blitzstrike 1.1.1 → 1.1.2

package/CHANGELOG.md

@@ -5,6 +5,19 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.1.2] — 2026-09-13
+
+### Added — curated security resource index
+
+- New `resource_lookup` MCP tool + `intelligence/resources.json`: 30 curated
+  domain-specific security resources (from the community Awesome-Hacking
+  meta-list, filtered to web/pentest relevance) — each tagged with use_when
+  (which phase/context it serves). Search by category (web, pentest, bug_bounty,
+  api, recon, payload, cve, privesc, source, fuzzing, llm, framework, osint,
+  rev, cracking, forensics, malware, ir, intel, cicd, knowledge, labs) or
+  keyword. Lets the LLM find the best domain-specific tools/knowledge when
+  Blitz Strike's own data doesn't cover a domain.
+
 ## [1.1.1] — 2026-09-13
 
 ### Added — HackTricks full enrichment (52 classes + 16 frameworks)

package/dist/index.js

@@ -31795,6 +31795,22 @@ function frameworkTricks(framework) {
     return { found: true, ...f };
   return { found: false, framework, suggestions: data.frameworks.map((x) => String(x.framework)) };
 }
+function resourceLookup(category) {
+  const data = loadJson("resources");
+  if (!data)
+    return { found: false, error: "resources.json not found" };
+  if (!category) {
+    return {
+      found: true,
+      resources: data.resources.map((r) => ({ id: r.id, name: r.name, category: r.category, use_when: r.use_when }))
+    };
+  }
+  const q = category.toLowerCase();
+  const matches = data.resources.filter((r) => String(r.category).toLowerCase() === q || String(r.id).toLowerCase().includes(q) || String(r.name).toLowerCase().includes(q) || String(r.use_when).toLowerCase().includes(q));
+  if (matches.length > 0)
+    return { found: true, matches };
+  return { found: false, category, suggestions: [...new Set(data.resources.map((r) => String(r.category)))] };
+}
 
 // src/active.ts
 var TIMEOUT_MS2 = 20000;
@@ -54306,6 +54322,15 @@ ${statusLine}` : statusLine },
   }, async ({ framework }) => {
     return { content: [{ type: "text", text: JSON.stringify(frameworkTricks(framework)) }] };
   });
+  server.registerTool("resource_lookup", {
+    title: "Curated security resource index",
+    description: "INTEL: return curated domain-specific security resources (the community Awesome-Hacking index, filtered to web/pentest relevance) — each with name, URL, description, and use_when (which phase/context it serves). Search by category (web, pentest, bug_bounty, api, recon, payload, cve, privesc, source, fuzzing, llm, framework, osint, rev, cracking, forensics, malware, ir, intel, cicd, knowledge, labs) or keyword. Use to find the best domain-specific tools/knowledge when Blitz Strike's own data doesn't cover it.",
+    inputSchema: {
+      category: string2().optional().describe("Optional category id or keyword (e.g. 'web', 'payload', 'recon', 'privesc').")
+    }
+  }, async ({ category }) => {
+    return { content: [{ type: "text", text: JSON.stringify(resourceLookup(category)) }] };
+  });
   server.registerTool("engagement_start", {
     title: "Start an engagement",
     description: "ORCHESTRATION: open an engagement and track its state. Call at the start of a full audit so subsequent engagement_phase / engagement_track / engagement_status calls have a state to update. The LLM is the brain; this is the deterministic bookkeeping hand.",

package/intelligence/resources.json

@@ -0,0 +1,35 @@
+{
+  "_comment": "Curated security resource index (from the community 'Awesome Hacking' meta-list, filtered to what matters for web/pentest bug hunting). The LLM uses this to find the best domain-specific tools/knowledge. use_when maps each resource to a Blitz Strike phase/context.",
+  "resources": [
+    {"id": "web_hacking", "name": "awesome-web-hacking", "category": "web", "url": "https://github.com/infoslack/awesome-web-hacking", "desc": "Web application security tools and techniques.", "use_when": "live web app testing — the master web list"},
+    {"id": "web_security", "name": "awesome-web-security", "category": "web", "url": "https://github.com/qazbnm456/awesome-web-security", "desc": "Web security materials and resources.", "use_when": "web security research + writeups"},
+    {"id": "pentest", "name": "awesome-pentest", "category": "pentest", "url": "https://github.com/enaqx/awesome-pentest", "desc": "Penetration testing resources, tools, and references.", "use_when": "broad pentest tooling + methodology"},
+    {"id": "bug_bounty", "name": "awesome-bug-bounty", "category": "bug_bounty", "url": "https://github.com/djadmin/awesome-bug-bounty", "desc": "Bug bounty programs and hunter write-ups.", "use_when": "bug bounty target selection + report style"},
+    {"id": "bug_bounty_reference", "name": "bug-bounty-reference", "category": "bug_bounty", "url": "https://github.com/ngalongc/bug-bounty-reference", "desc": "Write-ups categorized by bug nature.", "use_when": "seeing how a bug class was exploited in the wild"},
+    {"id": "api_checklist", "name": "API-Security-Checklist", "category": "api", "url": "https://github.com/shieldfy/API-Security-Checklist", "desc": "API security countermeasures checklist.", "use_when": "API/GraphQL security testing"},
+    {"id": "asset_discovery", "name": "Awesome-Asset-Discovery", "category": "recon", "url": "https://github.com/redhuntlabs/Awesome-Asset-Discovery", "desc": "Asset discovery / attack-surface enumeration resources.", "use_when": "recon — mapping the full attack surface"},
+    {"id": "payloads_foospidy", "name": "payloads", "category": "payload", "url": "https://github.com/foospidy/payloads", "desc": "Web attack payloads collection.", "use_when": "crafting probes"},
+    {"id": "payloads_all_the_things", "name": "PayloadsAllTheThings", "category": "payload", "url": "https://github.com/swisskyrepo/PayloadsAllTheThings", "desc": "Payloads + bypass for web app pentest/CTF (already vendored as payloads/).", "use_when": "crafting probes"},
+    {"id": "seclists", "name": "SecLists", "category": "payload", "url": "https://github.com/danielmiessler/SecLists", "desc": "Wordlists + fuzz lists for security assessments.", "use_when": "fuzzing + brute-force lists"},
+    {"id": "cve_poc", "name": "trickest/cve", "category": "cve", "url": "https://github.com/trickest/cve", "desc": "CVE Proof-of-Concepts updated daily.", "use_when": "finding a PoC for a known CVE"},
+    {"id": "gtfobins", "name": "GTFOBins", "category": "privesc", "url": "https://gtfobins.github.io", "desc": "Unix binaries exploitable to bypass local restrictions.", "use_when": "Linux privilege escalation"},
+    {"id": "static_analysis", "name": "static-analysis", "category": "source", "url": "https://github.com/analysis-tools-dev/static-analysis", "desc": "Static analysis tools, linters, and checkers per language.", "use_when": "source-code audit tool selection"},
+    {"id": "fuzzing", "name": "Awesome-Fuzzing", "category": "fuzzing", "url": "https://github.com/secfigo/Awesome-Fuzzing", "desc": "Fuzzing resources + exploit-development learning.", "use_when": "input fuzzing / crash analysis"},
+    {"id": "prompt_injection", "name": "awesome-prompt-injection", "category": "llm", "url": "https://github.com/Joe-B-Security/awesome-prompt-injection", "desc": "Prompt-injection vulnerabilities targeting AI/LLM systems.", "use_when": "testing LLM/AI-integrated targets"},
+    {"id": "nodejs_security", "name": "awesome-nodejs-security", "category": "framework", "url": "https://github.com/lirantal/awesome-nodejs-security", "desc": "Node.js security tools + incidents.", "use_when": "Node/Express target"},
+    {"id": "php_security", "name": "awesome-php#security", "category": "framework", "url": "https://github.com/ziadoz/awesome-php#security", "desc": "PHP security libraries + scanners.", "use_when": "PHP target"},
+    {"id": "osint", "name": "awesome-osint", "category": "recon", "url": "https://github.com/jivoi/awesome-osint", "desc": "OSINT tools and resources.", "use_when": "OSINT / passive recon"},
+    {"id": "reversing", "name": "awesome-reversing", "category": "rev", "url": "https://github.com/HACKE-RC/awesome-reversing", "desc": "Reverse engineering learning resources.", "use_when": "binary RE"},
+    {"id": "password_cracking", "name": "awesome-password-cracking", "category": "cracking", "url": "https://github.com/n0kovo/awesome-password-cracking", "desc": "Password recovery tools + resources.", "use_when": "hash cracking"},
+    {"id": "forensics", "name": "awesome-forensics", "category": "forensics", "url": "https://github.com/Cugu/awesome-forensics", "desc": "Forensic analysis tools.", "use_when": "forensics / incident analysis"},
+    {"id": "malware_analysis", "name": "awesome-malware-analysis", "category": "malware", "url": "https://github.com/rshipp/awesome-malware-analysis", "desc": "Malware analysis tools.", "use_when": "malware triage (static + IOC)"},
+    {"id": "incident_response", "name": "awesome-incident-response", "category": "ir", "url": "https://github.com/meirwah/awesome-incident-response", "desc": "Incident response tools.", "use_when": "incident response"},
+    {"id": "threat_intel", "name": "awesome-threat-intelligence", "category": "intel", "url": "https://github.com/hslatman/awesome-threat-intelligence", "desc": "Threat intelligence resources.", "use_when": "attribution / threat research"},
+    {"id": "ci_cd_attacks", "name": "awesome-cicd-attacks", "category": "cicd", "url": "https://github.com/TupleType/awesome-cicd-attacks", "desc": "CI/CD pipeline offensive research.", "use_when": "CI/CD + deployment-process testing"},
+    {"id": "pentest_wiki", "name": "pentest-wiki", "category": "knowledge", "url": "https://github.com/nixawk/pentest-wiki", "desc": "Free online security knowledge library.", "use_when": "technique reference"},
+    {"id": "infosec_reference", "name": "Infosec_Reference", "category": "knowledge", "url": "https://github.com/rmusser01/Infosec_Reference", "desc": "Information security reference that doesn't suck.", "use_when": "broad infosec reference"},
+    {"id": "cheatsheets", "name": "OWASP CheatSheetSeries", "category": "knowledge", "url": "https://github.com/OWASP/CheatSheetSeries", "desc": "OWASP cheat sheets for app security.", "use_when": "defensive/context reference"},
+    {"id": "vulhub", "name": "vulhub", "category": "labs", "url": "https://github.com/vulhub/vulhub", "desc": "Pre-built vulnerable Docker environments.", "use_when": "spinning up a vulnerable lab to reproduce a bug"},
+    {"id": "ai_security", "name": "Awesome-AI-Security", "category": "llm", "url": "https://github.com/DeepSpaceHarbor/Awesome-AI-Security", "desc": "AI security resources.", "use_when": "AI/LLM system security"}
+  ]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.1.1",
+  "version": "1.1.2",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {

package/skills/bs-web-hunting.md

@@ -178,5 +178,6 @@ into the next follow-up.
 - **Framework-specific tricks** → `framework_tricks(laravel|django|...)` after
   `detect_framework` (signals + known vulns/CVEs + attack tricks).
 - **Need to run an external exploit tool** → `tool_lookup` → `ensure_tool` → `read_tool_manual`.
+- **Need domain-specific resources beyond Blitz's own data** → `resource_lookup(web|recon|payload|privesc|...)` for the curated index.
 - **Verification** → `verify-finding` skill. **Review** → `adversarial-review`.
 - **The full map** → `doctrine_map` (phase → skill → tools → data).