linux: download from github releases
+# darwin: manual
+# win32: manual
+```
+
+## Usage
+
+```bash
+cloudfox -aws <aws>
+```
+
+## Parameter Reference
+
+| Parameter | Description |
+|------|------|
+| `aws` | Provider (required) |
+| `-p` | Profile |
+
+## Tags
+
+cloud, attack-path

package/manuals/crypto/ciphey.md

@@ -0,0 +1,34 @@
+# ciphey
+
+- **Category**: Cryptography
+- **Risk Level**: 🟠 Medium
+
+---
+
+## Description
+
+Cipher/encoding auto-decode. Focus areas: cipher, decode, ctf.
+
+## Installation
+
+```bash
+# linux: pip install --break-system-packages ciphey
+# darwin: pip install --break-system-packages ciphey
+# win32: pip install --break-system-packages ciphey
+```
+
+## Usage
+
+```bash
+ciphey -t <t>
+```
+
+## Parameter Reference
+
+| Parameter | Description |
+|------|------|
+| `-t` | Ciphertext (required) |
+
+## Tags
+
+cipher, decode, ctf

package/manuals/crypto/rsactftool.md

@@ -0,0 +1,35 @@
+# rsactftool
+
+- **Category**: Cryptography
+- **Risk Level**: 🟠 Medium
+
+---
+
+## Description
+
+RSA attack toolkit. Focus areas: rsa, crypto, ctf.
+
+## Installation
+
+```bash
+# linux: git clone https://github.com/RsaCtfTool/RsaCtfTool && pip install -r requirements.txt
+# darwin: manual
+# win32: manual
+```
+
+## Usage
+
+```bash
+RsaCtfTool -h
+```
+
+## Parameter Reference
+
+| Parameter | Description |
+|------|------|
+| `--publickey` | Public key |
+| `--attack` | Attack type |
+
+## Tags
+
+rsa, crypto, ctf

package/manuals/exploitation/gopherus.md

@@ -0,0 +1,28 @@
+# gopherus
+
+- **Category**: Exploitation
+- **Risk Level**: 🔴 High
+
+---
+
+## Description
+
+Gopher SSRF payloads. Focus areas: ssrf, gopher, payload.
+
+## Installation
+
+```bash
+# linux: git clone https://github.com/tarunkant/Gopherus && cd Gopherus && pip install -r requirements.txt
+# darwin: manual
+# win32: manual
+```
+
+## Usage
+
+```bash
+gopherus - <>
+```
+
+## Tags
+
+ssrf, gopher, payload

package/manuals/exploitation/nosqlmap.md

@@ -0,0 +1,34 @@
+# nosqlmap
+
+- **Category**: Exploitation
+- **Risk Level**: 🔴 High
+
+---
+
+## Description
+
+NoSQL injection. Focus areas: nosql, injection.
+
+## Installation
+
+```bash
+# linux: pip install --break-system-packages nosqlmap
+# darwin: pip install --break-system-packages nosqlmap
+# win32: pip install --break-system-packages nosqlmap
+```
+
+## Usage
+
+```bash
+nosqlmap -u <u>
+```
+
+## Parameter Reference
+
+| Parameter | Description |
+|------|------|
+| `-u` | URL (required) |
+
+## Tags
+
+nosql, injection

package/manuals/exploitation/ssrfmap.md

@@ -0,0 +1,40 @@
+# ssrfmap
+
+- **Category**: Exploitation
+- **Risk Level**: 🔴 High
+
+---
+
+## Description
+
+SSRF exploitation. Focus areas: ssrf, exploit. Alternatives: gopherus.
+
+## Installation
+
+```bash
+# linux: git clone https://github.com/swisskyrepo/SSRFmap && cd SSRFmap && pip install -r requirements.txt
+# darwin: manual
+# win32: manual
+```
+
+## Usage
+
+```bash
+ssrfmap -r <r>
+```
+
+## Parameter Reference
+
+| Parameter | Description |
+|------|------|
+| `-r` | Request file (required) |
+| `-p` | Param |
+| `-m` | Module |
+
+## Tags
+
+ssrf, exploit
+
+## Alternatives
+
+gopherus