blitzstrike 1.0.98 → 1.0.99

package/CHANGELOG.md

@@ -5,6 +5,20 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.0.99] — 2026-09-13
+
+### Added — WSTG + HackTricks enrichment (interconnected doctrine)
+
+- New `wstg_map` MCP tool + `intelligence/wstg_map.json`: maps every OWASP
+  WSTG category (12) to the Blitz Strike skill/phase/tools/data that covers it,
+  including the high-value advanced tests (smuggling, SSRF, SSTI, deserialization,
+  prototype pollution, mass assignment, path confusion, GraphQL, WebSockets).
+- `bypass_techniques.json` auth category enriched with concrete 401/403 bypass
+  techniques (verb fuzzing, proxy-header spoofing, path normalization, API
+  version confusion, JSON parameter pollution, protocol/host confusion).
+- `bs-web-hunting` SSRF ladder gained DNS-rebinding-vs-safe-url-checks note.
+- THIRD-PARTY-NOTICES: added OWASP WSTG (CC BY-SA 4.0).
+
 ## [1.0.98] — 2026-09-13
 
 ### Added — interconnected doctrine map

package/THIRD-PARTY-NOTICES.md

@@ -48,6 +48,14 @@ satisfies the attribution requirements of those licenses.
 - **License:** MIT
 - **Used for:** ~11.9k YAML detection templates (`templates/`).
 
+## OWASP Web Security Testing Guide (WSTG)
+
+- **Source:** https://github.com/OWASP/wstg
+- **License:** CC BY-SA 4.0
+- **Used for:** the WSTG category/test taxonomy in `intelligence/wstg_map.json`
+  (category identifiers WSTG-INFO/CONF/IDNT/ATHN/ATHZ/SESS/INPV/ERRH/CRYP/
+  BUSL/CLNT/APIT and their test names).
+
 ---
 
 All other code, chains, and data in this project are written by shinthink

package/dist/index.js

@@ -31750,6 +31750,22 @@ function doctrineMap(part) {
     suggestions: ["cross_cutting", ...data.phases.map((p) => String(p.phase))]
   };
 }
+function wstgMap(category) {
+  const data = loadJson("wstg_map");
+  if (!data)
+    return { found: false, error: "wstg_map.json not found" };
+  if (!category) {
+    return {
+      found: true,
+      categories: data.categories.map((c) => ({ wstg: c.wstg, name: c.name, phase: c.phase, skill: c.skill }))
+    };
+  }
+  const q = category.toUpperCase();
+  const c = data.categories.find((x) => String(x.wstg).toUpperCase() === q || String(x.name).toLowerCase().includes(category.toLowerCase()) || String(x.wstg).toUpperCase().includes(q));
+  if (c)
+    return { found: true, ...c };
+  return { found: false, category, suggestions: data.categories.map((x) => String(x.wstg)) };
+}
 
 // src/active.ts
 var TIMEOUT_MS2 = 20000;
@@ -54234,6 +54250,15 @@ ${statusLine}` : statusLine },
   }, async ({ part }) => {
     return { content: [{ type: "text", text: JSON.stringify(doctrineMap(part)) }] };
   });
+  server.registerTool("wstg_map", {
+    title: "OWASP WSTG -> Blitz coverage map",
+    description: "INTEL: map an OWASP WSTG category (WSTG-INFO, WSTG-INPV, WSTG-BUSL, WSTG-CLNT, WSTG-APIT, ...) to the Blitz Strike skill, phase, tools, and data that covers it, including the high-value advanced tests where Blitz has a specific deterministic capability. Use to ground the engagement in the official framework.",
+    inputSchema: {
+      category: string2().optional().describe("Optional WSTG category id (e.g. WSTG-INPV) or name (e.g. 'Input Validation').")
+    }
+  }, async ({ category }) => {
+    return { content: [{ type: "text", text: JSON.stringify(wstgMap(category)) }] };
+  });
   server.registerTool("engagement_start", {
     title: "Start an engagement",
     description: "ORCHESTRATION: open an engagement and track its state. Call at the start of a full audit so subsequent engagement_phase / engagement_track / engagement_status calls have a state to update. The LLM is the brain; this is the deterministic bookkeeping hand.",

package/intelligence/bypass_techniques.json

@@ -31,11 +31,12 @@
       "id": "auth",
       "defense": "Authentication / authorization (401/403)",
       "techniques": [
-        {"id": "path_traversal", "name": "Path normalization", "how": "Bypass path-based ACL with traversal or encoding.", "example": "/admin/../admin, /admin%2f, /admin/.;/"},
-        {"id": "verb", "name": "HTTP verb tampering", "how": "Switch the method (GET->POST, add X-HTTP-Method-Override).", "example": "GET /admin -> POST /admin"},
-        {"id": "header", "name": "Header spoofing", "how": "Spoof X-Forwarded-For / X-Real-IP / X-Original-URL to appear internal.", "example": "X-Original-URL: /admin"},
-        {"id": "case_path", "name": "Case / suffix", "how": "Vary case or append suffix to dodge exact-match rules.", "example": "/Admin, /admin/.json, /admin/."},
-        {"id": "param", "name": "Parameter override", "how": "Override auth via a second parameter or body field the backend trusts.", "example": "user=guest&user=admin"}
+        {"id": "verb", "name": "HTTP verb tampering", "how": "Switch the method (GET->POST) or fuzz uncommon verbs (TRACE, HEAD, OPTIONS, PATCH, INVENTED, HACK) + X-HTTP-Method-Override.", "example": "GET /admin -> POST /admin; X-HTTP-Method-Override: PUT"},
+        {"id": "header", "name": "Proxy header spoofing", "how": "Spoof a proxy-origin header to appear internal/localhost; each proxy honors a different one.", "example": "X-Originating-IP, X-Forwarded-For, X-Forwarded, Forwarded-For, X-Remote-IP, X-Remote-Addr, X-ProxyUser-Ip, Client-IP, True-Client-IP, Cluster-Client-IP, Host: localhost, X-Original-URL: /admin, X-Rewrite-URL: /admin"},
+        {"id": "path_normalize", "name": "Path normalization", "how": "Bypass path-based ACL with traversal, encoding, case, suffix, or separator tricks.", "example": "/%2e/admin, /%252e/admin, //admin//, /./admin/.., /;/admin, /.;/admin, /Admin, /admin/., /admin.json, /admin%ef%bc%8f"},
+        {"id": "api_version", "name": "API version confusion", "how": "Hit a legacy or different API version that lacks the authorization check.", "example": "/v3/users/1234 -> /v1/users/1234"},
+        {"id": "param", "name": "Parameter override / pollution", "how": "Override auth via a second param, or pollute a JSON field with a duplicate key.", "example": "user=guest&user=admin; {\"user_id\":\"legit\",\"user_id\":\"victim\"}; id=111 -> id=[111] -> id={\"id\":111}"},
+        {"id": "proto", "name": "Protocol / host confusion", "how": "Switch http<->https, drop the Host header, or contact the origin IP/CNAME directly.", "example": "https://host -> http://host; remove Host header; resolve CNAME to origin"}
       ]
     },
     {

package/intelligence/wstg_map.json

@@ -0,0 +1,113 @@
+{
+  "_comment": "OWASP WSTG -> Blitz Strike coverage map. Each WSTG category maps to the Blitz skill/phase/tools/data that covers it; 'advanced' lists the high-value tests where Blitz has a specific deterministic or doctrine capability (the moat).",
+  "categories": [
+    {
+      "wstg": "WSTG-INFO",
+      "name": "Information Gathering",
+      "phase": "recon",
+      "skill": "web-hunting (live) / source-audit (source)",
+      "tools": ["live_recon", "list_attack_vectors", "detect_framework", "blitz_scan"],
+      "data": ["attack_vectors", "port_correlations", "tech_correlations"],
+      "advanced": ["Fingerprint Web Server/App/Framework", "Attack Surface Identification", "Map Application Architecture"]
+    },
+    {
+      "wstg": "WSTG-CONF",
+      "name": "Configuration & Deployment Management",
+      "phase": "recon",
+      "skill": "web-hunting",
+      "tools": ["live_recon", "active_scan"],
+      "data": [],
+      "advanced": ["Subdomain Takeover", "Cloud Storage", "Path Confusion", "Old Backup & Unreferenced Files", "Content Security Policy"]
+    },
+    {
+      "wstg": "WSTG-IDNT",
+      "name": "Identity Management",
+      "phase": "analyze",
+      "skill": "web-hunting",
+      "tools": ["active_scan"],
+      "data": ["payloads"],
+      "advanced": ["Account Enumeration & Guessable User Account"]
+    },
+    {
+      "wstg": "WSTG-ATHN",
+      "name": "Authentication",
+      "phase": "analyze",
+      "skill": "web-hunting",
+      "tools": ["active_scan", "bypass_lookup"],
+      "data": ["bypass_techniques", "payloads"],
+      "advanced": ["Bypassing Authentication Schema", "Weak Password Change/Reset", "Multi-Factor Authentication"]
+    },
+    {
+      "wstg": "WSTG-ATHZ",
+      "name": "Authorization",
+      "phase": "analyze",
+      "skill": "web-hunting + ap-idor-exploitation",
+      "tools": ["active_scan", "browser_validate"],
+      "data": [],
+      "advanced": ["Insecure Direct Object References", "Privilege Escalation", "OAuth Weaknesses", "Directory Traversal / File Include"]
+    },
+    {
+      "wstg": "WSTG-SESS",
+      "name": "Session Management",
+      "phase": "analyze",
+      "skill": "web-hunting",
+      "tools": ["active_scan"],
+      "data": ["payloads"],
+      "advanced": ["JSON Web Tokens", "Session Fixation", "Session Puzzling", "Cross-Site Request Forgery"]
+    },
+    {
+      "wstg": "WSTG-INPV",
+      "name": "Input Validation / Injection",
+      "phase": "analyze + deep",
+      "skill": "source-audit (taint) + web-hunting (advanced)",
+      "tools": ["eagle_eye2", "taint_file", "complex_scan", "active_scan"],
+      "data": ["chains", "chain_links", "payloads", "bypass_techniques"],
+      "advanced": ["HTTP Request Smuggling", "Host Header Injection", "Server-Side Template Injection", "Server-Side Request Forgery", "Mass Assignment", "CSV Injection", "Prototype Pollution", "Insecure Deserialization", "SQL/LDAP/XPath/SSI/XML/Command/Code Injection", "HTTP Response Splitting"]
+    },
+    {
+      "wstg": "WSTG-ERRH",
+      "name": "Error Handling",
+      "phase": "analyze",
+      "skill": "web-hunting",
+      "tools": ["active_scan"],
+      "data": [],
+      "advanced": ["Improper Error Handling", "Stack Traces"]
+    },
+    {
+      "wstg": "WSTG-CRYP",
+      "name": "Cryptography",
+      "phase": "analyze",
+      "skill": "hp-tls-transport + ap-client-side-crypto-forgery",
+      "tools": ["active_scan"],
+      "data": [],
+      "advanced": ["Weak Transport Layer Security", "Padding Oracle", "Weak Cryptographic Primitives"]
+    },
+    {
+      "wstg": "WSTG-BUSL",
+      "name": "Business Logic",
+      "phase": "deep",
+      "skill": "hp-business-logic-fuzzing + complex_scan",
+      "tools": ["complex_scan", "route_scan"],
+      "data": ["chains", "chain_links"],
+      "advanced": ["Circumvention of Work Flows", "Process Timing (race conditions)", "Payment Functionality", "Number of Times a Function Can Be Used"]
+    },
+    {
+      "wstg": "WSTG-CLNT",
+      "name": "Client-side",
+      "phase": "deep",
+      "skill": "web-hunting + ap-stored-xss-admin-bot",
+      "tools": ["browser_validate", "active_scan"],
+      "data": ["payloads"],
+      "advanced": ["DOM-based XSS", "Cross-Origin Resource Sharing", "Clickjacking", "Browser Storage", "Reverse Tabnabbing", "Client-Side Template Injection", "Web Messaging"]
+    },
+    {
+      "wstg": "WSTG-APIT",
+      "name": "API Testing",
+      "phase": "analyze + deep",
+      "skill": "web-hunting + hp-api-security",
+      "tools": ["active_scan", "browser_validate"],
+      "data": [],
+      "advanced": ["Broken Object/Function Level Authorization", "Excessive Data Exposure", "GraphQL", "WebSockets"]
+    }
+  ]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.98",
+  "version": "1.0.99",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {

package/skills/bs-web-hunting.md

@@ -61,6 +61,10 @@ the ones basic scanners miss. Hunt those.
   `127.0.0.1.nip.io`, DNS rebinding, `http://127.0.0.1:80@evil/`, double-URL-encode.
 - Scheme tricks: `gopher://`, `dict://`, `file://`, `http://` to internal ports.
 - Redirect bypass: an allow-listed host that 302s to an internal address.
+- DNS-rebinding vs safe-url checks: a "safe" wrapper that resolves the hostname
+  once to validate and again to connect (e.g. `wp_safe_remote_*`) is rebinding-
+  bypassable — the name resolves to an allowed IP at check time and an internal
+  IP at request time.
 - The prize: cloud metadata (`169.254.169.254`), Redis/Postgres, internal admin.
   `ap-ssrf-cloud-metadata` skill has the metadata endpoints.