blitzstrike 1.0.95 → 1.0.96

package/CHANGELOG.md

@@ -5,6 +5,22 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.0.96] — 2026-09-13
+
+### Added — advanced web live hunting doctrine, separated from source audit
+
+- New `bs-web-hunting` skill: advanced LIVE web bug hunting — deep recon (JS
+  maps, parameter mining, versioned APIs, exposed config), advanced injection
+  (HTTP request smuggling, cache poisoning/deception, SSRF bypass ladder, race
+  conditions, deserialization gadget chains, SSTI filter bypass, prototype
+  pollution), advanced auth (JWT key confusion, OAuth redirect, host-header
+  poisoning), client-side (CORS/CSP/open-redirect), API (GraphQL/WebSocket/
+  IDOR), and the chain mindset — all still gated by marker + negative control.
+- Routing now separates the TWO doctrines explicitly: live web/API →
+  `web-hunting`; source tree → `source-audit`. The LLM never mixes them.
+- Scope relaxed: authorize ONCE, then hunt aggressively (no re-asking each
+  step); unauthorized targets are still refused.
+
 ## [1.0.95] — 2026-09-13
 
 ### Added — three new complex-bug detectors (deepen the moat)

package/dist/index.js

@@ -53677,8 +53677,8 @@ function createServer() {
     name: "blitzstrike",
     version: "1.0.0"
   }, {
-    instructions: "Blitz Strike is a universal penetration-testing toolbelt with three tiers — " + "BLITZ (reconnaissance / attack-surface mapping), EAGLE-EYE (source-to-sink " + "analysis), STRIKE (live validation) — plus a canonical evidence-first finding " + "engine and a multi-language taint engine.\\n\\n" + "CORE MENTAL MODEL:\\n" + "- A scanner hit is a HYPOTHESIS, not a finding. Live verification (or data-flow " + "  proof) is the verdict. Never report an unverified hit as a vulnerability.\\n" + "- Distinguish REACHABLE from mere PRESENT: a sink is only a finding when tainted " + "  input reaches it AND it is not neutralized by a sanitizer and not guarded by an " + "  auth gate.\\n\\n" + "HOW TO RUN AN AUDIT (start here):\\n" + "0. ROUTE BY TARGET. Classify the target automatically - no need to ask. A " + "   URL - with or without http/https (example.com, 192.168.1.1, host:8080) - " + "   is LIVE (scope-gated, then live_recon + active_scan + strike_verify). A " + "   filesystem path (exists on disk, or a code extension) is SOURCE audit " + "   (blitz_scan + eagle_eye2 + complex_scan/route_scan). If the scheme is " + "   missing, prepend https://. run_engagement auto-detects both internally.\\n" + "1. SCOPE FIRST. Call scope_check(target, scope, mode) before ANY active testing. " + "   Passive analysis (reading source, fingerprinting public pages) needs no gate; " + "   active probing (exploitation, fuzzing, path brute-force) is blocked until scope " + "   authorizes it.\\n" + "2. MAP THE SURFACE (BLITZ). For a source tree use blitz_scan (tree) or blitz_file " + "   (single file) then enrich_scan to match sinks to escalation chains. For a live " + "   URL use live_recon for a full pass (fingerprint/WAF/tech/version/crawler/params/" + "   subdomains/API endpoints/intel correlation) — it returns next_steps. active_scan " + "   is the lighter gated alternative. Both re-check scope internally.\\n" + "3. TRACE REACHABILITY (EAGLE-EYE). For every sink, determine whether attacker " + "   input actually reaches it:\\n" + "   - PHP/JS/TS/Python/Java source: taint_file (auto-detects language) or " + "     taint_scan/taint_tree (PHP AST). list_languages shows what's supported.\\n" + "   - Any language: trace_data_flow (window heuristic) and eagle_eye/eagle_grep " + "     (function-scoped view of sinks + auth gates). Beyond taint: route_scan (route confusion / dispatch abuse / batch forwarding) and complex_scan (deserialization->POP, type juggling, mass assignment, prototype pollution, CRLF/header injection, path confusion) catch classes plain taint misses.\\n" + "   A sink counts only if tainted input reaches it unsanitized and unguarded.\\n" + "4. VALIDATE (STRIKE). Confirm live with strike_verify using a MARKER plus a " + "   NEGATIVE CONTROL plus a BASELINE. The verdict is deterministic: marker " + "   reflected AND control inert = confirmed; both reflected = false_positive; " + "   marker not reflected = unconfirmed. Feed the verdict to strike_resolve to " + "   advance the finding lifecycle (hypothesis->validating->confirmed). Use " + "   read_tool_manual for the exploit tool's manual, payload_lookup for payloads, " + "   detect_waf/tech_correlation for context.\\n" + "5. RECORD + REPORT. Create a canonical finding with finding_create, advance it " + "   through the lifecycle with finding_transition, attach confidence_score, and " + "   redact any secrets before persisting. Only report findings that survived " + "   verification.\\n\\n" + "SUPPORTING LAYERS:\\n" + "- run_engagement: ONE call does the whole audit (no babysitting). Source path -> " + "  full static pipeline + inline report (markdown/JSON/SARIF). URL target -> " + "  autonomous live marker sweep + confirmed findings + report. Prefer this first.\\n" + "- list_chains: 57 escalation chains (source -> sink -> impact).\\n" + "- list_languages / taint_file: multi-language taint (PHP, JS/TS, Python, Java).\\n" + "- tool_lookup / ensure_tool / list_tools: 130-tool catalog, auto-install.\\n" + "- read_playbook / list_playbooks: 17 engagement playbooks (web-app, api-security, " + "  source-code-audit, active-directory, mobile, external-attack-surface, ...).\\n" + "- skill_lookup / read_skill / list_skills: 38 skills (6 bs-* agent doctrine + " + "  technique playbooks: WP/PHP 0-day, AD, malware, mobile, cloud).\\n" + "- read_tool_manual / list_manuals: 317 tool manuals (sqlmap, nmap, commix, ...).\\n" + "- payload_lookup / read_payload: 66 payload collections (sqli, xss, ssti, xxe, lfi).\\n" + "- detect_waf / tech_correlation / cve_correlation / port_correlation: signature " + "  + correlation intelligence.\\n" + "- nvd_lookup / fofa_search: CVE lookup + asset reconnaissance (FOFA needs env creds).\\n" + "- remember / memory_lookup / memory_list: persist + recall verified knowledge.\\n\\n" + "RESOURCE MAP (know what to reach for):\\n" + "- ORCHESTRATION = the engagement framework. orchestration() returns the " + "  lifecycle (scope->recon->analyze->deep->verify->report, each with " + "  entry/exit criteria) + sub-agent team + handoff contract + termination " + "  criteria. Load it at engagement start.\\n" + "- TOOL = acts (scan, taint, verify, record, correlate). Call it to DO something.\\n" + "- PLAYBOOK = campaign plan for a target TYPE. read_playbook(web-application) " + "  BEFORE a full engagement of that type.\\n" + "- SKILL = procedure doctrine. Load the bs-* skill for the phase you are on " + "  (orchestrate, scope, source-audit, verify, review, report); load a technique " + "  skill for the specific technique (WP 0-day, AD, malware).\\n" + "- MANUAL = deep reference for ONE tool. read_tool_manual right before using it.\\n" + "- CATALOG = external tools (130: sqlmap, nmap, nuclei, ffuf, ysoserial, ...). " + "  Blitz Strike's OWN tools find + verify; the catalog is for deeper EXTERNAL " + "  exploitation/enumeration. After your own analysis confirms a finding, run " + "  tool_lookup -> ensure_tool (auto-install) -> read_tool_manual to drive the " + "  external tool that demonstrates impact.\\n" + "- PAYLOAD = attack payloads for a class. payload_lookup before crafting a probe.\\n" + "- INTELLIGENCE = knowledge. list_attack_vectors (34 categories) maps the " + "  full surface during RECON; list_chains (57) turns a finding into impact; " + "  chain_links composes chains for complex bugs; bypass_lookup when blocked; " + "  payload_lookup when crafting a probe. Reach for them at that moment.\\n\\n" + "NO-BABYSITTING (while scanning + testing):\\n" + "- Scan the WHOLE surface before reporting - every file, entry point, and sink. " + "  Do not stop after the first hit to ask; keep enumerating the full tree.\\n" + "- Test every hypothesis through its full verification cycle - vary probes on " + "  failure, apply bypasses when blocked, keep going. Do not pause to ask.\\n" + "- Persist through partial results: a scan that surfaces few sinks is NOT done - " + "  widen the surface, escalate detectors, dig into each reachable sink.\\n" + "- Only surface to the user when: scope/authorization is genuinely unclear, a " + "  destructive or DoS action needs explicit consent, or the engagement is complete.\\n\\n" + "PERSISTENCE (complex bugs - do not give up):\\n" + "- On any failure (empty output, blocked probe, failed sub-agent/model), call " + "  retry_guidance(signal) for concrete recovery actions before giving up.\\n" + "- On a model/sub-agent error (rate-limit, quota, timeout, 5xx, auth, " + "  unavailable), model_fallback(signal) classifies it and returns the exact " + "  recovery (retry+backoff / fall back / shrink scope / fix credentials / " + "  abort). Do not fall back blindly - the class decides.\\n" + "- One failed probe != not vulnerable. Vary: alternative sinks, other params, " + "  encoding/case/whitespace bypasses, different injection context.\\n" + "- Empty output != no findings. Re-run (server may be stale after an upgrade - " + "  /reload-mcp), or escalate to route_scan / complex_scan for classes taint " + "  misses (POP chains, type juggling, mass assignment, route confusion).\\n" + "- A 'sanitized' sink may not be safe. Challenge the sanitizer: loose == vs ===, " + "  missing EXTR_SKIP, int cast truncation, weak regex.\\n" + "- An unconfirmed hypothesis is KEPT as hypothesis - try alternate verification, " + "  then let adversarial review decide.\\n" + "- Complex chains (deserialization->POP, LFI->RCE) need the FULL chain traced, " + `  not just the first sink.\\n
-` + "- When a probe is BLOCKED by a WAF/filter/sanitizer, call bypass_lookup(defense) " + "  for concrete techniques (encoding, case, comment insertion, chunked, null byte, " + "  double-encoding, verb tampering, header spoofing) and apply them - do not give up.\\n" + "- CHAIN findings: a low-severity finding may escalate — do not assume it is the " + "  end of the story. list_chains / chain_links show whether it composes into a " + "  multi-stage chain (e.g. SSRF->metadata, SQLi->RCE, LFI->RCE, upload->shell). " + "  Check before concluding, and do not overclaim an escalation that is not there.\\n\\n" + "- Complex bugs chain ACROSS chains: after confirming one chain, chain_links " + "  shows what follows (SSRF->metadata then default-creds->pivot via stolen IAM). " + "  Trace the full composition, not just a single chain.\\n\\n" + "HYPOTHESIS EXPANSION (from each finding, enumerate + verify every follow-up):\\n" + "- A confirmed finding is the START, not the end. From each one, enumerate " + "  the follow-ups: ESCALATE (list_chains + chain_links), CHAIN (chain_links " + "  from->to), BYPASS (bypass_lookup), PIVOT (new endpoints/sinks now reachable).\\n" + "- Every follow-up (this might happen, this could chain, maybe bypassable) is " + "  a HYPOTHESIS, not a finding. Verify EACH via strike_verify (marker + negative " + "  control) before it enters the report.\\n" + "- Never report speculation: might / could / possibly live in the " + "  hypothesis list, never in the report. Every report line is a verified fact.\\n\\n" + "PROFESSIONAL JUDGMENT (act like a senior tester, not a checklist runner):\\n" + "- PRIORITIZE by severity, computed deterministically with cvss_score (impact x " + "  exploitability) and weighted by escalation potential (chain_links). Do NOT rank " + "  by bug class - a critical stored XSS that yields account takeover outranks an " + "  unreachable blind RCE. Weight by the engagement context (which asset/data is " + "  most sensitive for THIS target).\\n" + "- Recognize dead ends: if a branch yields nothing after a few varied probes, " + "  note it and move on. Do not tunnel-vision one sink at the expense of the rest.\\n" + "- Live-test with care: respect rate limits, do not lock accounts, do not " + "  trigger DoS. Test non-destructively and prove impact with the smallest payload.\\n" + "- Know when done: stop when the termination criteria are met, not when you feel " + "  tired. A thorough audit over a rushed one, every time.\\n\\n" + "IRON RULES:\\n" + "- Scope first; authorized targets only. Refuse out-of-scope or destructive/DoS work.\\n" + "- A hit is a hypothesis; a verified exploit (or proven data-flow) is the finding.\\n" + "- Prefer the one-call run_engagement path; fall back to granular tools when you " + "  need finer control."
+    instructions: "Blitz Strike is a universal penetration-testing toolbelt with three tiers — " + "BLITZ (reconnaissance / attack-surface mapping), EAGLE-EYE (source-to-sink " + "analysis), STRIKE (live validation) — plus a canonical evidence-first finding " + "engine and a multi-language taint engine.\\n\\n" + "CORE MENTAL MODEL:\\n" + "- A scanner hit is a HYPOTHESIS, not a finding. Live verification (or data-flow " + "  proof) is the verdict. Never report an unverified hit as a vulnerability.\\n" + "- Distinguish REACHABLE from mere PRESENT: a sink is only a finding when tainted " + "  input reaches it AND it is not neutralized by a sanitizer and not guarded by an " + "  auth gate.\\n\\n" + "HOW TO RUN AN AUDIT (start here):\\n" + "0. ROUTE BY TARGET. Classify automatically - no need to ask. A URL - with or " + "   without http/https - is LIVE (scope_check once, then live_recon + the " + "   web-hunting doctrine + strike_verify). A filesystem path (exists on disk, " + "   or a code extension) is SOURCE audit (source-audit doctrine: blitz_scan + " + "   eagle_eye2 + complex_scan/route_scan). TWO DOCTRINES - never mix: live " + "   web/API -> web-hunting skill; source tree -> source-audit skill.\\n" + "1. SCOPE FIRST. Call scope_check(target, scope, mode) before ANY active testing. " + "   Passive analysis (reading source, fingerprinting public pages) needs no gate; " + "   active probing (exploitation, fuzzing, path brute-force) is blocked until scope " + "   authorizes it.\\n" + "2. MAP THE SURFACE (BLITZ). For a source tree use blitz_scan (tree) or blitz_file " + "   (single file) then enrich_scan to match sinks to escalation chains. For a live " + "   URL use live_recon for a full pass (fingerprint/WAF/tech/version/crawler/params/" + "   subdomains/API endpoints/intel correlation) — it returns next_steps. active_scan " + "   is the lighter gated alternative. Both re-check scope internally.\\n" + "3. TRACE REACHABILITY (EAGLE-EYE). For every sink, determine whether attacker " + "   input actually reaches it:\\n" + "   - PHP/JS/TS/Python/Java source: taint_file (auto-detects language) or " + "     taint_scan/taint_tree (PHP AST). list_languages shows what's supported.\\n" + "   - Any language: trace_data_flow (window heuristic) and eagle_eye/eagle_grep " + "     (function-scoped view of sinks + auth gates). Beyond taint: route_scan (route confusion / dispatch abuse / batch forwarding) and complex_scan (deserialization->POP, type juggling, mass assignment, prototype pollution, CRLF/header injection, path confusion) catch classes plain taint misses.\\n" + "   A sink counts only if tainted input reaches it unsanitized and unguarded.\\n" + "4. VALIDATE (STRIKE). Confirm live with strike_verify using a MARKER plus a " + "   NEGATIVE CONTROL plus a BASELINE. The verdict is deterministic: marker " + "   reflected AND control inert = confirmed; both reflected = false_positive; " + "   marker not reflected = unconfirmed. Feed the verdict to strike_resolve to " + "   advance the finding lifecycle (hypothesis->validating->confirmed). Use " + "   read_tool_manual for the exploit tool's manual, payload_lookup for payloads, " + "   detect_waf/tech_correlation for context.\\n" + "5. RECORD + REPORT. Create a canonical finding with finding_create, advance it " + "   through the lifecycle with finding_transition, attach confidence_score, and " + "   redact any secrets before persisting. Only report findings that survived " + "   verification.\\n\\n" + "SUPPORTING LAYERS:\\n" + "- run_engagement: ONE call does the whole audit (no babysitting). Source path -> " + "  full static pipeline + inline report (markdown/JSON/SARIF). URL target -> " + "  autonomous live marker sweep + confirmed findings + report. Prefer this first.\\n" + "- list_chains: 57 escalation chains (source -> sink -> impact).\\n" + "- list_languages / taint_file: multi-language taint (PHP, JS/TS, Python, Java).\\n" + "- tool_lookup / ensure_tool / list_tools: 130-tool catalog, auto-install.\\n" + "- read_playbook / list_playbooks: 17 engagement playbooks (web-app, api-security, " + "  source-code-audit, active-directory, mobile, external-attack-surface, ...).\\n" + "- skill_lookup / read_skill / list_skills: 39 skills (7 bs-* agent doctrine: " + "  orchestrate, scope, source-audit, web-hunting, verify, review, report; + " + "  technique playbooks: WP/PHP 0-day, AD, malware, mobile, cloud).\\n" + "- read_tool_manual / list_manuals: 317 tool manuals (sqlmap, nmap, commix, ...).\\n" + "- payload_lookup / read_payload: 66 payload collections (sqli, xss, ssti, xxe, lfi).\\n" + "- detect_waf / tech_correlation / cve_correlation / port_correlation: signature " + "  + correlation intelligence.\\n" + "- nvd_lookup / fofa_search: CVE lookup + asset reconnaissance (FOFA needs env creds).\\n" + "- remember / memory_lookup / memory_list: persist + recall verified knowledge.\\n\\n" + "RESOURCE MAP (know what to reach for):\\n" + "- ORCHESTRATION = the engagement framework. orchestration() returns the " + "  lifecycle (scope->recon->analyze->deep->verify->report, each with " + "  entry/exit criteria) + sub-agent team + handoff contract + termination " + "  criteria. Load it at engagement start.\\n" + "- TOOL = acts (scan, taint, verify, record, correlate). Call it to DO something.\\n" + "- PLAYBOOK = campaign plan for a target TYPE. read_playbook(web-application) " + "  BEFORE a full engagement of that type.\\n" + "- SKILL = procedure doctrine. Load the bs-* skill for the phase you are on " + "  (orchestrate, scope, web-hunting for LIVE, source-audit for SOURCE, verify, " + "  review, report); load a technique skill for the specific technique.\\n" + "- MANUAL = deep reference for ONE tool. read_tool_manual right before using it.\\n" + "- CATALOG = external tools (130: sqlmap, nmap, nuclei, ffuf, ysoserial, ...). " + "  Blitz Strike's OWN tools find + verify; the catalog is for deeper EXTERNAL " + "  exploitation/enumeration. After your own analysis confirms a finding, run " + "  tool_lookup -> ensure_tool (auto-install) -> read_tool_manual to drive the " + "  external tool that demonstrates impact.\\n" + "- PAYLOAD = attack payloads for a class. payload_lookup before crafting a probe.\\n" + "- INTELLIGENCE = knowledge. list_attack_vectors (34 categories) maps the " + "  full surface during RECON; list_chains (57) turns a finding into impact; " + "  chain_links composes chains for complex bugs; bypass_lookup when blocked; " + "  payload_lookup when crafting a probe. Reach for them at that moment.\\n\\n" + "NO-BABYSITTING (while scanning + testing):\\n" + "- Scan the WHOLE surface before reporting - every file, entry point, and sink. " + "  Do not stop after the first hit to ask; keep enumerating the full tree.\\n" + "- Test every hypothesis through its full verification cycle - vary probes on " + "  failure, apply bypasses when blocked, keep going. Do not pause to ask.\\n" + "- Persist through partial results: a scan that surfaces few sinks is NOT done - " + "  widen the surface, escalate detectors, dig into each reachable sink.\\n" + "- Only surface to the user when: scope/authorization is genuinely unclear, a " + "  destructive or DoS action needs explicit consent, or the engagement is complete.\\n\\n" + "PERSISTENCE (complex bugs - do not give up):\\n" + "- On any failure (empty output, blocked probe, failed sub-agent/model), call " + "  retry_guidance(signal) for concrete recovery actions before giving up.\\n" + "- On a model/sub-agent error (rate-limit, quota, timeout, 5xx, auth, " + "  unavailable), model_fallback(signal) classifies it and returns the exact " + "  recovery (retry+backoff / fall back / shrink scope / fix credentials / " + "  abort). Do not fall back blindly - the class decides.\\n" + "- One failed probe != not vulnerable. Vary: alternative sinks, other params, " + "  encoding/case/whitespace bypasses, different injection context.\\n" + "- Empty output != no findings. Re-run (server may be stale after an upgrade - " + "  /reload-mcp), or escalate to route_scan / complex_scan for classes taint " + "  misses (POP chains, type juggling, mass assignment, route confusion).\\n" + "- A 'sanitized' sink may not be safe. Challenge the sanitizer: loose == vs ===, " + "  missing EXTR_SKIP, int cast truncation, weak regex.\\n" + "- An unconfirmed hypothesis is KEPT as hypothesis - try alternate verification, " + "  then let adversarial review decide.\\n" + "- Complex chains (deserialization->POP, LFI->RCE) need the FULL chain traced, " + `  not just the first sink.\\n
+` + "- When a probe is BLOCKED by a WAF/filter/sanitizer, call bypass_lookup(defense) " + "  for concrete techniques (encoding, case, comment insertion, chunked, null byte, " + "  double-encoding, verb tampering, header spoofing) and apply them - do not give up.\\n" + "- CHAIN findings: a low-severity finding may escalate — do not assume it is the " + "  end of the story. list_chains / chain_links show whether it composes into a " + "  multi-stage chain (e.g. SSRF->metadata, SQLi->RCE, LFI->RCE, upload->shell). " + "  Check before concluding, and do not overclaim an escalation that is not there.\\n\\n" + "- Complex bugs chain ACROSS chains: after confirming one chain, chain_links " + "  shows what follows (SSRF->metadata then default-creds->pivot via stolen IAM). " + "  Trace the full composition, not just a single chain.\\n\\n" + "HYPOTHESIS EXPANSION (from each finding, enumerate + verify every follow-up):\\n" + "- A confirmed finding is the START, not the end. From each one, enumerate " + "  the follow-ups: ESCALATE (list_chains + chain_links), CHAIN (chain_links " + "  from->to), BYPASS (bypass_lookup), PIVOT (new endpoints/sinks now reachable).\\n" + "- Every follow-up (this might happen, this could chain, maybe bypassable) is " + "  a HYPOTHESIS, not a finding. Verify EACH via strike_verify (marker + negative " + "  control) before it enters the report.\\n" + "- Never report speculation: might / could / possibly live in the " + "  hypothesis list, never in the report. Every report line is a verified fact.\\n\\n" + "PROFESSIONAL JUDGMENT (act like a senior tester, not a checklist runner):\\n" + "- PRIORITIZE by severity, computed deterministically with cvss_score (impact x " + "  exploitability) and weighted by escalation potential (chain_links). Do NOT rank " + "  by bug class - a critical stored XSS that yields account takeover outranks an " + "  unreachable blind RCE. Weight by the engagement context (which asset/data is " + "  most sensitive for THIS target).\\n" + "- Recognize dead ends: if a branch yields nothing after a few varied probes, " + "  note it and move on. Do not tunnel-vision one sink at the expense of the rest.\\n" + "- Live-test with care: respect rate limits, do not lock accounts, do not " + "  trigger DoS. Test non-destructively and prove impact with the smallest payload.\\n" + "- Know when done: stop when the termination criteria are met, not when you feel " + "  tired. A thorough audit over a rushed one, every time.\\n\\n" + "IRON RULES:\\n" + "- Authorized targets only, authorize once, then hunt aggressively - do not " + "  re-ask each step. Refuse UNauthorized targets and destructive/DoS work.\\n" + "- Prefer the one-call run_engagement path; fall back to granular tools when you " + "  need finer control."
   });
   server.registerTool("blitz_scan", {
     title: "BLITZ scan",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.95",
+  "version": "1.0.96",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {

package/skills/bs-orchestrate-engagement.md

@@ -14,10 +14,18 @@ Classify the target before any tool call. This is automatic, driven by the
 shape of what the user gave you. A URL often has NO `http://`/`https://` prefix
 — a bare domain, IP, or host:port is still a live target:
 
-| Target shape | Flow |
+| Target shape | Flow + doctrine |
 |---|---|
-| URL — with or without scheme (`https://x.com`, `x.com`, `sub.x.com/path`, `x.com:8080`, `192.168.1.1`) | **Live** — `scope_check` (authorization) → `live_recon` → `active_scan` → `strike_verify` → report |
-| Filesystem path (exists on disk, or starts `/` `./` `../` `~`, or ends in a code extension `.php` `.py` `.js` `.ts` `.java` …) | **Source** — `blitz_scan` → `eagle_eye2` → `complex_scan`/`route_scan` → report |
+| URL — with or without scheme (`https://x.com`, `x.com`, `sub.x.com/path`, `x.com:8080`, `192.168.1.1`) | **LIVE** — `scope_check` (authorization) → `live_recon` → advanced hunting (`web-hunting` skill) → `strike_verify` → report |
+| Filesystem path (exists on disk, or starts `/` `./` `../` `~`, or ends in a code extension `.php` `.py` `.js` `.ts` `.java` …) | **SOURCE** — `blitz_scan` → `eagle_eye2` → `complex_scan`/`route_scan` (`source-audit` skill) → report |
+
+**TWO SEPARATE DOCTRINES — pick the right one, never mix them:**
+
+- **LIVE web / API target** → load `web-hunting` (advanced bug hunting:
+  request smuggling, cache poisoning, race conditions, SSRF bypass, JWT/OAuth,
+  host-header injection, prototype pollution, GraphQL/WebSocket, chain mindset).
+- **SOURCE code tree** → load `source-audit` (taint, route-confusion,
+  complex-bugs, differential, incremental).
 
 Rule of thumb: check "is it a filesystem path?" FIRST (exists on disk, or a
 code extension). If it is NOT a path, treat it as a live host — prepend
@@ -31,15 +39,18 @@ workstreams yourself: URL → live workstreams, path → source workstreams.
 After routing, read the matching playbook (`read_playbook`) for the target type
 — `web-application`, `api-security`, `source-code-audit`, `active-directory`,
 `mobile-application`, `external-attack-surface` — it is the campaign plan for
-that type. Load the phase skill (`source-audit`, `verify-finding`, …) for the
-step you are on. Do not improvise a plan the playbook already spells out.
+that type. Then load the doctrine skill for the step you are on (`web-hunting`
+for live, `source-audit` for source, `verify-finding` for verification). Do not
+improvise a plan the playbook already spells out.
 
 ## The cycle
 
-1. **Scope gate (always first).** Call `scope_check` before any live action.
-   A target outside scope or without authorization → refuse, record, stop.
-   Static source paths on disk are always in-scope; live URLs require an
-   explicit scope.
+1. **Scope gate (authorize, then go aggressive).** Confirm the target is
+   authorized — that is the only gate. Once authorized, do NOT keep pausing to
+   ask: run the full active test matrix (injection, exploitation, fuzzing,
+   advanced classes). An UNAUTHORIZED target → refuse, record, stop. A static
+   source path on disk is always in-scope; a live URL just needs the scope
+   confirmed once, then you hunt without re-asking.
 
    **Announce takeover.** When you start an engagement, `run_engagement`
    returns a `banner` ("orchestrator in control") as a standalone text block.

package/skills/bs-scope-gate.md

@@ -1,6 +1,6 @@
 ---
 name: scope-gate
-description: Use BEFORE any live action against a target (recon, scanning, exploitation, verification). Enforce scope and authorization boundaries — never touch a target outside the declared scope, and never run live actions against a target the user has not authorized.
+description: Use BEFORE any live action against a target (recon, scanning, exploitation, verification). Confirm authorization ONCE, then hunt aggressively within scope — never touch a target the user has NOT authorized, but do not keep pausing to re-ask once a target is authorized.
 ---
 
 # Scope gate
@@ -22,11 +22,14 @@ port scan, or exploitation step, resolve the boundary deterministically.
 
 - Malicious / third-party infrastructure ("cari pelaku") → hold, static analysis
   + takedown only. Never live-probe.
-- Authorized research targets → live action is fine, but only within the scope
-  the user declared.
+- Authorized research target → live action is fine and EXPECTED: hunt
+  aggressively (injection, exploitation, fuzzing, RCE) within the declared
+  scope. Do not re-ask permission for each step once the target is authorized.
 - A finding that depends on out-of-scope action is not a finding — drop it.
 
 ## Why
 
-"Scope cannot be bypassed." A tool that ignores scope is worse than a tool that
-misses a bug. The gate is a hard invariant, not a suggestion.
+"Authorize once, then hunt." A tool that ignores authorization is worse than a
+tool that misses a bug; but a tool that keeps refusing to act on an authorized
+target is not hunting at all. The gate confirms authorization ONCE — then the
+scope is the ceiling, not a list of excuses to stop.

package/skills/bs-web-hunting.md

@@ -0,0 +1,162 @@
+---
+name: web-hunting
+description: Use when the target is a LIVE web application or API and you are bug hunting — advanced, beyond basic OWASP. Deep recon, advanced injection (HTTP request smuggling, cache attacks, race conditions, SSRF bypass), advanced auth (JWT/OAuth), client-side attacks, and the chain mindset. Every finding still passes marker + negative control.
+---
+
+# Advanced Web Bug Hunting (live target)
+
+Professional bug hunting is not a checklist — it is **recon depth → advanced
+classes → chaining**. Basic SQLi/XSS is table stakes; the bugs that matter are
+the ones basic scanners miss. Hunt those.
+
+## Mindset
+
+- **The surface is bigger than you think.** JS bundles, source maps, hidden
+  endpoints, non-standard ports, versioned APIs, and callback URLs all leak
+  attack surface that a naive crawl misses.
+- **Every finding chains.** A cache poisoning is only interesting because it
+  becomes stored XSS; an open redirect matters because it steals an OAuth
+  token. Always ask "what does this escalate into?"
+- **Bypass, don't give up.** A WAF/sanitizer/filter is a puzzle, not a wall —
+  `bypass_lookup(defense)` for the concrete evasions.
+- **Still anti-FP.** None of the below is reported without `strike_verify`
+  (marker + negative control). Advanced ≠ speculative.
+
+## Phase 1 — Deep recon (map the real surface)
+
+1. **JS static analysis** — pull every `<script src>`; grep for endpoints,
+   `/api/`, tokens, keys, subdomains, and source-map refs. Download `.map`
+   files to recover original source + hidden routes.
+2. **Parameter mining** — `arjun` / `x8` / `ParamMiner` for hidden params;
+   fuzz common ones (`?debug=1`, `?backup=1`, `?admin=1`, `?source=1`).
+3. **Versioned/legacy APIs** — `/api/v1` vs `/api/v2` vs `/api/v3`, and
+   deprecated paths (`/old`, `/backup`, `/legacy`, `/dev`, `/staging`).
+4. **Exposed config** — `/.git/`, `/.env`, `/.svn/`, `/backup.zip`, `/wp-config.php.bak`,
+   `/.DS_Store`, `/composer.json`, `/package.json`, `/actuator/`, `/debug/`.
+5. **WAF fingerprint** — `detect_waf` before probing; a WAF changes the whole
+   payload strategy (encoding/case/chunked vs direct).
+6. **Non-standard ports + virtual hosts** — `live_recon` port scan; test
+   `X-Forwarded-Host`, `Host`, and alternate vhosts — they often route to
+   admin/internal apps.
+
+## Phase 2 — Advanced injection (beyond the basics)
+
+### HTTP request smuggling
+- Test CL.TE, TE.CL, TE.TE on every endpoint behind a front-end/back-end pair.
+- The prize: smuggled requests that poison the next user's request → session
+  hijack, cache poisoning, or WAF bypass.
+- `bypass_lookup(waf)` + `read_payload(request-smuggling)`; verify with a
+  timing marker (the smuggled request's response lands on YOUR request).
+
+### Web cache poisoning / deception
+- Find **unkeyed headers** that reflect into the response (`X-Forwarded-Host`,
+  `X-Forwarded-Scheme`, `X-Original-URL`, `X-Host`, custom `X-*`).
+- Poison the cache with a payload in an unkeyed header → stored on the shared
+  response → stored XSS for every visitor. Verify the cache is actually shared
+  (hit it from a second request + confirm the reflected payload persists).
+
+### SSRF — the bypass ladder
+- Basic `127.0.0.1`/`localhost` blocked? Escalate the ladder:
+  `127.1`, `0`, `0x7f000001`, `2130706433`, `017700000001`, `[::1]`,
+  `127.0.0.1.nip.io`, DNS rebinding, `http://127.0.0.1:80@evil/`, double-URL-encode.
+- Scheme tricks: `gopher://`, `dict://`, `file://`, `http://` to internal ports.
+- Redirect bypass: an allow-listed host that 302s to an internal address.
+- The prize: cloud metadata (`169.254.169.254`), Redis/Postgres, internal admin.
+  `ap-ssrf-cloud-metadata` skill has the metadata endpoints.
+
+### Race conditions
+- TOCTOU: spend-a-coupon-twice, withdraw-twice, redeem-twice — fire parallel
+  requests (single-packet attack via HTTP/2) and check for the double effect.
+- Session/register races, file-upload races (upload → check → replace).
+
+### Deserialization → RCE
+- Spot serialized blobs in params/cookies (PHP `O:`, Java `rO0AB`, .NET,
+  `pickle`). Build a gadget chain with `ysoserial`/`PHPGGC` (`tool_lookup`).
+- Verify with a marker command (`id`/`touch /tmp/<marker>`) via a callback —
+  never claim RCE without the command actually firing.
+
+### Server-side template injection
+- Probe with `{{7*7}}`, `${7*7}`, `<%= 7*7 %>`, `#{7*7}` — the marker is the
+  evaluated arithmetic (`49`), the control is a benign literal.
+- Filter bypass: nested attributes, `|attr`, string concat, `__mro__`/`__subclasses__`
+  (Python), `T(java.lang.Runtime)` (Java) for RCE.
+
+### Prototype pollution
+- Client-side: merge of `location.hash`/`URLSearchParams` into an object →
+  `__proto__`/`constructor.prototype` → XSS/gadget.
+- Server-side: `Object.assign`/`_.merge`/`lodash.merge` of request body → RCE
+  via polluted options (child_process, template, etc.).
+
+## Phase 3 — Auth & session (advanced)
+
+### JWT
+- `alg:none`; HS256/RS256 **key confusion** (sign with the public key as HMAC);
+  `kid` injection (path traversal / SQLi in `kid`); `jku`/`x5u` to an
+  attacker-controlled key URL.
+- Weak secret → crack with `jwt_tool`/`hashcat` (`tool_lookup(jwt_tool)`).
+
+### OAuth / SSO
+- `redirect_uri` confusion (open redirect, path/param variations, missing
+  `state`), `state` leakage → CSRF on the callback, code/token theft.
+- PKCE downgrade; client-secret leak; `response_type` tampering.
+
+### Host header injection
+- Password-reset poisoning: `Host: attacker.com` in the reset link → the token
+  is emailed to your host.
+- Routing bypass + cache poisoning via `Host`/`X-Forwarded-Host`.
+
+## Phase 4 — Client-side (advanced)
+
+### CORS
+- `Access-Control-Allow-Origin: null`, reflection of `Origin`, trusted-subdomain
+  takeover, missing `Vary: Origin` (cache leaks cross-origin responses),
+  `Access-Control-Allow-Credentials: true` + wildcard.
+
+### CSP bypass
+- Nonce reuse, `unsafe-inline`, JSONP endpoints, `script-src` whitelist that
+  allows a takeover-able domain, dangling markup injection.
+
+### Open redirect → impact
+- `//evil.com`, `https://trusted.com@evil.com`, `/%2f%2fevil.com`, backslash,
+  `javascript:` (rare) — then chain to OAuth token theft or credential
+  phishing (redirect to a lookalike login).
+
+## Phase 5 — API & modern stacks
+
+### GraphQL
+- Introspection dump → full schema. Aliases + batching to bypass rate limits
+  and force deep recursion (DoS). Field/authorization bypass: query a field the
+  UI hides. Batching to test IDOR across objects.
+
+### WebSocket
+- Cross-site WebSocket hijacking (no `Origin` check), message smuggling,
+  authorization on `connect` but not per-message.
+
+### IDOR / BOLA (advanced)
+- Not just `?id=1` → `?id=2`: parameterized references (`/users/me` →
+  `/users/<guid>`), mass assignment on PATCH, API version confusion, and
+  UUIDv4 vs sequential ID (a guessable ID is the bug). Verify by reading
+  another user's object across roles — never by "it returned 200".
+
+## Phase 6 — The chain mindset
+
+A single finding is rarely the end. For each confirmed finding, enumerate the
+follow-ups (`list_chains` + `chain_links`):
+
+- **Cache poisoning → stored XSS** (poison → every visitor gets your payload).
+- **Open redirect → OAuth token theft** (redirect steals the authorization code).
+- **Request smuggling → session hijack** (smuggled request captures the next user's session).
+- **SSRF → cloud metadata → credential theft → lateral movement**.
+- **Host header injection → password reset → account takeover**.
+- **Subdomain takeover → trusted-origin CORS/XSS on the parent**.
+
+Trace the full composition — that is the difference between a script-kiddie
+finding and a professional bug.
+
+## Verify (anti-FP still applies)
+
+Every hypothesis above becomes a finding only after `strike_verify` (unique
+marker + negative control + baseline). "This might be exploitable" is a
+hypothesis; "this IS exploitable (marker reflected, control inert)" is a
+finding. Report the latter only. Attach evidence, redact secrets, then chain
+into the next follow-up.