blitzstrike 1.0.70 → 1.0.72

package/CHANGELOG.md

@@ -5,6 +5,31 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.0.72] — 2026-09-13
+
+### Changed — coordinated agent guidance
+
+- Added `next_steps` directives for the three new sink classes (SSTI, XPath,
+  LDAP injection) so a driving LLM is told exactly how to validate each one
+  after detection — not just "go verify it".
+- Updated the static MCP `instructions`: now directs the agent to `route_scan`
+  and `complex_scan` for the deep/complex classes, and corrects the stale
+  skill count (85 → 38).
+
+## [1.0.71] — 2026-09-13
+
+### Added — expanded sink-class coverage
+
+- **Filled two empty sink classes** across all four languages:
+  - `xml_processing` (XXE) — PHP `simplexml_load_string/file`, JS `DOMParser`,
+    Python `etree.parse`/`minidom.parse`/`xml.sax`, Java XML parsers.
+  - `archive_extraction` (zip slip) — PHP `->extractTo`, JS `extractAllTo`,
+    Python `extractall`/`shutil.unpack_archive`, Java `ZipInputStream`.
+- **Three new sink classes** (SSTI, XPath, LDAP injection) across PHP / JS /
+  Python / Java adapters + the PHP depth layer.
+- Fixed a coverage-matrix desync (Python `http_request` was marked false).
+- Corpus grew 103 → 109 fixtures (tp=77, tn=32, fp=0, fn=0).
+
 ## [1.0.70] — 2026-09-13
 
 ### Fixed — polish from live LLM-driven verification

package/bench/corpus/js-ssti-vuln.md

@@ -0,0 +1,8 @@
+- id: js-ssti-vuln
+- language: javascript
+- vulnerable: true
+- sink_type: template_injection
+```javascript
+const tpl = req.query.tpl;
+ejs.render(tpl, {});
+```

package/bench/corpus/php-ldap-vuln.md

@@ -0,0 +1,9 @@
+- id: php-ldap-vuln
+- language: php
+- vulnerable: true
+- sink_type: ldap_injection
+```php
+<?php
+$filter = $_GET["filter"];
+$res = ldap_search($conn, "dc=example,dc=com", $filter);
+```

package/bench/corpus/php-xpath-vuln.md

@@ -0,0 +1,9 @@
+- id: php-xpath-vuln
+- language: php
+- vulnerable: true
+- sink_type: xpath_injection
+```php
+<?php
+$q = $_GET["q"];
+$res = $doc->xpath($q);
+```

package/bench/corpus/py-ssti-vuln.md

@@ -0,0 +1,8 @@
+- id: py-ssti-vuln
+- language: python
+- vulnerable: true
+- sink_type: template_injection
+```python
+tpl = request.args.get("tpl")
+return render_template_string(tpl)
+```

package/bench/corpus/py-xss-escape.md

@@ -4,5 +4,5 @@
 - sink_type: html_render
 ```python
 name = request.args.get("name")
-return render_template_string(escape(name))
+return "<div>" + escape(name) + "</div>"
 ```

package/bench/corpus/py-xxe-vuln.md

@@ -0,0 +1,8 @@
+- id: py-xxe-vuln
+- language: python
+- vulnerable: true
+- sink_type: xml_processing
+```python
+xml = request.data
+etree.parse(xml)
+```

package/bench/corpus/py-zipslip-vuln.md

@@ -0,0 +1,8 @@
+- id: py-zipslip-vuln
+- language: python
+- vulnerable: true
+- sink_type: archive_extraction
+```python
+dest = request.args.get("dest")
+zf.extractall(dest)
+```

package/dist/index.js

@@ -31711,7 +31711,10 @@ var SINK_CLASS_MAP = [
   [/\bheader\(|\bwp_redirect\(/, { id: "redirect", category: "Redirect handling", cwe: "CWE-601" }],
   [/echo\s|print\s|\bprintf\(/, { id: "html_render", category: "HTML rendering (XSS)", cwe: "CWE-79" }],
   [/\bsimplexml_load_string\(|new SimpleXMLElement|DOMDocument/, { id: "xml_processing", category: "XML processing (XXE)", cwe: "CWE-611" }],
-  [/\bZipArchive|\bPharData|->extractTo\(/, { id: "archive_extraction", category: "Archive extraction (zip slip)", cwe: "CWE-22" }]
+  [/\bZipArchive|\bPharData|->extractTo\(/, { id: "archive_extraction", category: "Archive extraction (zip slip)", cwe: "CWE-22" }],
+  [/\bcreateTemplate\(/, { id: "template_injection", category: "Template injection (SSTI)", cwe: "CWE-1336" }],
+  [/->xpath\(|DOMXPath/, { id: "xpath_injection", category: "XPath injection", cwe: "CWE-643" }],
+  [/\bldap_search\(|\bldap_list\(|\bldap_read\(/, { id: "ldap_injection", category: "LDAP injection", cwe: "CWE-90" }]
 ];
 function classifySink2(sink) {
   for (const [re, cls] of SINK_CLASS_MAP) {
@@ -51053,7 +51056,15 @@ var PHP_SINKS = [
   ["file_put_contents", "file_operations", "CWE-434"],
   ["include", "file_inclusion", "CWE-98"],
   ["require", "file_inclusion", "CWE-98"],
-  ["file_get_contents", "http_request", "CWE-918"]
+  ["file_get_contents", "http_request", "CWE-918"],
+  ["simplexml_load_string", "xml_processing", "CWE-611"],
+  ["simplexml_load_file", "xml_processing", "CWE-611"],
+  ["extractTo", "archive_extraction", "CWE-22"],
+  ["createTemplate", "template_injection", "CWE-1336"],
+  ["xpath", "xpath_injection", "CWE-643"],
+  ["ldap_search", "ldap_injection", "CWE-90"],
+  ["ldap_list", "ldap_injection", "CWE-90"],
+  ["ldap_read", "ldap_injection", "CWE-90"]
 ];
 var PHP_SANITIZERS = [
   ["htmlspecialchars", ["html_render"]],
@@ -51186,7 +51197,14 @@ var JS_SINKS = [
   [/http\.get|https\.get|axios/i, "http_request", "CWE-918"],
   [/http\.request|https\.request/i, "http_request", "CWE-918"],
   [/redirect\s*\(/i, "redirect", "CWE-601"],
-  [/res\.redirect/i, "redirect", "CWE-601"]
+  [/res\.redirect/i, "redirect", "CWE-601"],
+  [/new\s+DOMParser/i, "xml_processing", "CWE-611"],
+  [/DOMParser/i, "xml_processing", "CWE-611"],
+  [/extractAllTo\s*\(/i, "archive_extraction", "CWE-22"],
+  [/extractTo\s*\(/i, "archive_extraction", "CWE-22"],
+  [/ejs\.render|ejs\.compile|pug\.compile|handlebars\.compile|nunjucks\.render|_\s*\.template/i, "template_injection", "CWE-1336"],
+  [/xpath\.evaluate|document\.evaluate/i, "xpath_injection", "CWE-643"],
+  [/ldap\.search|ldapjs|client\.search/i, "ldap_injection", "CWE-90"]
 ];
 var JS_SANITIZERS = [
   [/escapeHtml/i, ["html_render"]],
@@ -51330,7 +51348,13 @@ var PY_SINKS = [
   [/pickle\.loads\s*\(/i, "deserialization", "CWE-502"],
   [/yaml\.load\s*\(/i, "deserialization", "CWE-502"],
   [/os\.popen\s*\(/i, "command_execution", "CWE-78"],
-  [/os\.exec/i, "command_execution", "CWE-78"]
+  [/os\.exec/i, "command_execution", "CWE-78"],
+  [/xml\.etree\.ElementTree\.parse|etree\.parse|lxml\.etree\.parse|minidom\.parse|xml\.sax|fromstring/i, "xml_processing", "CWE-611"],
+  [/\.extractall\s*\(/i, "archive_extraction", "CWE-22"],
+  [/shutil\.unpack_archive/i, "archive_extraction", "CWE-22"],
+  [/render_template_string|jinja2\.Template|env\.from_string/i, "template_injection", "CWE-1336"],
+  [/\.xpath\s*\(|etree\.XPath|lxml\.etree\.XPath/i, "xpath_injection", "CWE-643"],
+  [/ldap\.search|\.search_s\s*\(/i, "ldap_injection", "CWE-90"]
 ];
 var PY_SANITIZERS = [
   [/escape\s*\(/i, ["html_render"]],
@@ -51459,7 +51483,11 @@ var JAVA_SINKS = [
   [/DocumentBuilder|SAXParser|XMLReader/i, "xml_processing", "CWE-611"],
   [/\.parse\s*\(/i, "xml_processing", "CWE-611"],
   [/sendRedirect\s*\(/i, "redirect", "CWE-601"],
-  [/\.forward\s*\(/i, "redirect", "CWE-601"]
+  [/\.forward\s*\(/i, "redirect", "CWE-601"],
+  [/ZipInputStream|ZipFile|getNextEntry|ZipEntry/i, "archive_extraction", "CWE-22"],
+  [/Velocity\.evaluate|Freemarker|Template\.process|\.process\s*\(/i, "template_injection", "CWE-1336"],
+  [/XPath\.evaluate|XPath\.compile|XPathExpression|XPathFactory/i, "xpath_injection", "CWE-643"],
+  [/DirContext\.search|LdapTemplate\.search|InitialDirContext/i, "ldap_injection", "CWE-90"]
 ];
 var JAVA_SANITIZERS = [
   [/HtmlUtils\.htmlEscape/i, ["html_render"]],
@@ -52455,7 +52483,10 @@ var SINK_DIRECTIVES = {
   html_render: "Validate the XSS with strike_verify (reflected marker script vs inert control). Check WAF first with detect_waf — many XSS are filtered at the edge.",
   xml_processing: "Validate XXE with strike_verify (external entity marker vs control). Read payload_lookup for xxe payloads.",
   archive_extraction: "Validate the archive/path issue (zip-slip / path traversal) with strike_verify. Confirm the extraction path is attacker-controlled.",
-  path_traversal: "Validate path traversal with strike_verify (marker file read vs control). Read payload_lookup for path-traversal payloads."
+  path_traversal: "Validate path traversal with strike_verify (marker file read vs control). Read payload_lookup for path-traversal payloads.",
+  template_injection: "SSTI needs a template-expression probe (e.g. {{7*7}} / ${7*7} / <%= 7*7 %>) — the marker is the evaluated arithmetic, the control is a benign literal. Confirm the template engine actually renders user input before reporting.",
+  xpath_injection: "Validate XPath injection with strike_verify (an XPath boolean/union probe vs a control that stays inert). Confirm the XPath expression is built from attacker-controlled input.",
+  ldap_injection: "Validate LDAP injection with strike_verify (an LDAP filter-wildcard/OR probe vs a control). Confirm the filter is concatenated from attacker-controlled input."
 };
 function nextSteps(ctx) {
   const steps = [];
@@ -53131,7 +53162,10 @@ var SINK_CLASSES = [
   "html_render",
   "xml_processing",
   "archive_extraction",
-  "path_traversal"
+  "path_traversal",
+  "template_injection",
+  "xpath_injection",
+  "ldap_injection"
 ];
 var PHP_SINKS2 = {
   sql_execution: true,
@@ -53143,9 +53177,12 @@ var PHP_SINKS2 = {
   http_request: true,
   redirect: true,
   html_render: true,
-  xml_processing: false,
-  archive_extraction: false,
-  path_traversal: true
+  xml_processing: true,
+  archive_extraction: true,
+  path_traversal: true,
+  template_injection: true,
+  xpath_injection: true,
+  ldap_injection: true
 };
 var JS_SINKS2 = {
   sql_execution: true,
@@ -53157,9 +53194,12 @@ var JS_SINKS2 = {
   http_request: true,
   redirect: true,
   html_render: true,
-  xml_processing: false,
-  archive_extraction: false,
-  path_traversal: true
+  xml_processing: true,
+  archive_extraction: true,
+  path_traversal: true,
+  template_injection: true,
+  xpath_injection: true,
+  ldap_injection: true
 };
 var PY_SINKS2 = {
   sql_execution: true,
@@ -53168,12 +53208,15 @@ var PY_SINKS2 = {
   file_operations: true,
   file_inclusion: false,
   deserialization: true,
-  http_request: false,
+  http_request: true,
   redirect: true,
   html_render: true,
-  xml_processing: false,
-  archive_extraction: false,
-  path_traversal: true
+  xml_processing: true,
+  archive_extraction: true,
+  path_traversal: true,
+  template_injection: true,
+  xpath_injection: true,
+  ldap_injection: true
 };
 var JAVA_SINKS2 = {
   sql_execution: true,
@@ -53185,9 +53228,12 @@ var JAVA_SINKS2 = {
   http_request: true,
   redirect: true,
   html_render: true,
-  xml_processing: false,
-  archive_extraction: false,
-  path_traversal: true
+  xml_processing: true,
+  archive_extraction: true,
+  path_traversal: true,
+  template_injection: true,
+  xpath_injection: true,
+  ldap_injection: true
 };
 var SINK_BY_LANG = {
   php: PHP_SINKS2,
@@ -53244,7 +53290,7 @@ function createServer() {
     name: "blitzstrike",
     version: "1.0.0"
   }, {
-    instructions: "Blitz Strike is a universal penetration-testing toolbelt with three tiers — " + "BLITZ (reconnaissance / attack-surface mapping), EAGLE-EYE (source-to-sink " + "analysis), STRIKE (live validation) — plus a canonical evidence-first finding " + "engine and a multi-language taint engine.\\n\\n" + "CORE MENTAL MODEL:\\n" + "- A scanner hit is a HYPOTHESIS, not a finding. Live verification (or data-flow " + "  proof) is the verdict. Never report an unverified hit as a vulnerability.\\n" + "- Distinguish REACHABLE from mere PRESENT: a sink is only a finding when tainted " + "  input reaches it AND it is not neutralized by a sanitizer and not guarded by an " + "  auth gate.\\n\\n" + "HOW TO RUN AN AUDIT (start here):\\n" + "1. SCOPE FIRST. Call scope_check(target, scope, mode) before ANY active testing. " + "   Passive analysis (reading source, fingerprinting public pages) needs no gate; " + "   active probing (exploitation, fuzzing, path brute-force) is blocked until scope " + "   authorizes it.\\n" + "2. MAP THE SURFACE (BLITZ). For a source tree use blitz_scan (tree) or blitz_file " + "   (single file) then enrich_scan to match sinks to escalation chains. For a live " + "   URL use live_recon for a full pass (fingerprint/WAF/tech/version/crawler/params/" + "   subdomains/API endpoints/intel correlation) — it returns next_steps. active_scan " + "   is the lighter gated alternative. Both re-check scope internally.\\n" + "3. TRACE REACHABILITY (EAGLE-EYE). For every sink, determine whether attacker " + "   input actually reaches it:\\n" + "   - PHP/JS/TS/Python/Java source: taint_file (auto-detects language) or " + "     taint_scan/taint_tree (PHP AST). list_languages shows what's supported.\\n" + "   - Any language: trace_data_flow (window heuristic) and eagle_eye/eagle_grep " + "     (function-scoped view of sinks + auth gates).\\n" + "   A sink counts only if tainted input reaches it unsanitized and unguarded.\\n" + "4. VALIDATE (STRIKE). Confirm live with strike_verify using a MARKER plus a " + "   NEGATIVE CONTROL plus a BASELINE. The verdict is deterministic: marker " + "   reflected AND control inert = confirmed; both reflected = false_positive; " + "   marker not reflected = unconfirmed. Feed the verdict to strike_resolve to " + "   advance the finding lifecycle (hypothesis->validating->confirmed). Use " + "   read_tool_manual for the exploit tool's manual, payload_lookup for payloads, " + "   detect_waf/tech_correlation for context.\\n" + "5. RECORD + REPORT. Create a canonical finding with finding_create, advance it " + "   through the lifecycle with finding_transition, attach confidence_score, and " + "   redact any secrets before persisting. Only report findings that survived " + "   verification.\\n\\n" + "SUPPORTING LAYERS:\\n" + "- run_engagement: ONE call does the whole audit (no babysitting). Source path -> " + "  full static pipeline + inline report (markdown/JSON/SARIF). URL target -> " + "  autonomous live marker sweep + confirmed findings + report. Prefer this first.\\n" + "- list_languages / taint_file: multi-language taint (PHP, JS/TS, Python, Java).\\n" + "- list_chains: 57 escalation chains (source -> sink -> impact).\\n" + "- tool_lookup / ensure_tool / list_tools: 130-tool catalog, auto-install.\\n" + "- skill_lookup / read_skill / list_skills: 85 playbooks (WP/PHP 0-day, AD, " + "  malware, mobile, cloud, etc.).\\n" + "- read_playbook / read_tool_manual / list_manuals: 270 tool manuals + engagement " + "  playbooks.\\n" + "- detect_waf / tech_correlation / cve_correlation / port_correlation: signature " + "  + correlation intelligence.\\n" + "- nvd_lookup / fofa_search: CVE + asset reconnaissance (FOFA needs env creds).\\n" + "- remember / memory_lookup / memory_list: persist + recall verified knowledge.\\n\\n" + "IRON RULES:\\n" + "- Scope first; authorized targets only. Refuse out-of-scope or destructive/DoS work.\\n" + "- A hit is a hypothesis; a verified exploit (or proven data-flow) is the finding.\\n" + "- Prefer the one-call run_engagement path; fall back to granular tools when you " + "  need finer control."
+    instructions: "Blitz Strike is a universal penetration-testing toolbelt with three tiers — " + "BLITZ (reconnaissance / attack-surface mapping), EAGLE-EYE (source-to-sink " + "analysis), STRIKE (live validation) — plus a canonical evidence-first finding " + "engine and a multi-language taint engine.\\n\\n" + "CORE MENTAL MODEL:\\n" + "- A scanner hit is a HYPOTHESIS, not a finding. Live verification (or data-flow " + "  proof) is the verdict. Never report an unverified hit as a vulnerability.\\n" + "- Distinguish REACHABLE from mere PRESENT: a sink is only a finding when tainted " + "  input reaches it AND it is not neutralized by a sanitizer and not guarded by an " + "  auth gate.\\n\\n" + "HOW TO RUN AN AUDIT (start here):\\n" + "1. SCOPE FIRST. Call scope_check(target, scope, mode) before ANY active testing. " + "   Passive analysis (reading source, fingerprinting public pages) needs no gate; " + "   active probing (exploitation, fuzzing, path brute-force) is blocked until scope " + "   authorizes it.\\n" + "2. MAP THE SURFACE (BLITZ). For a source tree use blitz_scan (tree) or blitz_file " + "   (single file) then enrich_scan to match sinks to escalation chains. For a live " + "   URL use live_recon for a full pass (fingerprint/WAF/tech/version/crawler/params/" + "   subdomains/API endpoints/intel correlation) — it returns next_steps. active_scan " + "   is the lighter gated alternative. Both re-check scope internally.\\n" + "3. TRACE REACHABILITY (EAGLE-EYE). For every sink, determine whether attacker " + "   input actually reaches it:\\n" + "   - PHP/JS/TS/Python/Java source: taint_file (auto-detects language) or " + "     taint_scan/taint_tree (PHP AST). list_languages shows what's supported.\\n" + "   - Any language: trace_data_flow (window heuristic) and eagle_eye/eagle_grep " + "     (function-scoped view of sinks + auth gates). Beyond taint: route_scan (route confusion / dispatch abuse / batch forwarding) and complex_scan (deserialization->POP, type juggling, mass assignment) catch classes plain taint misses.\\n" + "   A sink counts only if tainted input reaches it unsanitized and unguarded.\\n" + "4. VALIDATE (STRIKE). Confirm live with strike_verify using a MARKER plus a " + "   NEGATIVE CONTROL plus a BASELINE. The verdict is deterministic: marker " + "   reflected AND control inert = confirmed; both reflected = false_positive; " + "   marker not reflected = unconfirmed. Feed the verdict to strike_resolve to " + "   advance the finding lifecycle (hypothesis->validating->confirmed). Use " + "   read_tool_manual for the exploit tool's manual, payload_lookup for payloads, " + "   detect_waf/tech_correlation for context.\\n" + "5. RECORD + REPORT. Create a canonical finding with finding_create, advance it " + "   through the lifecycle with finding_transition, attach confidence_score, and " + "   redact any secrets before persisting. Only report findings that survived " + "   verification.\\n\\n" + "SUPPORTING LAYERS:\\n" + "- run_engagement: ONE call does the whole audit (no babysitting). Source path -> " + "  full static pipeline + inline report (markdown/JSON/SARIF). URL target -> " + "  autonomous live marker sweep + confirmed findings + report. Prefer this first.\\n" + "- list_languages / taint_file: multi-language taint (PHP, JS/TS, Python, Java).\\n" + "- list_chains: 57 escalation chains (source -> sink -> impact).\\n" + "- tool_lookup / ensure_tool / list_tools: 130-tool catalog, auto-install.\\n" + "- skill_lookup / read_skill / list_skills: 38 skills (WP/PHP 0-day, AD, " + "  malware, mobile, cloud, etc.).\\n" + "- read_playbook / read_tool_manual / list_manuals: 270 tool manuals + engagement " + "  playbooks.\\n" + "- detect_waf / tech_correlation / cve_correlation / port_correlation: signature " + "  + correlation intelligence.\\n" + "- nvd_lookup / fofa_search: CVE + asset reconnaissance (FOFA needs env creds).\\n" + "- remember / memory_lookup / memory_list: persist + recall verified knowledge.\\n\\n" + "IRON RULES:\\n" + "- Scope first; authorized targets only. Refuse out-of-scope or destructive/DoS work.\\n" + "- A hit is a hypothesis; a verified exploit (or proven data-flow) is the finding.\\n" + "- Prefer the one-call run_engagement path; fall back to granular tools when you " + "  need finer control."
   });
   server.registerTool("blitz_scan", {
     title: "BLITZ scan",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.70",
+  "version": "1.0.72",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {