blitzstrike 2.4.100 → 2.4.102

package/CHANGELOG.md

@@ -5,6 +5,31 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.102] — 2026-09-17
+
+### Added — `broken_link_scan` (broken-link hijacking live detector)
+
+- New `broken_link_scan(url)` tool: crawls the target's outbound references
+  (script/link/img/src + inline JS URLs), then checks each referenced hostname's
+  DNS + RDAP registration status. Unregistered (RDAP 404) or in-drop-cycle
+  (pendingDelete/redemptionPeriod) domains are flagged CLAIMABLE — register the
+  expired domain and inherit the trust of every page that still loads it.
+  Verdict is derived live from DNS + RDAP, never a static list. Distinct from
+  `subdomain_takeover` (dangling CNAME); this is a fully-expired registrable
+  domain. Verified live: example.com → registered (not claimable), a
+  nonexistent domain → RDAP 404 → claimable.
+
+## [2.4.101] — 2026-09-17
+
+### Added — three new hunting classes (techniques + attack vectors)
+
+- Added `broken_link_hijacking` (expired-domain takeover), `padding_oracle`
+  (CBC PKCS#7 cookie/token decryption), and `dns_rebinding` (hostname
+  re-resolution to internal IP) to the technique base (53 → 56 classes) and the
+  attack-vector taxonomy (588 → 591 vectors). Each carries summary, objectives,
+  how-to-test steps, concrete techniques, and verify (marker + negative
+  control) — matching the existing per-class methodology shape.
+
 ## [2.4.100] — 2026-09-17
 
 ### Fixed — data-file resolution was `process.cwd()`-dependent (broke under npx)

package/dist/index.js

@@ -59295,6 +59295,163 @@ function dataRefresh() {
 init_verify_harness();
 init_variants();
 
+// src/broken-link.ts
+import { resolve4 as resolve43 } from "node:dns/promises";
+function hostFromUrl(u) {
+  try {
+    const h = new URL(u.startsWith("//") ? `https:${u}` : u).hostname.toLowerCase();
+    return h || null;
+  } catch {
+    return null;
+  }
+}
+var ALWAYS_ALIVE = new Set([
+  "googleapis.com",
+  "gstatic.com",
+  "google.com",
+  "googletagmanager.com",
+  "google-analytics.com",
+  "cloudflare.com",
+  "cloudflareinsights.com",
+  "jsdelivr.net",
+  "unpkg.com",
+  "cdnjs.cloudflare.com",
+  "bootstrapcdn.com",
+  "jquery.com",
+  "fontawesome.com",
+  "stackpathcdn.com",
+  "w3.org",
+  "schema.org",
+  "github.com",
+  "github.io",
+  "npmjs.com",
+  "nodejs.org",
+  "microsoft.com",
+  "azureedge.net",
+  "azure.com",
+  "akamai.net",
+  "akamaized.net",
+  "amazonaws.com",
+  "amazon.com",
+  "cloudfront.net",
+  "youtube.com",
+  "youtu.be",
+  "instagram.com",
+  "facebook.com",
+  "fbcdn.net",
+  "twitter.com",
+  "x.com",
+  "tiktok.com",
+  "pinterest.com",
+  "linkedin.com",
+  "apple.com",
+  "mozilla.org",
+  "gravatar.com",
+  "twimg.com",
+  "g.co",
+  "goo.gl",
+  "bit.ly",
+  "tinyurl.com",
+  "paypal.com",
+  "stripe.com",
+  "shopify.com",
+  "wordpress.org",
+  "wp.com"
+]);
+function extractOutboundHosts(html, baseHost) {
+  const hosts = new Set;
+  for (const m of html.matchAll(/(?:src|href)\s*=\s*["']([^"']+)["']/gi)) {
+    const h = hostFromUrl(m[1]);
+    if (h)
+      hosts.add(h);
+  }
+  for (const m of html.matchAll(/https?:\/\/([a-z0-9.-]+)/gi)) {
+    hosts.add(m[1].toLowerCase());
+  }
+  const base = baseHost.toLowerCase().replace(/^www\./, "");
+  const out = [...hosts].filter((h) => {
+    const lh = h.toLowerCase().replace(/^www\./, "");
+    if (lh === base || lh.endsWith(`.${base}`))
+      return false;
+    if (ALWAYS_ALIVE.has(lh))
+      return false;
+    for (const s of ALWAYS_ALIVE)
+      if (lh.endsWith(`.${s}`))
+        return false;
+    return true;
+  });
+  return [...new Set(out)].sort();
+}
+async function checkDomainStatus(domain) {
+  let resolved = true;
+  try {
+    await resolve43(domain);
+  } catch {
+    resolved = false;
+  }
+  try {
+    const res = await fetch(`https://rdap.org/domain/${domain}`, {
+      signal: AbortSignal.timeout(7000),
+      headers: { accept: "application/json" }
+    });
+    if (res.status === 404) {
+      return { status: "unregistered", claimable: true, evidence: "RDAP 404 — domain not registered, registrable now" };
+    }
+    const data = await res.json();
+    const statuses = data.status ?? [];
+    if (statuses.includes("pendingDelete") || statuses.includes("redemptionPeriod")) {
+      return { status: statuses.join(","), claimable: true, evidence: `RDAP ${statuses.join(",")} — in the drop cycle, registrable soon` };
+    }
+    if (statuses.length > 0) {
+      return { status: statuses.join(","), claimable: false, evidence: `RDAP ${statuses.join(",")} — still registered${resolved ? "" : " (held, no DNS)"}` };
+    }
+    return { status: resolved ? "resolved" : "nxdomain", claimable: false, evidence: "RDAP returned no status (inconclusive)" };
+  } catch {
+    return { status: resolved ? "resolved" : "nxdomain", claimable: false, evidence: resolved ? "RDAP lookup failed — cannot confirm registration status" : "NXDOMAIN + RDAP lookup failed (inconclusive)" };
+  }
+}
+async function brokenLinkScan(url, maxHosts = 30) {
+  const base = url.startsWith("http") ? url : `https://${url}`;
+  const baseHost = (() => {
+    try {
+      return new URL(base).hostname;
+    } catch {
+      return url;
+    }
+  })();
+  let html = "";
+  try {
+    const res = await fetch(base, { signal: AbortSignal.timeout(15000), redirect: "follow", headers: researchHeaders() });
+    html = (await res.text()).slice(0, 1e6);
+  } catch {
+    return { target: base, base_host: baseHost, outbound_hosts: 0, checked: 0, claimable: [], inconclusive: [] };
+  }
+  const hosts = extractOutboundHosts(html, baseHost).slice(0, maxHosts);
+  const claimable = [];
+  const inconclusive = [];
+  for (let i = 0;i < hosts.length; i += 5) {
+    const batch = hosts.slice(i, i + 5);
+    const results = await Promise.all(batch.map(async (h) => {
+      const r = await checkDomainStatus(h);
+      return { domain: h, ...r };
+    }));
+    for (const r of results) {
+      if (r.claimable)
+        claimable.push({ domain: r.domain, status: r.status, claimable: true, evidence: r.evidence, source: "outbound-reference" });
+      else if (r.status === "nxdomain")
+        inconclusive.push(r.domain);
+    }
+  }
+  return {
+    target: base,
+    base_host: baseHost,
+    outbound_hosts: hosts.length,
+    checked: hosts.length,
+    claimable,
+    inconclusive
+  };
+}
+
 // src/benchmark.ts
 import { readFileSync as readFileSync22, readdirSync as readdirSync5, writeFileSync as writeFileSync6, rmSync as rmSync3, mkdirSync as mkdirSync7 } from "node:fs";
 import { join as join22 } from "node:path";
@@ -62890,6 +63047,15 @@ ${statusLine}` : statusLine },
   }, async () => {
     return { content: [{ type: "text", text: JSON.stringify(watchlist()) }] };
   });
+  server.registerTool("broken_link_scan", {
+    title: "Broken-link hijacking / expired-domain takeover (live detector)",
+    description: "Detect expired-domain takeover (broken-link hijacking): crawl the target's outbound references (script/link/img/src + inline JS URLs), then check each referenced hostname's DNS + RDAP registration status. A domain that is unregistered (RDAP 404) or in the drop cycle (pendingDelete/redemptionPeriod) is CLAIMABLE — register it and inherit the trust of every page that still loads it. Distinct from subdomain_takeover (a dangling CNAME); this is a fully-expired registrable domain. Verdict is derived live from DNS + RDAP, never a static list.",
+    inputSchema: {
+      url: string2().describe("Target URL (https://target.com) — crawls outbound references")
+    }
+  }, async ({ url }) => {
+    return { content: [{ type: "text", text: JSON.stringify(await brokenLinkScan(url)) }] };
+  });
   server.registerTool("auto_poc", {
     title: "Auto-PoC — generate a copy-paste-ready reproduction recipe",
     description: "Turn a finding into a concrete reproduction recipe (the 'reproducible' gate question made executable). Given a vuln class + target + endpoint + param, emit the exact request (with a MARKER), a NEGATIVE CONTROL, and the expected differential that PROVES the bug — plus a Patchstack-style title, derived severity, and the fix. Covers sql_injection, missing_authz/idor, ssrf, xss, ssti, command_injection, file_upload, mass_assignment, jwt_alg_confusion, crlf, open_redirect, xxe, prototype_pollution, deserialization, hardcoded_secret, cache_deception, cors_misconfiguration, subdomain_takeover. Pass type='list' to enumerate supported classes.",
@@ -63043,7 +63209,7 @@ ${statusLine}` : statusLine },
   });
   server.registerTool("technique_lookup", {
     title: "Detailed bug-hunting technique base",
-    description: "INTEL: return the DETAILED methodology + tricks for one vulnerability class (52 classes: ssrf, request smuggling, cache poisoning, race conditions, ssti, deserialization, prototype pollution, mass assignment, sql/nosql injection, xss, cors, csrf, jwt, oauth, host header, open redirect, subdomain takeover, idor, graphql, websocket, file upload, path traversal/LFI, command injection, xxe, crlf, ldap, xpath, xslt, ssi, xssi, email, formula/CSV, orm, rsql, unicode, dangling markup, account takeover, 2fa bypass, rate-limit, password reset, captcha, registration, payment bypass, timing, uuid, reverse tabnabbing, iframe traps, cookies, postMessage, ...). Each returns summary, objectives, how_to_test steps, concrete techniques, and verify (marker + negative control). Load before testing a class to hunt it in detail.",
+    description: "INTEL: return the DETAILED methodology + tricks for one vulnerability class (56 classes: ssrf, request smuggling, cache poisoning, race conditions, ssti, deserialization, prototype pollution, mass assignment, sql/nosql injection, xss, cors, csrf, jwt, oauth, host header, open redirect, subdomain takeover, broken link hijacking, dns rebinding, padding oracle, idor, graphql, websocket, file upload, path traversal/LFI, command injection, xxe, crlf, ldap, xpath, xslt, ssi, xssi, email, formula/CSV, orm, rsql, unicode, dangling markup, account takeover, 2fa bypass, rate-limit, password reset, captcha, registration, payment bypass, timing, uuid, reverse tabnabbing, iframe traps, cookies, postMessage, ...). Each returns summary, objectives, how_to_test steps, concrete techniques, and verify (marker + negative control). Load before testing a class to hunt it in detail.",
     inputSchema: {
       cls: string2().optional().describe("Optional class id or name (e.g. 'ssrf', 'request smuggling', 'ssti').")
     }