blitzstrike 1.1.1 → 1.1.4

package/CHANGELOG.md

@@ -5,6 +5,44 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.1.4] — 2026-09-13
+
+### Added — OWASP Web Top 10 + ASVS (complete taxonomy)
+
+- `taxonomy` tool now serves four standards: OWASP Top 10 2021 (web), OWASP API
+  Security Top 10 2023 (api), CWE mapping (cwe), and ASVS verification chapters
+  (asvs) — each mapped to Blitz Strike coverage.
+- New `intelligence/owasp_top10.json` (A01–A10) + `intelligence/asvs.json`
+  (V1–V14).
+- doctrine_map cross_cutting + RESOURCE MAP + `bs-web-hunting` now reach
+  `taxonomy` and `resource_lookup` for full no-babysitting interconnection.
+- THIRD-PARTY-NOTICES: OWASP Top 10 + ASVS (CC BY-SA 4.0).
+
+## [1.1.3] — 2026-09-13
+
+### Added — standard taxonomy (OWASP API Top 10 + CWE)
+
+- New `taxonomy` MCP tool + `intelligence/api_top10.json` + `cwe_map.json`:
+  - `taxonomy(api)` → OWASP API Security Top 10 (2023) risks mapped to Blitz
+    coverage (BOLA, broken auth, BOPLA, resource consumption, BFLA, business
+    flows, SSRF, misconfiguration, inventory, unsafe consumption).
+  - `taxonomy(cwe, query)` → CWE ID + name for any technique class (52 mapped),
+    for grounding findings in standard IDs during reporting.
+- THIRD-PARTY-NOTICES: OWASP API Security (CC BY-SA 4.0) + MITRE CWE.
+
+## [1.1.2] — 2026-09-13
+
+### Added — curated security resource index
+
+- New `resource_lookup` MCP tool + `intelligence/resources.json`: 30 curated
+  domain-specific security resources (from the community Awesome-Hacking
+  meta-list, filtered to web/pentest relevance) — each tagged with use_when
+  (which phase/context it serves). Search by category (web, pentest, bug_bounty,
+  api, recon, payload, cve, privesc, source, fuzzing, llm, framework, osint,
+  rev, cracking, forensics, malware, ir, intel, cicd, knowledge, labs) or
+  keyword. Lets the LLM find the best domain-specific tools/knowledge when
+  Blitz Strike's own data doesn't cover a domain.
+
 ## [1.1.1] — 2026-09-13
 
 ### Added — HackTricks full enrichment (52 classes + 16 frameworks)

package/THIRD-PARTY-NOTICES.md

@@ -56,6 +56,27 @@ satisfies the attribution requirements of those licenses.
   (category identifiers WSTG-INFO/CONF/IDNT/ATHN/ATHZ/SESS/INPV/ERRH/CRYP/
   BUSL/CLNT/APIT and their test names).
 
+## OWASP API Security Top 10
+
+- **Source:** https://github.com/OWASP/API-Security
+- **License:** CC BY-SA 4.0
+- **Used for:** the 2023 risk taxonomy in `intelligence/api_top10.json`
+  (API1–API10 identifiers and risk names).
+
+## OWASP Top 10 + ASVS
+
+- **Sources:** https://github.com/OWASP/Top10 · https://github.com/OWASP/ASVS
+- **License:** CC BY-SA 4.0
+- **Used for:** the 2021 web risk taxonomy in `intelligence/owasp_top10.json`
+  (A01–A10 identifiers) and the ASVS verification-area names in
+  `intelligence/asvs.json` (V1–V14).
+
+## MITRE CWE (Common Weakness Enumeration)
+
+- **Source:** https://cwe.mitre.org
+- **Used for:** standard weakness identifiers + names in `intelligence/cwe_map.json`
+  (CWE IDs are MITRE's taxonomy; the technique→CWE mapping is our own).
+
 ---
 
 All other code, chains, and data in this project are written by shinthink

package/dist/index.js

@@ -31795,6 +31795,77 @@ function frameworkTricks(framework) {
     return { found: true, ...f };
   return { found: false, framework, suggestions: data.frameworks.map((x) => String(x.framework)) };
 }
+function resourceLookup(category) {
+  const data = loadJson("resources");
+  if (!data)
+    return { found: false, error: "resources.json not found" };
+  if (!category) {
+    return {
+      found: true,
+      resources: data.resources.map((r) => ({ id: r.id, name: r.name, category: r.category, use_when: r.use_when }))
+    };
+  }
+  const q = category.toLowerCase();
+  const matches = data.resources.filter((r) => String(r.category).toLowerCase() === q || String(r.id).toLowerCase().includes(q) || String(r.name).toLowerCase().includes(q) || String(r.use_when).toLowerCase().includes(q));
+  if (matches.length > 0)
+    return { found: true, matches };
+  return { found: false, category, suggestions: [...new Set(data.resources.map((r) => String(r.category)))] };
+}
+function taxonomy(kind, query) {
+  if (kind === "api" || kind === "api_top10" || kind === "owasp-api") {
+    const data = loadJson("api_top10");
+    if (!data)
+      return { found: false, error: "api_top10.json not found" };
+    if (!query)
+      return { found: true, risks: data.risks };
+    const q = query.toLowerCase();
+    const r = data.risks.find((x) => String(x.id).toLowerCase() === q || String(x.name).toLowerCase().includes(q));
+    if (r)
+      return { found: true, ...r };
+    return { found: false, query, suggestions: data.risks.map((x) => String(x.id)) };
+  }
+  if (kind === "cwe" || kind === "weakness") {
+    const data = loadJson("cwe_map");
+    if (!data)
+      return { found: false, error: "cwe_map.json not found" };
+    if (!query)
+      return { found: true, mapping: data.mapping };
+    const q = query.toLowerCase();
+    const m = data.mapping.filter((x) => String(x.id).toLowerCase().includes(q) || String(x.cwe).toLowerCase() === q || String(x.name).toLowerCase().includes(q));
+    if (m.length > 0)
+      return { found: true, matches: m };
+    return { found: false, query, suggestions: data.mapping.map((x) => String(x.id)) };
+  }
+  if (kind === "web" || kind === "owasp" || kind === "top10" || kind === "web_top10") {
+    const data = loadJson("owasp_top10");
+    if (!data)
+      return { found: false, error: "owasp_top10.json not found" };
+    if (!query)
+      return { found: true, risks: data.risks };
+    const q = query.toLowerCase();
+    const r = data.risks.find((x) => String(x.id).toLowerCase() === q || String(x.name).toLowerCase().includes(q));
+    if (r)
+      return { found: true, ...r };
+    return { found: false, query, suggestions: data.risks.map((x) => String(x.id)) };
+  }
+  if (kind === "asvs" || kind === "verification") {
+    const data = loadJson("asvs");
+    if (!data)
+      return { found: false, error: "asvs.json not found" };
+    if (!query)
+      return { found: true, chapters: data.chapters };
+    const q = query.toLowerCase();
+    const c = data.chapters.find((x) => String(x.id).toLowerCase() === q || String(x.name).toLowerCase().includes(q));
+    if (c)
+      return { found: true, ...c };
+    return { found: false, query, suggestions: data.chapters.map((x) => String(x.id)) };
+  }
+  return {
+    found: false,
+    error: "unknown taxonomy kind",
+    usage: "taxonomy(kind='web'|'api'|'cwe'|'asvs', query?)"
+  };
+}
 
 // src/active.ts
 var TIMEOUT_MS2 = 20000;
@@ -53741,7 +53812,7 @@ function createServer() {
     name: "blitzstrike",
     version: "1.0.0"
   }, {
-    instructions: "Blitz Strike is a universal penetration-testing toolbelt with three tiers — " + "BLITZ (reconnaissance / attack-surface mapping), EAGLE-EYE (source-to-sink " + "analysis), STRIKE (live validation) — plus a canonical evidence-first finding " + "engine and a multi-language taint engine.\\n\\n" + "CORE MENTAL MODEL:\\n" + "- A scanner hit is a HYPOTHESIS, not a finding. Live verification (or data-flow " + "  proof) is the verdict. Never report an unverified hit as a vulnerability.\\n" + "- Distinguish REACHABLE from mere PRESENT: a sink is only a finding when tainted " + "  input reaches it AND it is not neutralized by a sanitizer and not guarded by an " + "  auth gate.\\n\\n" + "HOW TO RUN AN AUDIT (start here):\\n" + "0. ROUTE BY TARGET. Classify automatically - no need to ask. A URL - with or " + "   without http/https - is LIVE (live_recon + the " + "   web-hunting doctrine + strike_verify). A filesystem path (exists on disk, " + "   or a code extension) is SOURCE audit (source-audit doctrine: blitz_scan + " + "   eagle_eye2 + complex_scan/route_scan). TWO DOCTRINES - never mix: live " + "   web/API -> web-hunting skill; source tree -> source-audit skill.\\n" + "1. RECORD SCOPE. scope_check classifies the target (intel for the report) - " + "   it does NOT gate the engagement. No authorization gate: the repo disclaimer " + "   places responsibility on the user. Hunt the target you are given.\\n" + "2. MAP THE SURFACE (BLITZ). For a source tree use blitz_scan (tree) or blitz_file " + "   (single file) then enrich_scan to match sinks to escalation chains. For a live " + "   URL use live_recon for a full pass (fingerprint/WAF/tech/version/crawler/params/" + "   subdomains/API endpoints/intel correlation) — it returns next_steps. active_scan " + "   is the lighter alternative. Both record scope internally.\\n" + "3. TRACE REACHABILITY (EAGLE-EYE). For every sink, determine whether attacker " + "   input actually reaches it:\\n" + "   - PHP/JS/TS/Python/Java source: taint_file (auto-detects language) or " + "     taint_scan/taint_tree (PHP AST). list_languages shows what's supported.\\n" + "   - Any language: trace_data_flow (window heuristic) and eagle_eye/eagle_grep " + "     (function-scoped view of sinks + auth gates). Beyond taint: route_scan (route confusion / dispatch abuse / batch forwarding) and complex_scan (deserialization->POP, type juggling, mass assignment, prototype pollution, CRLF/header injection, path confusion) catch classes plain taint misses.\\n" + "   A sink counts only if tainted input reaches it unsanitized and unguarded.\\n" + "4. VALIDATE (STRIKE). Confirm live with strike_verify using a MARKER plus a " + "   NEGATIVE CONTROL plus a BASELINE. The verdict is deterministic: marker " + "   reflected AND control inert = confirmed; both reflected = false_positive; " + "   marker not reflected = unconfirmed. Feed the verdict to strike_resolve to " + "   advance the finding lifecycle (hypothesis->validating->confirmed). Use " + "   read_tool_manual for the exploit tool's manual, payload_lookup for payloads, " + "   detect_waf/tech_correlation for context.\\n" + "5. RECORD + REPORT. Create a canonical finding with finding_create, advance it " + "   through the lifecycle with finding_transition, attach confidence_score, and " + "   redact any secrets before persisting. Only report findings that survived " + "   verification.\\n\\n" + "SUPPORTING LAYERS:\\n" + "- run_engagement: ONE call does the whole audit (no babysitting). Source path -> " + "  full static pipeline + inline report (markdown/JSON/SARIF). URL target -> " + "  autonomous live marker sweep + confirmed findings + report. Prefer this first.\\n" + "- list_chains: 57 escalation chains (source -> sink -> impact).\\n" + "- list_languages / taint_file: multi-language taint (PHP, JS/TS, Python, Java).\\n" + "- tool_lookup / ensure_tool / list_tools: 130-tool catalog, auto-install.\\n" + "- read_playbook / list_playbooks: 17 engagement playbooks (web-app, api-security, " + "  source-code-audit, active-directory, mobile, external-attack-surface, ...).\\n" + "- skill_lookup / read_skill / list_skills: 39 skills (7 bs-* agent doctrine: " + "  orchestrate, scope, source-audit, web-hunting, verify, review, report; + " + "  technique playbooks: WP/PHP 0-day, AD, malware, mobile, cloud).\\n" + "- read_tool_manual / list_manuals: 317 tool manuals (sqlmap, nmap, commix, ...).\\n" + "- payload_lookup / read_payload: 66 payload collections (sqli, xss, ssti, xxe, lfi).\\n" + "- detect_waf / tech_correlation / cve_correlation / port_correlation: signature " + "  + correlation intelligence.\\n" + "- nvd_lookup / fofa_search: CVE lookup + asset reconnaissance (FOFA needs env creds).\\n" + "- remember / memory_lookup / memory_list: persist + recall verified knowledge.\\n\\n" + "RESOURCE MAP (know what to reach for):\\n" + "- ORCHESTRATION = the engagement framework. orchestration() returns the " + "  lifecycle (scope->recon->analyze->deep->verify->report, each with " + "  entry/exit criteria) + sub-agent team + handoff contract + termination " + "  criteria. Load it at engagement start.\\n" + "- TOOL = acts (scan, taint, verify, record, correlate). Call it to DO something.\\n" + "- PLAYBOOK = campaign plan for a target TYPE. read_playbook(web-application) " + "  BEFORE a full engagement of that type.\\n" + "- SKILL = procedure doctrine. Load the bs-* skill for the phase you are on " + "  (orchestrate, scope, web-hunting for LIVE, source-audit for SOURCE, verify, " + "  review, report); load a technique skill for the specific technique.\\n" + "- MANUAL = deep reference for ONE tool. read_tool_manual right before using it.\\n" + "- CATALOG = external tools (130: sqlmap, nmap, nuclei, ffuf, ysoserial, ...). " + "  Blitz Strike's OWN tools find + verify; the catalog is for deeper EXTERNAL " + "  exploitation/enumeration. After your own analysis confirms a finding, run " + "  tool_lookup -> ensure_tool (auto-install) -> read_tool_manual to drive the " + "  external tool that demonstrates impact.\\n" + "- PAYLOAD = attack payloads for a class. payload_lookup before crafting a probe.\\n" + "- INTELLIGENCE = knowledge. list_attack_vectors (34 categories) maps the " + "  full surface during RECON; list_chains (57) turns a finding into impact; " + "  chain_links composes chains for complex bugs; bypass_lookup when blocked; " + "  payload_lookup when crafting a probe. technique_lookup(cls) returns the " + "  DETAILED methodology + tricks for a vulnerability class (ssrf, ssti, " + "  jwt, deserialization, ...) - load before testing a class. wstg_map maps " + "  an OWASP category to coverage; doctrine_map shows how everything links.\\n\\n" + "NO-BABYSITTING (while scanning + testing):\\n" + "- Scan the WHOLE surface before reporting - every file, entry point, and sink. " + "  Do not stop after the first hit to ask; keep enumerating the full tree.\\n" + "- Test every hypothesis through its full verification cycle - vary probes on " + "  failure, apply bypasses when blocked, keep going. Do not pause to ask.\\n" + "- Persist through partial results: a scan that surfaces few sinks is NOT done - " + "  widen the surface, escalate detectors, dig into each reachable sink.\\n" + "- Only surface to the user when: the target is genuinely ambiguous, a " + "  destructive or DoS action needs explicit consent, or the engagement is complete.\\n\\n" + "PERSISTENCE (complex bugs - do not give up):\\n" + "- On any failure (empty output, blocked probe, failed sub-agent/model), call " + "  retry_guidance(signal) for concrete recovery actions before giving up.\\n" + "- On a model/sub-agent error (rate-limit, quota, timeout, 5xx, auth, " + "  unavailable), model_fallback(signal) classifies it and returns the exact " + "  recovery (retry+backoff / fall back / shrink scope / fix credentials / " + "  abort). Do not fall back blindly - the class decides.\\n" + "- One failed probe != not vulnerable. Vary: alternative sinks, other params, " + "  encoding/case/whitespace bypasses, different injection context.\\n" + "- Empty output != no findings. Re-run (server may be stale after an upgrade - " + "  /reload-mcp), or escalate to route_scan / complex_scan for classes taint " + "  misses (POP chains, type juggling, mass assignment, route confusion).\\n" + "- A 'sanitized' sink may not be safe. Challenge the sanitizer: loose == vs ===, " + "  missing EXTR_SKIP, int cast truncation, weak regex.\\n" + "- An unconfirmed hypothesis is KEPT as hypothesis - try alternate verification, " + "  then let adversarial review decide.\\n" + "- Complex chains (deserialization->POP, LFI->RCE) need the FULL chain traced, " + `  not just the first sink.\\n
+    instructions: "Blitz Strike is a universal penetration-testing toolbelt with three tiers — " + "BLITZ (reconnaissance / attack-surface mapping), EAGLE-EYE (source-to-sink " + "analysis), STRIKE (live validation) — plus a canonical evidence-first finding " + "engine and a multi-language taint engine.\\n\\n" + "CORE MENTAL MODEL:\\n" + "- A scanner hit is a HYPOTHESIS, not a finding. Live verification (or data-flow " + "  proof) is the verdict. Never report an unverified hit as a vulnerability.\\n" + "- Distinguish REACHABLE from mere PRESENT: a sink is only a finding when tainted " + "  input reaches it AND it is not neutralized by a sanitizer and not guarded by an " + "  auth gate.\\n\\n" + "HOW TO RUN AN AUDIT (start here):\\n" + "0. ROUTE BY TARGET. Classify automatically - no need to ask. A URL - with or " + "   without http/https - is LIVE (live_recon + the " + "   web-hunting doctrine + strike_verify). A filesystem path (exists on disk, " + "   or a code extension) is SOURCE audit (source-audit doctrine: blitz_scan + " + "   eagle_eye2 + complex_scan/route_scan). TWO DOCTRINES - never mix: live " + "   web/API -> web-hunting skill; source tree -> source-audit skill.\\n" + "1. RECORD SCOPE. scope_check classifies the target (intel for the report) - " + "   it does NOT gate the engagement. No authorization gate: the repo disclaimer " + "   places responsibility on the user. Hunt the target you are given.\\n" + "2. MAP THE SURFACE (BLITZ). For a source tree use blitz_scan (tree) or blitz_file " + "   (single file) then enrich_scan to match sinks to escalation chains. For a live " + "   URL use live_recon for a full pass (fingerprint/WAF/tech/version/crawler/params/" + "   subdomains/API endpoints/intel correlation) — it returns next_steps. active_scan " + "   is the lighter alternative. Both record scope internally.\\n" + "3. TRACE REACHABILITY (EAGLE-EYE). For every sink, determine whether attacker " + "   input actually reaches it:\\n" + "   - PHP/JS/TS/Python/Java source: taint_file (auto-detects language) or " + "     taint_scan/taint_tree (PHP AST). list_languages shows what's supported.\\n" + "   - Any language: trace_data_flow (window heuristic) and eagle_eye/eagle_grep " + "     (function-scoped view of sinks + auth gates). Beyond taint: route_scan (route confusion / dispatch abuse / batch forwarding) and complex_scan (deserialization->POP, type juggling, mass assignment, prototype pollution, CRLF/header injection, path confusion) catch classes plain taint misses.\\n" + "   A sink counts only if tainted input reaches it unsanitized and unguarded.\\n" + "4. VALIDATE (STRIKE). Confirm live with strike_verify using a MARKER plus a " + "   NEGATIVE CONTROL plus a BASELINE. The verdict is deterministic: marker " + "   reflected AND control inert = confirmed; both reflected = false_positive; " + "   marker not reflected = unconfirmed. Feed the verdict to strike_resolve to " + "   advance the finding lifecycle (hypothesis->validating->confirmed). Use " + "   read_tool_manual for the exploit tool's manual, payload_lookup for payloads, " + "   detect_waf/tech_correlation for context.\\n" + "5. RECORD + REPORT. Create a canonical finding with finding_create, advance it " + "   through the lifecycle with finding_transition, attach confidence_score, and " + "   redact any secrets before persisting. Only report findings that survived " + "   verification.\\n\\n" + "SUPPORTING LAYERS:\\n" + "- run_engagement: ONE call does the whole audit (no babysitting). Source path -> " + "  full static pipeline + inline report (markdown/JSON/SARIF). URL target -> " + "  autonomous live marker sweep + confirmed findings + report. Prefer this first.\\n" + "- list_chains: 57 escalation chains (source -> sink -> impact).\\n" + "- list_languages / taint_file: multi-language taint (PHP, JS/TS, Python, Java).\\n" + "- tool_lookup / ensure_tool / list_tools: 130-tool catalog, auto-install.\\n" + "- read_playbook / list_playbooks: 17 engagement playbooks (web-app, api-security, " + "  source-code-audit, active-directory, mobile, external-attack-surface, ...).\\n" + "- skill_lookup / read_skill / list_skills: 39 skills (7 bs-* agent doctrine: " + "  orchestrate, scope, source-audit, web-hunting, verify, review, report; + " + "  technique playbooks: WP/PHP 0-day, AD, malware, mobile, cloud).\\n" + "- read_tool_manual / list_manuals: 317 tool manuals (sqlmap, nmap, commix, ...).\\n" + "- payload_lookup / read_payload: 66 payload collections (sqli, xss, ssti, xxe, lfi).\\n" + "- detect_waf / tech_correlation / cve_correlation / port_correlation: signature " + "  + correlation intelligence.\\n" + "- nvd_lookup / fofa_search: CVE lookup + asset reconnaissance (FOFA needs env creds).\\n" + "- remember / memory_lookup / memory_list: persist + recall verified knowledge.\\n\\n" + "RESOURCE MAP (know what to reach for):\\n" + "- ORCHESTRATION = the engagement framework. orchestration() returns the " + "  lifecycle (scope->recon->analyze->deep->verify->report, each with " + "  entry/exit criteria) + sub-agent team + handoff contract + termination " + "  criteria. Load it at engagement start.\\n" + "- TOOL = acts (scan, taint, verify, record, correlate). Call it to DO something.\\n" + "- PLAYBOOK = campaign plan for a target TYPE. read_playbook(web-application) " + "  BEFORE a full engagement of that type.\\n" + "- SKILL = procedure doctrine. Load the bs-* skill for the phase you are on " + "  (orchestrate, scope, web-hunting for LIVE, source-audit for SOURCE, verify, " + "  review, report); load a technique skill for the specific technique.\\n" + "- MANUAL = deep reference for ONE tool. read_tool_manual right before using it.\\n" + "- CATALOG = external tools (130: sqlmap, nmap, nuclei, ffuf, ysoserial, ...). " + "  Blitz Strike's OWN tools find + verify; the catalog is for deeper EXTERNAL " + "  exploitation/enumeration. After your own analysis confirms a finding, run " + "  tool_lookup -> ensure_tool (auto-install) -> read_tool_manual to drive the " + "  external tool that demonstrates impact.\\n" + "- PAYLOAD = attack payloads for a class. payload_lookup before crafting a probe.\\n" + "- INTELLIGENCE = knowledge. list_attack_vectors (34 categories) maps the " + "  full surface during RECON; list_chains (57) turns a finding into impact; " + "  chain_links composes chains for complex bugs; bypass_lookup when blocked; " + "  payload_lookup when crafting a probe. technique_lookup(cls) returns the " + "  DETAILED methodology + tricks for a vulnerability class (ssrf, ssti, " + "  jwt, deserialization, ...) - load before testing a class. wstg_map maps " + "  an OWASP category to coverage; taxonomy maps findings to standard IDs " + "  (OWASP Top 10 / API Top 10 / CWE / ASVS); doctrine_map shows how everything links.\\n\\n" + "NO-BABYSITTING (while scanning + testing):\\n" + "- Scan the WHOLE surface before reporting - every file, entry point, and sink. " + "  Do not stop after the first hit to ask; keep enumerating the full tree.\\n" + "- Test every hypothesis through its full verification cycle - vary probes on " + "  failure, apply bypasses when blocked, keep going. Do not pause to ask.\\n" + "- Persist through partial results: a scan that surfaces few sinks is NOT done - " + "  widen the surface, escalate detectors, dig into each reachable sink.\\n" + "- Only surface to the user when: the target is genuinely ambiguous, a " + "  destructive or DoS action needs explicit consent, or the engagement is complete.\\n\\n" + "PERSISTENCE (complex bugs - do not give up):\\n" + "- On any failure (empty output, blocked probe, failed sub-agent/model), call " + "  retry_guidance(signal) for concrete recovery actions before giving up.\\n" + "- On a model/sub-agent error (rate-limit, quota, timeout, 5xx, auth, " + "  unavailable), model_fallback(signal) classifies it and returns the exact " + "  recovery (retry+backoff / fall back / shrink scope / fix credentials / " + "  abort). Do not fall back blindly - the class decides.\\n" + "- One failed probe != not vulnerable. Vary: alternative sinks, other params, " + "  encoding/case/whitespace bypasses, different injection context.\\n" + "- Empty output != no findings. Re-run (server may be stale after an upgrade - " + "  /reload-mcp), or escalate to route_scan / complex_scan for classes taint " + "  misses (POP chains, type juggling, mass assignment, route confusion).\\n" + "- A 'sanitized' sink may not be safe. Challenge the sanitizer: loose == vs ===, " + "  missing EXTR_SKIP, int cast truncation, weak regex.\\n" + "- An unconfirmed hypothesis is KEPT as hypothesis - try alternate verification, " + "  then let adversarial review decide.\\n" + "- Complex chains (deserialization->POP, LFI->RCE) need the FULL chain traced, " + `  not just the first sink.\\n
 ` + "- When a probe is BLOCKED by a WAF/filter/sanitizer, call bypass_lookup(defense) " + "  for concrete techniques (encoding, case, comment insertion, chunked, null byte, " + "  double-encoding, verb tampering, header spoofing) and apply them - do not give up.\\n" + "- CHAIN findings: a low-severity finding may escalate — do not assume it is the " + "  end of the story. list_chains / chain_links show whether it composes into a " + "  multi-stage chain (e.g. SSRF->metadata, SQLi->RCE, LFI->RCE, upload->shell). " + "  Check before concluding, and do not overclaim an escalation that is not there.\\n\\n" + "- Complex bugs chain ACROSS chains: after confirming one chain, chain_links " + "  shows what follows (SSRF->metadata then default-creds->pivot via stolen IAM). " + "  Trace the full composition, not just a single chain.\\n\\n" + "HYPOTHESIS EXPANSION (from each finding, enumerate + verify every follow-up):\\n" + "- A confirmed finding is the START, not the end. From each one, enumerate " + "  the follow-ups: ESCALATE (list_chains + chain_links), CHAIN (chain_links " + "  from->to), BYPASS (bypass_lookup), PIVOT (new endpoints/sinks now reachable).\\n" + "- Every follow-up (this might happen, this could chain, maybe bypassable) is " + "  a HYPOTHESIS, not a finding. Verify EACH via strike_verify (marker + negative " + "  control) before it enters the report.\\n" + "- Never report speculation: might / could / possibly live in the " + "  hypothesis list, never in the report. Every report line is a verified fact.\\n\\n" + "PROFESSIONAL JUDGMENT (act like a senior tester, not a checklist runner):\\n" + "- PRIORITIZE by severity, computed deterministically with cvss_score (impact x " + "  exploitability) and weighted by escalation potential (chain_links). Do NOT rank " + "  by bug class - a critical stored XSS that yields account takeover outranks an " + "  unreachable blind RCE. Weight by the engagement context (which asset/data is " + "  most sensitive for THIS target).\\n" + "- Recognize dead ends: if a branch yields nothing after a few varied probes, " + "  note it and move on. Do not tunnel-vision one sink at the expense of the rest.\\n" + "- Live-test with care: respect rate limits, do not lock accounts, do not " + "  trigger DoS. Test non-destructively and prove impact with the smallest payload.\\n" + "- Know when done: stop when the termination criteria are met, not when you feel " + "  tired. A thorough audit over a rushed one, every time.\\n\\n" + "IRON RULES:\\n" + "- No authorization gate - the repo disclaimer places responsibility on the " + "  user. Hunt the target you are given (like nmap/sqlmap/Burp, which do not " + "  ask). The one hard stop: malicious/third-party infra (cari pelaku) - hold/static.\\n" + "  need finer control."
   });
   server.registerTool("blitz_scan", {
@@ -54306,6 +54377,25 @@ ${statusLine}` : statusLine },
   }, async ({ framework }) => {
     return { content: [{ type: "text", text: JSON.stringify(frameworkTricks(framework)) }] };
   });
+  server.registerTool("resource_lookup", {
+    title: "Curated security resource index",
+    description: "INTEL: return curated domain-specific security resources (the community Awesome-Hacking index, filtered to web/pentest relevance) — each with name, URL, description, and use_when (which phase/context it serves). Search by category (web, pentest, bug_bounty, api, recon, payload, cve, privesc, source, fuzzing, llm, framework, osint, rev, cracking, forensics, malware, ir, intel, cicd, knowledge, labs) or keyword. Use to find the best domain-specific tools/knowledge when Blitz Strike's own data doesn't cover it.",
+    inputSchema: {
+      category: string2().optional().describe("Optional category id or keyword (e.g. 'web', 'payload', 'recon', 'privesc').")
+    }
+  }, async ({ category }) => {
+    return { content: [{ type: "text", text: JSON.stringify(resourceLookup(category)) }] };
+  });
+  server.registerTool("taxonomy", {
+    title: "OWASP Top 10 / API Top 10 / CWE / ASVS taxonomy",
+    description: "INTEL: return standard taxonomy for grounding + professional reporting. taxonomy(web) = OWASP Top 10 (2021); taxonomy(api) = OWASP API Security Top 10 (2023); taxonomy(cwe, query) = CWE ID for a technique class; taxonomy(asvs) = ASVS verification chapters. Each maps to Blitz Strike coverage. Use to map findings to standard IDs (A01, API1, CWE-79, V4, ...).",
+    inputSchema: {
+      kind: string2().optional().describe("'web' (OWASP Top 10), 'api' (API Top 10), 'cwe' (CWE mapping), or 'asvs' (ASVS chapters)."),
+      query: string2().optional().describe("Optional query: a technique class id (for cwe) or a risk/chapter id (for web/api/asvs).")
+    }
+  }, async ({ kind, query }) => {
+    return { content: [{ type: "text", text: JSON.stringify(taxonomy(kind, query)) }] };
+  });
   server.registerTool("engagement_start", {
     title: "Start an engagement",
     description: "ORCHESTRATION: open an engagement and track its state. Call at the start of a full audit so subsequent engagement_phase / engagement_track / engagement_status calls have a state to update. The LLM is the brain; this is the deterministic bookkeeping hand.",

package/intelligence/api_top10.json

@@ -0,0 +1,15 @@
+{
+  "_comment": "OWASP API Security Top 10 (2023) mapped to Blitz Strike coverage. Each risk has its id, name, and the Blitz technique/tool that hunts it.",
+  "risks": [
+    {"id": "API1", "name": "Broken Object Level Authorization (BOLA)", "cwe": ["CWE-639"], "desc": "Accessing another user's object by tampering the object id without an authorization check.", "blitz": "technique_lookup(idor) + active_scan", "data": []},
+    {"id": "API2", "name": "Broken Authentication", "cwe": ["CWE-287", "CWE-384"], "desc": "Weak or bypassable authentication (JWT, OAuth, token, credential flaws).", "blitz": "technique_lookup(jwt) + technique_lookup(oauth) + bypass_lookup(auth)", "data": []},
+    {"id": "API3", "name": "Broken Object Property Level Authorization (BOPLA)", "cwe": ["CWE-915", "CWE-639"], "desc": "Mass assignment / excessive data exposure of object properties.", "blitz": "technique_lookup(mass_assignment) + complex_scan", "data": []},
+    {"id": "API4", "name": "Unrestricted Resource Consumption", "cwe": ["CWE-400", "CWE-770"], "desc": "DoS via missing rate limits, deep recursion, or resource exhaustion.", "blitz": "technique_lookup(rate_limit_bypass) + technique_lookup(race_condition)", "data": []},
+    {"id": "API5", "name": "Broken Function Level Authorization (BFLA)", "cwe": ["CWE-862", "CWE-285"], "desc": "Invoking admin-only functions without the right role.", "blitz": "technique_lookup(idor) + route_scan", "data": []},
+    {"id": "API6", "name": "Unrestricted Access to Sensitive Business Flows", "cwe": ["CWE-841"], "desc": "Abusing a legitimate business flow (purchase, redeem) without authorization.", "blitz": "technique_lookup(bypass_payment) + hp-business-logic-fuzzing", "data": []},
+    {"id": "API7", "name": "Server Side Request Forgery", "cwe": ["CWE-918"], "desc": "The API fetches an attacker-influenced URL to reach internal services.", "blitz": "technique_lookup(ssrf) + ap-ssrf-cloud-metadata", "data": ["chains"]},
+    {"id": "API8", "name": "Security Misconfiguration", "cwe": ["CWE-16"], "desc": "Verbose errors, exposed debug/admin endpoints, missing headers, CORS misconfig.", "blitz": "technique_lookup(cors) + live_recon + web-hunting (exposed config)", "data": []},
+    {"id": "API9", "name": "Improper Inventory Management", "cwe": ["CWE-1057"], "desc": "Orphaned/legacy API versions or endpoints left undocumented and unprotected.", "blitz": "live_recon (versioned APIs) + web-hunting (recon)", "data": []},
+    {"id": "API10", "name": "Unsafe Consumption of APIs", "cwe": ["CWE-20", "CWE-502"], "desc": "Trusting third-party API responses that are then processed unsafely.", "blitz": "technique_lookup(deserialization) + technique_lookup(command_injection)", "data": []}
+  ]
+}

package/intelligence/asvs.json

@@ -0,0 +1,19 @@
+{
+  "_comment": "OWASP ASVS (Application Security Verification Standard) — the 14 verification areas, condensed. Each maps to what Blitz Strike verifies for it.",
+  "chapters": [
+    {"id": "V1", "name": "Architecture, Design and Threat Modeling", "focus": "Design + threat model", "blitz": "blitz_scan (attack surface) + list_attack_vectors"},
+    {"id": "V2", "name": "Authentication", "focus": "Password, MFA, credential, OAuth/JWT", "blitz": "technique_lookup(jwt|oauth|two_fa_bypass|account_takeover)"},
+    {"id": "V3", "name": "Session Management", "focus": "Session tokens, cookies, logout, fixation", "blitz": "technique_lookup(cookie_hacking) + hp-auth-session"},
+    {"id": "V4", "name": "Access Control", "focus": "IDOR, forced browsing, privilege escalation", "blitz": "technique_lookup(idor) + route_scan + technique_lookup(mass_assignment)"},
+    {"id": "V5", "name": "Validation, Sanitization and Encoding", "focus": "Injection + XSS + encoding", "blitz": "source-audit (taint) + technique_lookup(sql_injection|xss|command_injection|ssti)"},
+    {"id": "V6", "name": "Stored Cryptography", "focus": "Password storage, key management", "blitz": "hp-tls-transport + ap-client-side-crypto-forgery"},
+    {"id": "V7", "name": "Error Handling and Logging", "focus": "Verbose errors, stack traces", "blitz": "web-hunting (info leak) + technique_lookup(ssi_injection)"},
+    {"id": "V8", "name": "Data Protection", "focus": "PII exposure, cache, client-side storage", "blitz": "technique_lookup(xssi) + technique_lookup(cache_poisoning) + hp-secrets-scan"},
+    {"id": "V9", "name": "Communications", "focus": "TLS, HSTS, downgrade", "blitz": "hp-tls-transport"},
+    {"id": "V10", "name": "Malicious Code", "focus": "CI/CD, dependency integrity", "blitz": "hp-dependency-audit + ap-gitea-ci-injection"},
+    {"id": "V11", "name": "Business Logic", "focus": "Workflow abuse, limits, races", "blitz": "hp-business-logic-fuzzing + technique_lookup(race_condition|bypass_payment)"},
+    {"id": "V12", "name": "Files and Resources", "focus": "Upload, path traversal, LFI", "blitz": "technique_lookup(file_upload|path_traversal_lfi) + complex_scan"},
+    {"id": "V13", "name": "API and Web Service", "focus": "REST/GraphQL/WebSocket security", "blitz": "technique_lookup(graphql|websocket) + taxonomy(api) + hp-api-security"},
+    {"id": "V14", "name": "Configuration", "focus": "Headers, CORS, CSP, cloud", "blitz": "technique_lookup(cors) + web-hunting (config) + hp-iac-cloud-posture"}
+  ]
+}

package/intelligence/cwe_map.json

@@ -0,0 +1,56 @@
+{
+  "_comment": "Technique class -> CWE mapping (standard weakness IDs, for grounding + professional reporting). Each entry maps a techniques.json class id to its CWE ID(s) and name.",
+  "mapping": [
+    {"id": "ssrf", "cwe": "CWE-918", "name": "Server-Side Request Forgery (SSRF)"},
+    {"id": "request_smuggling", "cwe": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (Request Smuggling)"},
+    {"id": "cache_poisoning", "cwe": "CWE-524", "name": "Use of Cache Containing Sensitive Information"},
+    {"id": "race_condition", "cwe": "CWE-362", "name": "Concurrent Execution using Shared Resource (TOCTOU)"},
+    {"id": "ssti", "cwe": "CWE-1336", "name": "Improper Neutralization of Special Elements Used in a Template Engine (SSTI)"},
+    {"id": "deserialization", "cwe": "CWE-502", "name": "Deserialization of Untrusted Data"},
+    {"id": "prototype_pollution", "cwe": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution)"},
+    {"id": "mass_assignment", "cwe": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"},
+    {"id": "sql_injection", "cwe": "CWE-89", "name": "SQL Injection"},
+    {"id": "nosql_injection", "cwe": "CWE-943", "name": "Improper Neutralization of Special Elements in Data Query Logic (NoSQL Injection)"},
+    {"id": "xss", "cwe": "CWE-79", "name": "Cross-site Scripting"},
+    {"id": "cors", "cwe": "CWE-942", "name": "Permissive Cross-domain Policy with Untrusted Domains (CORS)"},
+    {"id": "csrf", "cwe": "CWE-352", "name": "Cross-Site Request Forgery"},
+    {"id": "jwt", "cwe": "CWE-347", "name": "Improper Verification of Cryptographic Signature"},
+    {"id": "oauth", "cwe": "CWE-287", "name": "Improper Authentication"},
+    {"id": "host_header", "cwe": "CWE-644", "name": "Improper Neutralization of HTTP Headers for Scripting Syntax (Host Header)"},
+    {"id": "open_redirect", "cwe": "CWE-601", "name": "URL Redirection to Untrusted Site (Open Redirect)"},
+    {"id": "subdomain_takeover", "cwe": "CWE-350", "name": "Reliance on Reverse DNS Resolution for a Security-Critical Action"},
+    {"id": "idor", "cwe": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key (IDOR/BOLA)"},
+    {"id": "graphql", "cwe": "CWE-862", "name": "Missing Authorization"},
+    {"id": "websocket", "cwe": "CWE-345", "name": "Insufficient Verification of Data Authenticity (WebSocket Hijacking)"},
+    {"id": "file_upload", "cwe": "CWE-434", "name": "Unrestricted Upload of File with Dangerous Type"},
+    {"id": "path_traversal_lfi", "cwe": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)"},
+    {"id": "command_injection", "cwe": "CWE-78", "name": "OS Command Injection"},
+    {"id": "xxe", "cwe": "CWE-611", "name": "Improper Restriction of XML External Entity Reference (XXE)"},
+    {"id": "crlf_injection", "cwe": "CWE-93", "name": "Improper Neutralization of CRLF Sequences (CRLF Injection)"},
+    {"id": "ldap_injection", "cwe": "CWE-90", "name": "Improper Neutralization of Special Elements in LDAP Queries"},
+    {"id": "xpath_injection", "cwe": "CWE-643", "name": "Improper Neutralization of Data within XPath Expressions"},
+    {"id": "xslt_injection", "cwe": "CWE-91", "name": "XML Injection (XSLT)"},
+    {"id": "ssi_injection", "cwe": "CWE-97", "name": "Improper Neutralization of Server-Side Includes (SSI)"},
+    {"id": "xssi", "cwe": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor (XSSI)"},
+    {"id": "email_injection", "cwe": "CWE-74", "name": "Improper Neutralization of Special Elements in Output (Email Header Injection)"},
+    {"id": "formula_csv_injection", "cwe": "CWE-1236", "name": "Improper Neutralization of Formula Elements in a CSV File"},
+    {"id": "orm_injection", "cwe": "CWE-89", "name": "SQL Injection (via ORM)"},
+    {"id": "rsql_injection", "cwe": "CWE-89", "name": "SQL Injection (RSQL/FIQL)"},
+    {"id": "unicode_injection", "cwe": "CWE-180", "name": "Incorrect Behavior Order: Validate Before Canonicalize"},
+    {"id": "dangling_markup", "cwe": "CWE-79", "name": "Cross-site Scripting (Dangling Markup)"},
+    {"id": "account_takeover", "cwe": "CWE-287", "name": "Improper Authentication (Account Takeover)"},
+    {"id": "two_fa_bypass", "cwe": "CWE-308", "name": "Use of Single-factor Authentication"},
+    {"id": "rate_limit_bypass", "cwe": "CWE-799", "name": "Improper Control of Interaction Frequency (Rate Limit)"},
+    {"id": "password_reset_bypass", "cwe": "CWE-640", "name": "Weak Password Recovery Mechanism for Forgotten Password"},
+    {"id": "captcha_bypass", "cwe": "CWE-804", "name": "Guessable CAPTCHA"},
+    {"id": "registration_vulnerabilities", "cwe": "CWE-799", "name": "Improper Control of Interaction Frequency"},
+    {"id": "payment_bypass", "cwe": "CWE-841", "name": "Improper Enforcement of Behavioral Workflow (Business Logic)"},
+    {"id": "timing_attacks", "cwe": "CWE-208", "name": "Observable Timing Discrepancy"},
+    {"id": "uuid_insecurities", "cwe": "CWE-330", "name": "Use of Insufficiently Random Values"},
+    {"id": "reverse_tab_nabbing", "cwe": "CWE-1022", "name": "Use of Web Link to Untrusted Target with window.opener Access (Reverse Tabnabbing)"},
+    {"id": "iframe_traps", "cwe": "CWE-1021", "name": "Improper Restriction of Rendered UI Layers or Frames (Clickjacking)"},
+    {"id": "cookie_hacking", "cwe": "CWE-565", "name": "Reliance on Cookies without Validation and Integrity Checking"},
+    {"id": "postmessage_vulnerabilities", "cwe": "CWE-345", "name": "Insufficient Verification of Data Authenticity (postMessage)"},
+    {"id": "web_vulnerabilities_methodology", "cwe": "CWE-1057", "name": "Improper Inventory / Methodology"}
+  ]
+}

package/intelligence/doctrine_map.json

@@ -57,6 +57,8 @@
     {"moment": "model/sub-agent failed", "reach": ["model_fallback", "retry_guidance"]},
     {"moment": "am I done?", "reach": ["engagement_status"]},
     {"moment": "need to run an external exploit tool", "reach": ["tool_lookup", "ensure_tool", "read_tool_manual"]},
-    {"moment": "need the campaign plan for this target type", "reach": ["read_playbook"]}
+    {"moment": "need the campaign plan for this target type", "reach": ["read_playbook"]},
+    {"moment": "map a finding to a standard ID for the report", "reach": ["taxonomy"]},
+    {"moment": "need domain-specific tools beyond Blitz's own data", "reach": ["resource_lookup"]}
   ]
 }

package/intelligence/owasp_top10.json

@@ -0,0 +1,15 @@
+{
+  "_comment": "OWASP Top 10 (2021) — the fundamental web risk taxonomy — mapped to CWE and Blitz Strike coverage.",
+  "risks": [
+    {"id": "A01", "name": "Broken Access Control", "cwe": ["CWE-200", "CWE-284", "CWE-285", "CWE-639", "CWE-862", "CWE-863"], "desc": "Missing/weak authorization on object, function, or property access.", "blitz": "technique_lookup(idor) + technique_lookup(mass_assignment) + route_scan"},
+    {"id": "A02", "name": "Cryptographic Failures", "cwe": ["CWE-259", "CWE-327", "CWE-328", "CWE-331"], "desc": "Weak/absent encryption, hardcoded keys, weak randomness.", "blitz": "hp-tls-transport + ap-client-side-crypto-forgery + technique_lookup(uuid_insecurities)"},
+    {"id": "A03", "name": "Injection", "cwe": ["CWE-79", "CWE-89", "CWE-94"], "desc": "SQL/NoSQL/OS/LDAP/XPath/XSS/SSI/XSLT/SSTI injection from unsanitized input.", "blitz": "source-audit (taint) + technique_lookup(sql_injection|xss|command_injection|ssti|ldap_injection|xpath_injection) + payload_lookup"},
+    {"id": "A04", "name": "Insecure Design", "cwe": ["CWE-209", "CWE-256", "CWE-501", "CWE-522"], "desc": "Design flaws (missing rate-limit, weak reset, flawed business logic).", "blitz": "hp-business-logic-fuzzing + technique_lookup(rate_limit_bypass|password_reset_bypass|bypass_payment)"},
+    {"id": "A05", "name": "Security Misconfiguration", "cwe": ["CWE-16", "CWE-611", "CWE-1004"], "desc": "Exposed debug/admin, verbose errors, missing headers, CORS, XXE-enabled parsers.", "blitz": "web-hunting (exposed config) + technique_lookup(cors|xxe) + live_recon"},
+    {"id": "A06", "name": "Vulnerable and Outdated Components", "cwe": ["CWE-1104"], "desc": "Known-vulnerable libraries/frameworks/components.", "blitz": "hp-dependency-audit + cve_correlation + nvd_lookup + framework_tricks"},
+    {"id": "A07", "name": "Identification and Authentication Failures", "cwe": ["CWE-287", "CWE-384", "CWE-798"], "desc": "Weak auth, session fixation, credential stuffing, weak JWT/OAuth.", "blitz": "technique_lookup(jwt|oauth|two_fa_bypass|account_takeover) + bypass_lookup(auth)"},
+    {"id": "A08", "name": "Software and Data Integrity Failures", "cwe": ["CWE-502", "CWE-494", "CWE-829"], "desc": "Insecure deserialization, unverified updates/plugins, CI/CD tampering.", "blitz": "technique_lookup(deserialization) + complex_scan + ap-gitea-ci-injection"},
+    {"id": "A09", "name": "Security Logging and Monitoring Failures", "cwe": ["CWE-778"], "desc": "Missing logging/detection (a monitoring gap, not an exploit).", "blitz": "report as a gap — note the absence of detection in the report"},
+    {"id": "A10", "name": "Server-Side Request Forgery", "cwe": ["CWE-918"], "desc": "The server fetches an attacker-influenced URL.", "blitz": "technique_lookup(ssrf) + ap-ssrf-cloud-metadata + bypass_lookup"}
+  ]
+}

package/intelligence/resources.json

@@ -0,0 +1,35 @@
+{
+  "_comment": "Curated security resource index (from the community 'Awesome Hacking' meta-list, filtered to what matters for web/pentest bug hunting). The LLM uses this to find the best domain-specific tools/knowledge. use_when maps each resource to a Blitz Strike phase/context.",
+  "resources": [
+    {"id": "web_hacking", "name": "awesome-web-hacking", "category": "web", "url": "https://github.com/infoslack/awesome-web-hacking", "desc": "Web application security tools and techniques.", "use_when": "live web app testing — the master web list"},
+    {"id": "web_security", "name": "awesome-web-security", "category": "web", "url": "https://github.com/qazbnm456/awesome-web-security", "desc": "Web security materials and resources.", "use_when": "web security research + writeups"},
+    {"id": "pentest", "name": "awesome-pentest", "category": "pentest", "url": "https://github.com/enaqx/awesome-pentest", "desc": "Penetration testing resources, tools, and references.", "use_when": "broad pentest tooling + methodology"},
+    {"id": "bug_bounty", "name": "awesome-bug-bounty", "category": "bug_bounty", "url": "https://github.com/djadmin/awesome-bug-bounty", "desc": "Bug bounty programs and hunter write-ups.", "use_when": "bug bounty target selection + report style"},
+    {"id": "bug_bounty_reference", "name": "bug-bounty-reference", "category": "bug_bounty", "url": "https://github.com/ngalongc/bug-bounty-reference", "desc": "Write-ups categorized by bug nature.", "use_when": "seeing how a bug class was exploited in the wild"},
+    {"id": "api_checklist", "name": "API-Security-Checklist", "category": "api", "url": "https://github.com/shieldfy/API-Security-Checklist", "desc": "API security countermeasures checklist.", "use_when": "API/GraphQL security testing"},
+    {"id": "asset_discovery", "name": "Awesome-Asset-Discovery", "category": "recon", "url": "https://github.com/redhuntlabs/Awesome-Asset-Discovery", "desc": "Asset discovery / attack-surface enumeration resources.", "use_when": "recon — mapping the full attack surface"},
+    {"id": "payloads_foospidy", "name": "payloads", "category": "payload", "url": "https://github.com/foospidy/payloads", "desc": "Web attack payloads collection.", "use_when": "crafting probes"},
+    {"id": "payloads_all_the_things", "name": "PayloadsAllTheThings", "category": "payload", "url": "https://github.com/swisskyrepo/PayloadsAllTheThings", "desc": "Payloads + bypass for web app pentest/CTF (already vendored as payloads/).", "use_when": "crafting probes"},
+    {"id": "seclists", "name": "SecLists", "category": "payload", "url": "https://github.com/danielmiessler/SecLists", "desc": "Wordlists + fuzz lists for security assessments.", "use_when": "fuzzing + brute-force lists"},
+    {"id": "cve_poc", "name": "trickest/cve", "category": "cve", "url": "https://github.com/trickest/cve", "desc": "CVE Proof-of-Concepts updated daily.", "use_when": "finding a PoC for a known CVE"},
+    {"id": "gtfobins", "name": "GTFOBins", "category": "privesc", "url": "https://gtfobins.github.io", "desc": "Unix binaries exploitable to bypass local restrictions.", "use_when": "Linux privilege escalation"},
+    {"id": "static_analysis", "name": "static-analysis", "category": "source", "url": "https://github.com/analysis-tools-dev/static-analysis", "desc": "Static analysis tools, linters, and checkers per language.", "use_when": "source-code audit tool selection"},
+    {"id": "fuzzing", "name": "Awesome-Fuzzing", "category": "fuzzing", "url": "https://github.com/secfigo/Awesome-Fuzzing", "desc": "Fuzzing resources + exploit-development learning.", "use_when": "input fuzzing / crash analysis"},
+    {"id": "prompt_injection", "name": "awesome-prompt-injection", "category": "llm", "url": "https://github.com/Joe-B-Security/awesome-prompt-injection", "desc": "Prompt-injection vulnerabilities targeting AI/LLM systems.", "use_when": "testing LLM/AI-integrated targets"},
+    {"id": "nodejs_security", "name": "awesome-nodejs-security", "category": "framework", "url": "https://github.com/lirantal/awesome-nodejs-security", "desc": "Node.js security tools + incidents.", "use_when": "Node/Express target"},
+    {"id": "php_security", "name": "awesome-php#security", "category": "framework", "url": "https://github.com/ziadoz/awesome-php#security", "desc": "PHP security libraries + scanners.", "use_when": "PHP target"},
+    {"id": "osint", "name": "awesome-osint", "category": "recon", "url": "https://github.com/jivoi/awesome-osint", "desc": "OSINT tools and resources.", "use_when": "OSINT / passive recon"},
+    {"id": "reversing", "name": "awesome-reversing", "category": "rev", "url": "https://github.com/HACKE-RC/awesome-reversing", "desc": "Reverse engineering learning resources.", "use_when": "binary RE"},
+    {"id": "password_cracking", "name": "awesome-password-cracking", "category": "cracking", "url": "https://github.com/n0kovo/awesome-password-cracking", "desc": "Password recovery tools + resources.", "use_when": "hash cracking"},
+    {"id": "forensics", "name": "awesome-forensics", "category": "forensics", "url": "https://github.com/Cugu/awesome-forensics", "desc": "Forensic analysis tools.", "use_when": "forensics / incident analysis"},
+    {"id": "malware_analysis", "name": "awesome-malware-analysis", "category": "malware", "url": "https://github.com/rshipp/awesome-malware-analysis", "desc": "Malware analysis tools.", "use_when": "malware triage (static + IOC)"},
+    {"id": "incident_response", "name": "awesome-incident-response", "category": "ir", "url": "https://github.com/meirwah/awesome-incident-response", "desc": "Incident response tools.", "use_when": "incident response"},
+    {"id": "threat_intel", "name": "awesome-threat-intelligence", "category": "intel", "url": "https://github.com/hslatman/awesome-threat-intelligence", "desc": "Threat intelligence resources.", "use_when": "attribution / threat research"},
+    {"id": "ci_cd_attacks", "name": "awesome-cicd-attacks", "category": "cicd", "url": "https://github.com/TupleType/awesome-cicd-attacks", "desc": "CI/CD pipeline offensive research.", "use_when": "CI/CD + deployment-process testing"},
+    {"id": "pentest_wiki", "name": "pentest-wiki", "category": "knowledge", "url": "https://github.com/nixawk/pentest-wiki", "desc": "Free online security knowledge library.", "use_when": "technique reference"},
+    {"id": "infosec_reference", "name": "Infosec_Reference", "category": "knowledge", "url": "https://github.com/rmusser01/Infosec_Reference", "desc": "Information security reference that doesn't suck.", "use_when": "broad infosec reference"},
+    {"id": "cheatsheets", "name": "OWASP CheatSheetSeries", "category": "knowledge", "url": "https://github.com/OWASP/CheatSheetSeries", "desc": "OWASP cheat sheets for app security.", "use_when": "defensive/context reference"},
+    {"id": "vulhub", "name": "vulhub", "category": "labs", "url": "https://github.com/vulhub/vulhub", "desc": "Pre-built vulnerable Docker environments.", "use_when": "spinning up a vulnerable lab to reproduce a bug"},
+    {"id": "ai_security", "name": "Awesome-AI-Security", "category": "llm", "url": "https://github.com/DeepSpaceHarbor/Awesome-AI-Security", "desc": "AI security resources.", "use_when": "AI/LLM system security"}
+  ]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.1.1",
+  "version": "1.1.4",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {

package/skills/bs-web-hunting.md

@@ -178,5 +178,7 @@ into the next follow-up.
 - **Framework-specific tricks** → `framework_tricks(laravel|django|...)` after
   `detect_framework` (signals + known vulns/CVEs + attack tricks).
 - **Need to run an external exploit tool** → `tool_lookup` → `ensure_tool` → `read_tool_manual`.
+- **Need domain-specific resources beyond Blitz's own data** → `resource_lookup(web|recon|payload|privesc|...)` for the curated index.
+- **Ground a finding in standard IDs for the report** → `taxonomy(web|api|cwe|asvs, ...)`.
 - **Verification** → `verify-finding` skill. **Review** → `adversarial-review`.
 - **The full map** → `doctrine_map` (phase → skill → tools → data).