blitzstrike 2.4.100 → 2.4.101

package/CHANGELOG.md

@@ -5,6 +5,17 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.101] — 2026-09-17
+
+### Added — three new hunting classes (techniques + attack vectors)
+
+- Added `broken_link_hijacking` (expired-domain takeover), `padding_oracle`
+  (CBC PKCS#7 cookie/token decryption), and `dns_rebinding` (hostname
+  re-resolution to internal IP) to the technique base (53 → 56 classes) and the
+  attack-vector taxonomy (588 → 591 vectors). Each carries summary, objectives,
+  how-to-test steps, concrete techniques, and verify (marker + negative
+  control) — matching the existing per-class methodology shape.
+
 ## [2.4.100] — 2026-09-17
 
 ### Fixed — data-file resolution was `process.cwd()`-dependent (broke under npx)

package/dist/index.js

@@ -63043,7 +63043,7 @@ ${statusLine}` : statusLine },
   });
   server.registerTool("technique_lookup", {
     title: "Detailed bug-hunting technique base",
-    description: "INTEL: return the DETAILED methodology + tricks for one vulnerability class (52 classes: ssrf, request smuggling, cache poisoning, race conditions, ssti, deserialization, prototype pollution, mass assignment, sql/nosql injection, xss, cors, csrf, jwt, oauth, host header, open redirect, subdomain takeover, idor, graphql, websocket, file upload, path traversal/LFI, command injection, xxe, crlf, ldap, xpath, xslt, ssi, xssi, email, formula/CSV, orm, rsql, unicode, dangling markup, account takeover, 2fa bypass, rate-limit, password reset, captcha, registration, payment bypass, timing, uuid, reverse tabnabbing, iframe traps, cookies, postMessage, ...). Each returns summary, objectives, how_to_test steps, concrete techniques, and verify (marker + negative control). Load before testing a class to hunt it in detail.",
+    description: "INTEL: return the DETAILED methodology + tricks for one vulnerability class (56 classes: ssrf, request smuggling, cache poisoning, race conditions, ssti, deserialization, prototype pollution, mass assignment, sql/nosql injection, xss, cors, csrf, jwt, oauth, host header, open redirect, subdomain takeover, broken link hijacking, dns rebinding, padding oracle, idor, graphql, websocket, file upload, path traversal/LFI, command injection, xxe, crlf, ldap, xpath, xslt, ssi, xssi, email, formula/CSV, orm, rsql, unicode, dangling markup, account takeover, 2fa bypass, rate-limit, password reset, captcha, registration, payment bypass, timing, uuid, reverse tabnabbing, iframe traps, cookies, postMessage, ...). Each returns summary, objectives, how_to_test steps, concrete techniques, and verify (marker + negative control). Load before testing a class to hunt it in detail.",
     inputSchema: {
       cls: string2().optional().describe("Optional class id or name (e.g. 'ssrf', 'request smuggling', 'ssti').")
     }