blitzstrike 1.0.28 → 1.0.29

package/CHANGELOG.md

@@ -46,6 +46,11 @@ code path, not a slogan.
 - **47 missing tool manuals** generated (`scripts/generate-manuals.py`) —
   manual coverage went 270 → 317 indexed manuals (334 files), 100% of the
   130-tool catalog is now documented.
+- **Attack-vector taxonomy** (`intelligence/attack_vectors.json` +
+  `list_attack_vectors` + `attack_vectors` tools) — a 34-category / 588-vector
+  master reference of web attack vectors (RCE, SQL, auth, SSRF, XSS, API,
+  business logic, race conditions, cloud, supply chain, CI/CD, AI/LLM, Web3,
+  XS-leaks, …) for BLITZ attack-surface mapping.
 
 ### Changed
 

package/README.md

@@ -224,9 +224,12 @@ MCP servers. With no client detected, it prints the snippet for manual paste.
 | `payload_lookup(topic)` | Find exploit payloads (66 categories from PayloadsAllTheThings). |
 | `read_payload(category)` | Read a full payload collection. |
 | `template_lookup(topic)` | Find nuclei detection templates (11.9k YAML signatures). |
+| `list_attack_vectors()` | List the full web attack-vector taxonomy (34 categories, 588 vectors). |
+| `attack_vectors(category)` | Enumerate the vector list for one category (e.g. ssrf, business logic, ai/llm). |
 
 The intelligence layer (WAF signatures, tech/CVE/port correlations, fuzzer
-data, vuln ontology, exploit payloads, nuclei detection templates) is sourced
+data, vuln ontology, exploit payloads, nuclei detection templates, attack-vector
+taxonomy) is sourced
 from airecon (MIT), PayloadsAllTheThings (MIT), and nuclei-templates (MIT) —
 loaded at runtime and wired into the tool surface above.
 
@@ -349,6 +352,9 @@ number you can re-run, not a claim.
 - **Coverage matrix** (`coverage_matrix`) — 4 languages × 12 sink classes =
   35/48 pairs covered (**72.9%**). The two uncovered classes (`xml_processing`,
   `archive_extraction`) are tracked in the roadmap.
+- **Attack-vector taxonomy** (`list_attack_vectors` / `attack_vectors`) — a
+  master reference of 34 attack-vector categories (588 vectors) so a driving
+  agent can map the *entire* attack surface, not just the obvious sinks.
 - **Regression suite** — `bun run test` runs 106 checks covering finding
   lifecycle, evidence integrity, CVSS math, taint tracing, dedup, report
   integrity, and benchmark invariants. CI runs it on every push.

package/THIRD-PARTY-NOTICES.md

@@ -48,6 +48,13 @@ satisfies the attribution requirements of those licenses.
 - **License:** MIT
 - **Used for:** ~11.9k YAML detection templates (`templates/`) + `cves.json`.
 
+## attack-vector taxonomy
+
+- **Source:** https://x0.at/Lqa2.txt (curated public list)
+- **License:** generic security terminology (OWASP/CWE-style attack-vector names)
+- **Used for:** `intelligence/attack_vectors.json` — a 34-category / 588-vector
+  taxonomy of web attack vectors for attack-surface mapping (BLITZ tier).
+
 ---
 
 All other code, chains, and data in this project are written by shinthink

package/dist/index.js

@@ -30562,6 +30562,7 @@ function intelSummary() {
   const cve = loadJson("cve_correlations");
   const port = loadJson("port_correlations");
   const fuzz = loadJson("fuzzer_data");
+  const av = loadJson("attack_vectors");
   return {
     waf_signatures: waf ? (waf.header_signatures?.length ?? 0) + (waf.body_signatures?.length ?? 0) : 0,
     tech_correlations: tech ? Object.keys(tech).length : 0,
@@ -30569,9 +30570,33 @@ function intelSummary() {
     port_correlations: port ? Object.keys(port).length : 0,
     fuzzer_categories: fuzz ? Object.keys(fuzz).length : 0,
     payload_categories: listPayloadCategories().length,
-    nuclei_templates: countTemplates()
+    nuclei_templates: countTemplates(),
+    attack_vector_categories: av ? av.categories.length : 0,
+    attack_vectors: av ? av.categories.reduce((n, c) => n + c.vectors.length, 0) : 0
   };
 }
+function listAttackVectors() {
+  const data = loadJson("attack_vectors");
+  if (!data)
+    return { error: "attack_vectors.json not loaded" };
+  return {
+    total_categories: data.categories.length,
+    total_vectors: data.categories.reduce((n, c) => n + c.vectors.length, 0),
+    categories: data.categories.map((c) => ({ id: c.id, title: c.title, count: c.vectors.length }))
+  };
+}
+function attackVectors(category) {
+  const data = loadJson("attack_vectors");
+  if (!data)
+    return { error: "attack_vectors.json not loaded" };
+  const q = category.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+  const found = data.categories.find((c) => c.id === q || c.id.includes(q) || c.title.toLowerCase().includes(category.toLowerCase()));
+  if (!found) {
+    const matches = data.categories.filter((c) => c.title.toLowerCase().includes(category.toLowerCase()) || c.id.includes(q)).slice(0, 5).map((c) => c.id);
+    return { found: false, query: category, suggestions: matches };
+  }
+  return { found: true, id: found.id, title: found.title, count: found.vectors.length, vectors: found.vectors };
+}
 var PACKAGE_PAYLOADS = join6(ROOT3, "payloads");
 var PACKAGE_TEMPLATES = join6(ROOT3, "templates");
 var DATA_ROOT = process.env.BLITZSTRIKE_DATA ?? join6(homedir2(), ".blitzstrike", "data");
@@ -51245,11 +51270,27 @@ function createServer() {
   });
   server.registerTool("intel_summary", {
     title: "Intelligence layer summary",
-    description: "INTEL: counts of WAF sigs, tech/CVE/port correlations, fuzzer categories.",
+    description: "INTEL: counts of WAF sigs, tech/CVE/port correlations, fuzzer categories, and attack vectors.",
     inputSchema: {}
   }, async () => {
     return { content: [{ type: "text", text: JSON.stringify(intelSummary()) }] };
   });
+  server.registerTool("list_attack_vectors", {
+    title: "List the attack-vector taxonomy",
+    description: "BLITZ: list the full web attack-vector taxonomy (34 categories, 588 vectors) grouped by category, for attack-surface mapping.",
+    inputSchema: {}
+  }, async () => {
+    return { content: [{ type: "text", text: JSON.stringify(listAttackVectors()) }] };
+  });
+  server.registerTool("attack_vectors", {
+    title: "Enumerate attack vectors for a category",
+    description: "BLITZ: return the full vector list for one attack category (e.g. 'ssrf', 'business logic', 'ai/llm') so a driving agent covers the whole attack surface.",
+    inputSchema: {
+      category: string2().describe("Category id or fuzzy title (e.g. ssrf, business_logic, ai/llm)")
+    }
+  }, async ({ category }) => {
+    return { content: [{ type: "text", text: JSON.stringify(attackVectors(category)) }] };
+  });
   server.registerTool("payload_lookup", {
     title: "Look up exploit payloads",
     description: "INTEL: find a payload collection (66 categories from PayloadsAllTheThings).",

package/intelligence/attack_vectors.json

@@ -0,0 +1,798 @@
+{
+  "_comment": "Web attack vector taxonomy — master reference for attack-surface mapping (BLITZ tier). Generic security terminology (OWASP/CWE-style attack vector names) grouped into 34 categories. Source: https://x0.at/Lqa2.txt (curated public list).",
+  "version": 1,
+  "categories": [
+    {
+      "id": "remote_code_execution",
+      "title": "REMOTE CODE EXECUTION",
+      "vectors": [
+        "RCE / Remote Code Execution",
+        "Command Injection",
+        "OS Command Injection",
+        "Code Injection",
+        "Server-Side Template Injection / SSTI",
+        "Unsafe Eval / Dynamic Code Execution",
+        "File Upload to RCE",
+        "Arbitrary File Write to RCE",
+        "Log Poisoning to RCE",
+        "PHAR Deserialization",
+        "PHP Object Injection",
+        "Java Deserialization RCE",
+        "ImageMagick RCE",
+        "GhostScript RCE",
+        "Dependency-Based RCE",
+        "Plugin / Module RCE"
+      ]
+    },
+    {
+      "id": "sql_database_attacks",
+      "title": "SQL & DATABASE ATTACKS",
+      "vectors": [
+        "SQL Injection",
+        "Blind SQL Injection",
+        "Time-Based SQL Injection",
+        "Boolean-Based SQL Injection",
+        "Error-Based SQL Injection",
+        "Union-Based SQL Injection",
+        "Stacked Query Injection",
+        "Second-Order SQL Injection",
+        "NoSQL Injection",
+        "MongoDB Injection",
+        "ORM Injection",
+        "GraphQL Database Injection",
+        "Database Error Disclosure",
+        "Exposed Database Service",
+        "Database Misconfiguration"
+      ]
+    },
+    {
+      "id": "authentication_session",
+      "title": "AUTHENTICATION & SESSION",
+      "vectors": [
+        "Authentication Bypass",
+        "Authorization Bypass",
+        "Account Takeover / ATO",
+        "Privilege Escalation",
+        "Vertical Privilege Escalation",
+        "Horizontal Privilege Escalation",
+        "Session Hijacking",
+        "Session Fixation",
+        "Session Poisoning",
+        "Cookie Injection",
+        "Cookie Tossing",
+        "JWT None Algorithm Attack",
+        "JWT Key Confusion",
+        "JWT Weak Secret",
+        "JWT Expiration Missing",
+        "JWT Replay Attack",
+        "OAuth Misconfiguration",
+        "SSO Misconfiguration",
+        "SAML Misconfiguration",
+        "OpenID Connect Misconfiguration",
+        "MFA Bypass",
+        "OTP Bypass",
+        "Password Reset Poisoning",
+        "Password Reset Token Leakage",
+        "Password Reset Bypass",
+        "Email Verification Bypass",
+        "Weak Password Policy",
+        "Credential Stuffing",
+        "Brute Force Attack",
+        "Password Spraying",
+        "Account Enumeration",
+        "Default Credentials",
+        "Hardcoded Credentials",
+        "Insecure Remember-Me Token",
+        "Weak / Predictable Token",
+        "Session Timeout Missing",
+        "Concurrent Session Abuse"
+      ]
+    },
+    {
+      "id": "access_control",
+      "title": "ACCESS CONTROL",
+      "vectors": [
+        "Broken Access Control",
+        "Missing Access Control",
+        "IDOR / Insecure Direct Object Reference",
+        "BOLA / Broken Object Level Authorization",
+        "BFLA / Broken Function Level Authorization",
+        "Broken Object Property Level Authorization",
+        "Function-Level Access Control Bypass",
+        "Object-Level Access Control Bypass",
+        "Forced Browsing",
+        "Insecure Direct Function Access",
+        "Role Bypass",
+        "Tenant Isolation Bypass",
+        "Multi-Tenant Data Leakage",
+        "Admin Panel Access Bypass",
+        "Mass Assignment",
+        "Quota Bypass",
+        "Rate Limit Bypass",
+        "CORS Misconfiguration"
+      ]
+    },
+    {
+      "id": "file_path_attacks",
+      "title": "FILE & PATH ATTACKS",
+      "vectors": [
+        "Path Traversal",
+        "Directory Traversal",
+        "LFI / Local File Inclusion",
+        "RFI / Remote File Inclusion",
+        "Arbitrary File Read",
+        "Arbitrary File Download",
+        "Arbitrary File Upload",
+        "Unrestricted File Upload",
+        "File Type Bypass",
+        "MIME Type Bypass",
+        "Double Extension Upload",
+        "Zip Slip / Archive Traversal",
+        "Archive Extraction Abuse",
+        "Backup File Exposure",
+        "Environment File Exposure",
+        ".env Exposure",
+        "Config File Exposure",
+        "Repository Exposure",
+        ".git Exposure",
+        ".svn Exposure",
+        "Directory Listing",
+        "Temporary File Exposure",
+        "Log File Exposure",
+        "Sensitive File Disclosure"
+      ]
+    },
+    {
+      "id": "injection_attacks",
+      "title": "INJECTION ATTACKS",
+      "vectors": [
+        "Insecure Deserialization",
+        "Prototype Pollution",
+        "XXE / XML External Entity Injection",
+        "XPath Injection",
+        "LDAP Injection",
+        "CRLF Injection",
+        "HTTP Response Splitting",
+        "HTTP Parameter Pollution",
+        "HTTP Request Smuggling",
+        "Host Header Injection",
+        "Header Injection",
+        "Email Injection",
+        "Email Header Injection",
+        "HTML Injection",
+        "CSV Injection",
+        "Formula Injection",
+        "Command Argument Injection",
+        "Expression Language Injection",
+        "OGNL Injection",
+        "SpEL Injection",
+        "Jinja2 Injection",
+        "Freemarker Injection",
+        "Velocity Injection"
+      ]
+    },
+    {
+      "id": "xss_client_side_attacks",
+      "title": "XSS & CLIENT-SIDE ATTACKS",
+      "vectors": [
+        "Reflected XSS",
+        "Stored XSS",
+        "DOM-Based XSS",
+        "Blind XSS",
+        "Mutation XSS / mXSS",
+        "Universal XSS",
+        "Client-Side Template Injection",
+        "DOM Clobbering",
+        "postMessage Misconfiguration",
+        "postMessage Origin Bypass",
+        "CSP Misconfiguration",
+        "CSP Bypass",
+        "JSONP Abuse",
+        "Script Gadget Abuse",
+        "Source Map Exposure",
+        "Sensitive Data in JavaScript",
+        "Sensitive Data in LocalStorage",
+        "Sensitive Data in SessionStorage",
+        "Service Worker Abuse",
+        "Web Worker Abuse",
+        "Clickjacking",
+        "UI Redressing"
+      ]
+    },
+    {
+      "id": "csrf_redirect",
+      "title": "CSRF & REDIRECT",
+      "vectors": [
+        "CSRF / Cross-Site Request Forgery",
+        "Login CSRF",
+        "Logout CSRF",
+        "Stored CSRF",
+        "Open Redirect",
+        "Unvalidated Redirect",
+        "OAuth Redirect URI Bypass",
+        "SSO Redirect Abuse",
+        "Clickjacking",
+        "UI Redressing"
+      ]
+    },
+    {
+      "id": "ssrf",
+      "title": "SSRF",
+      "vectors": [
+        "SSRF / Server-Side Request Forgery",
+        "Blind SSRF",
+        "Semi-Blind SSRF",
+        "Full-Read SSRF",
+        "SSRF to Internal Network",
+        "SSRF to Cloud Metadata",
+        "SSRF to Localhost",
+        "SSRF to Redis",
+        "SSRF to Memcached",
+        "SSRF via PDF Generator",
+        "SSRF via Image Fetcher",
+        "SSRF via Webhook",
+        "SSRF via URL Preview",
+        "DNS Rebinding",
+        "Gopher-Based SSRF",
+        "Cloud Metadata Exposure"
+      ]
+    },
+    {
+      "id": "api_security",
+      "title": "API SECURITY",
+      "vectors": [
+        "BOLA / Broken Object Level Authorization",
+        "BFLA / Broken Function Level Authorization",
+        "Broken Object Property Level Authorization",
+        "Excessive Data Exposure",
+        "Mass Assignment",
+        "Unrestricted Resource Consumption",
+        "Unrestricted Access to Sensitive Business Flows",
+        "Improper API Inventory Management",
+        "Unsafe Consumption of APIs",
+        "API Versioning Misconfiguration",
+        "Deprecated API Exposure",
+        "Shadow API Exposure",
+        "Exposed Swagger / OpenAPI Docs",
+        "Exposed GraphQL Endpoint",
+        "GraphQL Introspection Exposure",
+        "GraphQL Query Depth Abuse",
+        "GraphQL Query Complexity Abuse",
+        "GraphQL Batching Abuse",
+        "GraphQL Alias Abuse",
+        "GraphQL Field Suggestion Leakage",
+        "REST API Misconfiguration",
+        "WebSocket Misconfiguration",
+        "WebSocket Authentication Bypass",
+        "WebSocket Authorization Bypass"
+      ]
+    },
+    {
+      "id": "business_logic",
+      "title": "BUSINESS LOGIC",
+      "vectors": [
+        "Business Logic Flaw",
+        "Workflow Bypass",
+        "Payment Bypass",
+        "Price Manipulation",
+        "Coupon Abuse",
+        "Voucher Abuse",
+        "Referral Abuse",
+        "Reward Abuse",
+        "Negative Quantity Abuse",
+        "Race Condition in Checkout",
+        "Inventory Manipulation",
+        "Order Manipulation",
+        "Cart Manipulation",
+        "Discount Stacking Abuse",
+        "Limit Bypass",
+        "Quota Bypass",
+        "Subscription Bypass",
+        "Trial Abuse",
+        "Refund Abuse",
+        "Feature Access Bypass",
+        "State Machine Bypass",
+        "Improper Validation of Business Rules"
+      ]
+    },
+    {
+      "id": "race_condition",
+      "title": "RACE CONDITION",
+      "vectors": [
+        "Race Condition",
+        "TOCTOU / Time-of-Check to Time-of-Use",
+        "Double Spending",
+        "Concurrent Request Abuse",
+        "Parallel Checkout Abuse",
+        "Parallel Coupon Abuse",
+        "Parallel Password Reset Abuse",
+        "Parallel OTP Verification Abuse",
+        "Account Balance Race",
+        "Inventory Race",
+        "File Operation Race"
+      ]
+    },
+    {
+      "id": "cache_cdn",
+      "title": "CACHE & CDN",
+      "vectors": [
+        "Web Cache Poisoning",
+        "Web Cache Deception",
+        "Cache Key Confusion",
+        "Cache Header Injection",
+        "CDN Misconfiguration",
+        "Origin Header Bypass",
+        "Stale Cache Exposure",
+        "Sensitive Data Cached",
+        "Unauthenticated Cache Access",
+        "Cache-Based Information Disclosure"
+      ]
+    },
+    {
+      "id": "domain_dns",
+      "title": "DOMAIN & DNS",
+      "vectors": [
+        "Subdomain Takeover",
+        "Dangling DNS Record",
+        "Dangling CNAME",
+        "Dangling A Record",
+        "Dangling NS Record",
+        "Zone Transfer",
+        "DNS Misconfiguration",
+        "Wildcard DNS Abuse",
+        "Domain Fronting Misconfiguration",
+        "Expired Domain Takeover",
+        "Email Domain Misconfiguration",
+        "SPF Misconfiguration",
+        "DKIM Misconfiguration",
+        "DMARC Misconfiguration"
+      ]
+    },
+    {
+      "id": "cloud_infrastructure_exposure",
+      "title": "CLOUD & INFRASTRUCTURE EXPOSURE",
+      "vectors": [
+        "Exposed S3 Bucket",
+        "Exposed Cloud Storage Bucket",
+        "Public Blob Storage",
+        "Cloud Metadata Exposure",
+        "Exposed Kubernetes Dashboard",
+        "Exposed Docker API",
+        "Exposed Redis",
+        "Exposed Memcached",
+        "Exposed Elasticsearch",
+        "Exposed MongoDB",
+        "Exposed PostgreSQL",
+        "Exposed MySQL",
+        "Exposed Prometheus",
+        "Exposed Grafana",
+        "Exposed Kibana",
+        "Exposed Jenkins",
+        "Exposed GitLab",
+        "Exposed Admin Panel",
+        "Exposed Metrics Endpoint",
+        "Exposed Debug Endpoint",
+        "Exposed Actuator Endpoint",
+        "Misconfigured Reverse Proxy",
+        "Internal Service Exposure",
+        "Open Management Port"
+      ]
+    },
+    {
+      "id": "configuration_security_headers",
+      "title": "CONFIGURATION & SECURITY HEADERS",
+      "vectors": [
+        "Security Misconfiguration",
+        "Debug Mode Enabled",
+        "Verbose Error Message",
+        "Stack Trace Disclosure",
+        "Default Installation Page",
+        "Default Admin Panel",
+        "Default Credentials",
+        "Insecure HTTP Methods",
+        "PUT Method Enabled",
+        "TRACE Method Enabled",
+        "CORS Misconfiguration",
+        "Missing Security Headers",
+        "Weak Security Headers",
+        "HSTS Missing",
+        "CSP Missing",
+        "X-Frame-Options Missing",
+        "X-Content-Type-Options Missing",
+        "Referrer-Policy Missing",
+        "Insecure TLS Configuration",
+        "Weak Cipher Suites",
+        "Expired SSL Certificate",
+        "Mixed Content",
+        "Directory Listing Enabled"
+      ]
+    },
+    {
+      "id": "cryptography_token",
+      "title": "CRYPTOGRAPHY & TOKEN",
+      "vectors": [
+        "Weak Cryptography",
+        "Broken Encryption",
+        "Insecure Randomness",
+        "Predictable Token",
+        "Weak Token Generation",
+        "Token Replay",
+        "Token Leakage",
+        "Token in URL",
+        "JWT Weak Secret",
+        "JWT Missing Expiration",
+        "JWT Algorithm Confusion",
+        "Hardcoded API Key",
+        "Hardcoded Secret",
+        "Secret Leakage in Frontend",
+        "Secret Leakage in Repository",
+        "Weak Password Hashing",
+        "Plaintext Password Storage",
+        "Insecure Key Management",
+        "Sensitive Data Exposure via Logs"
+      ]
+    },
+    {
+      "id": "supply_chain",
+      "title": "SUPPLY CHAIN",
+      "vectors": [
+        "Supply Chain Attack",
+        "Dependency Confusion",
+        "Dependency Hijacking",
+        "Typosquatting Package",
+        "Malicious Package Injection",
+        "Compromised Package",
+        "Outdated Dependency",
+        "Vulnerable Dependency",
+        "Composer Package Abuse",
+        "NPM Package Abuse",
+        "PyPI Package Abuse",
+        "Maven Package Abuse",
+        "Plugin Supply Chain Attack",
+        "Theme Supply Chain Attack",
+        "Third-Party Script Compromise",
+        "CDN Script Compromise",
+        "Subresource Integrity Missing"
+      ]
+    },
+    {
+      "id": "ci_cd_devops",
+      "title": "CI/CD & DEVOPS",
+      "vectors": [
+        "CI/CD Secret Exposure",
+        "Exposed GitHub Actions Secrets",
+        "Exposed GitLab CI Variables",
+        "Exposed Jenkins Credentials",
+        "Build Artifact Exposure",
+        "Public CI Logs",
+        "Docker Image Secret Leakage",
+        "Hardcoded Secrets in Container Image",
+        "Insecure Deployment Pipeline",
+        "Over-Permissioned CI Token",
+        "Leaked SSH Key",
+        "Leaked Cloud Key",
+        "Leaked API Token",
+        "Public Backup Artifact"
+      ]
+    },
+    {
+      "id": "information_disclosure",
+      "title": "INFORMATION DISCLOSURE",
+      "vectors": [
+        "Information Disclosure",
+        "Data Leakage",
+        "Sensitive Data Exposure",
+        "PII Exposure",
+        "User Data Exposure",
+        "Admin Data Exposure",
+        "Source Code Disclosure",
+        "Stack Trace Disclosure",
+        "Error Message Disclosure",
+        "Server Banner Disclosure",
+        "Version Disclosure",
+        "Internal IP Disclosure",
+        "Internal Path Disclosure",
+        "Debug Information Disclosure",
+        "API Key Disclosure",
+        "Access Token Disclosure",
+        "Private Key Disclosure",
+        "Backup Disclosure",
+        "Log Disclosure",
+        "Database Dump Exposure",
+        "Source Map Disclosure"
+      ]
+    },
+    {
+      "id": "dos_resource_abuse",
+      "title": "DoS & RESOURCE ABUSE",
+      "vectors": [
+        "DoS / Denial of Service",
+        "Application-Level DoS",
+        "Resource Exhaustion",
+        "CPU Exhaustion",
+        "Memory Exhaustion",
+        "Disk Exhaustion",
+        "Large Payload DoS",
+        "File Upload DoS",
+        "Slowloris",
+        "ReDoS / Regular Expression DoS",
+        "XML Bomb",
+        "Billion Laughs Attack",
+        "Zip Bomb",
+        "Decompression Bomb",
+        "GraphQL Complexity DoS",
+        "GraphQL Depth DoS",
+        "Expensive Search Query DoS",
+        "Pagination Abuse",
+        "Connection Exhaustion",
+        "Webhook Flooding"
+      ]
+    },
+    {
+      "id": "mobile_hybrid_web",
+      "title": "MOBILE & HYBRID WEB",
+      "vectors": [
+        "Deep Link Hijacking",
+        "Universal Link Misconfiguration",
+        "App Link Misconfiguration",
+        "WebView JavaScript Bridge Abuse",
+        "Insecure WebView Configuration",
+        "Insecure App-to-Web Token Sharing",
+        "Mobile OAuth Redirect Abuse",
+        "Custom Scheme Hijacking",
+        "Local File Access via WebView",
+        "Insecure Deeplink Parameter Handling"
+      ]
+    },
+    {
+      "id": "third_party_integration",
+      "title": "THIRD-PARTY INTEGRATION",
+      "vectors": [
+        "Webhook Misconfiguration",
+        "Webhook SSRF",
+        "Webhook Signature Bypass",
+        "Payment Gateway Misconfiguration",
+        "OAuth App Misconfiguration",
+        "Third-Party API Key Leakage",
+        "Third-Party Widget XSS",
+        "Analytics Script Exposure",
+        "Chat Widget Misconfiguration",
+        "Email Service Misconfiguration",
+        "Storage Integration Misconfiguration"
+      ]
+    },
+    {
+      "id": "email_account_communication",
+      "title": "EMAIL & ACCOUNT COMMUNICATION",
+      "vectors": [
+        "Email Header Injection",
+        "SMTP Misconfiguration",
+        "Email Spoofing",
+        "SPF Misconfiguration",
+        "DKIM Misconfiguration",
+        "DMARC Misconfiguration",
+        "Password Reset Email Poisoning",
+        "Verification Link Leakage",
+        "Magic Link Leakage",
+        "Account Enumeration via Email",
+        "HTML Email Injection"
+      ]
+    },
+    {
+      "id": "admin_management_panel",
+      "title": "ADMIN & MANAGEMENT PANEL",
+      "vectors": [
+        "Exposed Admin Panel",
+        "Default Admin Credentials",
+        "Weak Admin Authentication",
+        "Admin Path Disclosure",
+        "Admin Function Access Bypass",
+        "Unauthenticated Admin API",
+        "Debug Console Exposure",
+        "Developer Console Exposure",
+        "Management Interface Exposure",
+        "Internal Dashboard Exposure"
+      ]
+    },
+    {
+      "id": "modern_web_frameworks",
+      "title": "MODERN WEB FRAMEWORKS",
+      "vectors": [
+        "Next.js Source Map Exposure",
+        "Next.js Image Optimization SSRF",
+        "Next.js Middleware Misconfiguration",
+        "React Hydration Data Leakage",
+        "Angular Template Injection",
+        "Vue Template Injection",
+        "Nuxt Misconfiguration",
+        "Webpack Source Map Exposure",
+        "Vite Dev Server Exposure",
+        "Exposed Build Manifest",
+        "Client-Side Route Access Bypass",
+        "Frontend Feature Flag Abuse"
+      ]
+    },
+    {
+      "id": "cms_plugin_theme",
+      "title": "CMS, PLUGIN & THEME",
+      "vectors": [
+        "WordPress Plugin Vulnerability",
+        "WordPress Theme Vulnerability",
+        "Joomla Extension Vulnerability",
+        "Drupal Module Vulnerability",
+        "OJS Plugin Vulnerability",
+        "OpenSID Module Vulnerability",
+        "CMS Arbitrary File Upload",
+        "CMS Authentication Bypass",
+        "CMS SQL Injection",
+        "CMS Stored XSS",
+        "CMS RCE",
+        "CMS Misconfiguration",
+        "Outdated CMS Core",
+        "Outdated Plugin",
+        "Outdated Theme"
+      ]
+    },
+    {
+      "id": "server_platform_specific",
+      "title": "SERVER & PLATFORM SPECIFIC",
+      "vectors": [
+        "PHP Object Injection",
+        "PHP File Inclusion",
+        "PHP Upload Bypass",
+        "PHP Session Poisoning",
+        "Laravel Debug Exposure",
+        "Laravel Ignition RCE",
+        "Laravel APP_KEY Exposure",
+        "Symfony Profiler Exposure",
+        "Spring Boot Actuator Exposure",
+        "Spring Expression Injection",
+        "Node.js Prototype Pollution",
+        "Node.js Deserialization",
+        "Express Misconfiguration",
+        "Django Debug Exposure",
+        "Flask Debug Console Exposure",
+        "Ruby on Rails Secret Key Exposure",
+        "ASP.NET ViewState Misconfiguration"
+      ]
+    },
+    {
+      "id": "bot_abuse_waf_bypass",
+      "title": "BOT, ABUSE & WAF BYPASS",
+      "vectors": [
+        "Bot Protection Bypass",
+        "Human Verification Bypass",
+        "Captcha Bypass",
+        "WAF Bypass",
+        "Rate Limiting Bypass",
+        "IP Rotation Abuse",
+        "User-Agent Spoofing",
+        "Header Spoofing",
+        "Automation Abuse",
+        "Scraping Abuse",
+        "Fake Account Creation",
+        "Spam Abuse",
+        "Credential Attack Automation"
+      ]
+    },
+    {
+      "id": "ai_llm_web_application_security",
+      "title": "AI / LLM WEB APPLICATION SECURITY",
+      "vectors": [
+        "Prompt Injection",
+        "Indirect Prompt Injection",
+        "System Prompt Leakage",
+        "Sensitive Information Disclosure via LLM",
+        "LLM Output Handling Vulnerability",
+        "Excessive Agency",
+        "Insecure Plugin / Tool Use",
+        "Insecure AI Agent Authorization",
+        "Insecure Tool Calling",
+        "Insecure Function Calling",
+        "RAG Data Poisoning",
+        "Vector Database Exposure",
+        "Vector Database Misconfiguration",
+        "Embedding Leakage",
+        "Training Data Leakage",
+        "Model Denial of Service",
+        "LLM Supply Chain Risk",
+        "AI Plugin Misconfiguration",
+        "AI Agent Privilege Escalation",
+        "AI Agent Workflow Bypass"
+      ]
+    },
+    {
+      "id": "web3_wallet_integration",
+      "title": "WEB3 / WALLET INTEGRATION",
+      "vectors": [
+        "Wallet Connection Abuse",
+        "Malicious Signature Request",
+        "Signature Replay",
+        "Blind Signing Abuse",
+        "Token Approval Abuse",
+        "Unlimited Approval Abuse",
+        "Frontend Contract Address Manipulation",
+        "Smart Contract Frontend Mismatch",
+        "RPC Endpoint Abuse",
+        "Cross-Chain Bridge UI Misconfiguration",
+        "Phishing via Wallet Prompt",
+        "Transaction Simulation Bypass",
+        "WalletConnect Misconfiguration",
+        "Wrong Chain ID Handling",
+        "Token Metadata Spoofing",
+        "Airdrop Claim Abuse",
+        "NFT Approval Abuse",
+        "Web3 Authentication Bypass",
+        "SIWE / Sign-In with Ethereum Misconfiguration",
+        "Replayable Login Signature"
+      ]
+    },
+    {
+      "id": "privacy_tracking_exposure",
+      "title": "PRIVACY & TRACKING EXPOSURE",
+      "vectors": [
+        "Consent Bypass",
+        "Cookie Consent Misconfiguration",
+        "Tracking Pixel Data Leakage",
+        "Analytics Token Exposure",
+        "PII Leakage to Third-Party Scripts",
+        "Session Replay Tool Exposure",
+        "Misconfigured Tag Manager",
+        "Leaky Referrer Header",
+        "Personal Data in URL",
+        "Personal Data in Logs",
+        "Personal Data in Analytics Events",
+        "Third-Party Script Data Leakage",
+        "Cross-Site Tracking Misconfiguration",
+        "Insecure Consent Storage",
+        "Privacy Preference Bypass"
+      ]
+    },
+    {
+      "id": "xs_leaks_browser_isolation",
+      "title": "XS-LEAKS & BROWSER ISOLATION",
+      "vectors": [
+        "XS-Leaks / Cross-Site Leaks",
+        "Cross-Origin Resource Policy Misconfiguration",
+        "Cross-Origin Embedder Policy Misconfiguration",
+        "Cross-Origin Opener Policy Misconfiguration",
+        "CORS Side-Channel",
+        "Browser Timing Attack",
+        "Browser Cache Side-Channel",
+        "Window Name Leakage",
+        "History Sniffing",
+        "Frame Counting Attack",
+        "Error Event Leak",
+        "Resource Load Timing Leak",
+        "Cross-Origin Redirect Leak",
+        "Cross-Origin Search Leak",
+        "Cross-Origin State Inference",
+        "SameSite Cookie Misconfiguration",
+        "Site Isolation Bypass"
+      ]
+    },
+    {
+      "id": "miscellaneous",
+      "title": "MISCELLANEOUS",
+      "vectors": [
+        "Improper Input Validation",
+        "Improper Output Encoding",
+        "Improper Error Handling",
+        "Improper Asset Management",
+        "Improper Logging",
+        "Insufficient Monitoring",
+        "Unsafe File Processing",
+        "Unsafe URL Fetching",
+        "Unsafe Parser Usage",
+        "Unsafe Redirect Handling",
+        "Insecure Default Setting",
+        "Business Logic Flaw",
+        "Security Misconfiguration",
+        "Human Verification Bypass",
+        "Bot Protection Bypass",
+        "WAF Bypass",
+        "Rate Limiting Bypass"
+      ]
+    }
+  ]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.28",
+  "version": "1.0.29",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {