blitzstrike 2.4.101 → 2.4.103

package/CHANGELOG.md

@@ -5,6 +5,32 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.103] — 2026-09-17
+
+### Added — version-precise fingerprint-first (semver narrowing)
+
+- `watchlistCveMatches` / `live_recon` now narrow the suggested CVEs by the
+  detected VERSION, not just the product. Each version-aware CVE carries a
+  `fixed_in` (semver boundary) + `version_key`; a detected version >= `fixed_in`
+  is excluded as patched, so `live_recon` names the EXACT CVE for the running
+  version instead of the whole product family. Verified: Next.js 14.2.5 →
+  CVE-2025-29927 (affected) but not CVE-2024-34351 (patched 14.1.1); Next.js
+  15.3.0 → both excluded; unknown version → full product list (fallback).
+
+## [2.4.102] — 2026-09-17
+
+### Added — `broken_link_scan` (broken-link hijacking live detector)
+
+- New `broken_link_scan(url)` tool: crawls the target's outbound references
+  (script/link/img/src + inline JS URLs), then checks each referenced hostname's
+  DNS + RDAP registration status. Unregistered (RDAP 404) or in-drop-cycle
+  (pendingDelete/redemptionPeriod) domains are flagged CLAIMABLE — register the
+  expired domain and inherit the trust of every page that still loads it.
+  Verdict is derived live from DNS + RDAP, never a static list. Distinct from
+  `subdomain_takeover` (dangling CNAME); this is a fully-expired registrable
+  domain. Verified live: example.com → registered (not claimable), a
+  nonexistent domain → RDAP 404 → claimable.
+
 ## [2.4.101] — 2026-09-17
 
 ### Added — three new hunting classes (techniques + attack vectors)

package/dist/index.js

@@ -36189,18 +36189,41 @@ function watchlist() {
   const recommendation = `Prioritize the ${unsaturated.length} non-saturated classes (top: ${unsaturated.slice(0, 3).map((e) => e.cwe).join(", ")}) — high frequency + high payout + not yet saturated. Skip saturated/low-value classes (XSS/CSRF/open-redirect standalone) unless they chain into account takeover. FINGERPRINT FIRST: if the target stack matches a watchlist product (Next.js, Kibana, Langflow, Confluence/Jira, PAN-OS, Grafana), test that specific CVE — top EPSS/report CVEs: ${topCve}.`;
   return { cwe_frequency: entries, cve_watchlist, recommendation };
 }
-function watchlistCveMatches(techs, headers = {}, body = "") {
+function semverLt(a, b) {
+  const pa = a.replace(/^v/, "").split(/[-+.]/).map((x) => parseInt(x, 10) || 0);
+  const pb = b.replace(/^v/, "").split(/[-+.]/).map((x) => parseInt(x, 10) || 0);
+  for (let i = 0;i < Math.max(pa.length, pb.length); i++) {
+    const x = pa[i] ?? 0;
+    const y = pb[i] ?? 0;
+    if (x !== y)
+      return x < y;
+  }
+  return false;
+}
+function watchlistCveMatches(techs, headers = {}, body = "", versions = []) {
   const { cve_watchlist } = loadWatchlist();
   const haystack = `${techs.join(" ")} ${Object.keys(headers).join(" ")} ${Object.values(headers).join(" ")} ${body}`.toLowerCase();
   return cve_watchlist.filter((c) => {
     const m = c.match;
     if (!m)
       return false;
+    let matched = false;
     try {
-      return new RegExp(m, "i").test(haystack);
+      matched = new RegExp(m, "i").test(haystack);
     } catch {
+      matched = false;
+    }
+    if (!matched)
       return false;
+    const fixedIn = c.fixed_in;
+    const vkey = c.version_key;
+    if (fixedIn && vkey) {
+      const v = versions.find((x) => x.product.toLowerCase().includes(vkey.toLowerCase()));
+      if (v?.version && !semverLt(v.version, fixedIn)) {
+        return false;
+      }
     }
+    return true;
   });
 }
 
@@ -36638,7 +36661,7 @@ async function liveRecon(target, includeActive = false) {
   const waf = detectWaf(root.headers, root.body);
   const techs = detectTech(root.headers, root.body);
   const versions = extractVersion(root.headers, root.body);
-  const suggestedCves = watchlistCveMatches(techs, root.headers, root.body);
+  const suggestedCves = watchlistCveMatches(techs, root.headers, root.body, versions);
   const { links, scripts } = crawlLinks(base, root.body);
   const { robots, sitemap } = await fetchRobotsAndSitemap(base);
   const allUrls = [...links, ...scripts, ...robots, ...sitemap];
@@ -59295,6 +59318,163 @@ function dataRefresh() {
 init_verify_harness();
 init_variants();
 
+// src/broken-link.ts
+import { resolve4 as resolve43 } from "node:dns/promises";
+function hostFromUrl(u) {
+  try {
+    const h = new URL(u.startsWith("//") ? `https:${u}` : u).hostname.toLowerCase();
+    return h || null;
+  } catch {
+    return null;
+  }
+}
+var ALWAYS_ALIVE = new Set([
+  "googleapis.com",
+  "gstatic.com",
+  "google.com",
+  "googletagmanager.com",
+  "google-analytics.com",
+  "cloudflare.com",
+  "cloudflareinsights.com",
+  "jsdelivr.net",
+  "unpkg.com",
+  "cdnjs.cloudflare.com",
+  "bootstrapcdn.com",
+  "jquery.com",
+  "fontawesome.com",
+  "stackpathcdn.com",
+  "w3.org",
+  "schema.org",
+  "github.com",
+  "github.io",
+  "npmjs.com",
+  "nodejs.org",
+  "microsoft.com",
+  "azureedge.net",
+  "azure.com",
+  "akamai.net",
+  "akamaized.net",
+  "amazonaws.com",
+  "amazon.com",
+  "cloudfront.net",
+  "youtube.com",
+  "youtu.be",
+  "instagram.com",
+  "facebook.com",
+  "fbcdn.net",
+  "twitter.com",
+  "x.com",
+  "tiktok.com",
+  "pinterest.com",
+  "linkedin.com",
+  "apple.com",
+  "mozilla.org",
+  "gravatar.com",
+  "twimg.com",
+  "g.co",
+  "goo.gl",
+  "bit.ly",
+  "tinyurl.com",
+  "paypal.com",
+  "stripe.com",
+  "shopify.com",
+  "wordpress.org",
+  "wp.com"
+]);
+function extractOutboundHosts(html, baseHost) {
+  const hosts = new Set;
+  for (const m of html.matchAll(/(?:src|href)\s*=\s*["']([^"']+)["']/gi)) {
+    const h = hostFromUrl(m[1]);
+    if (h)
+      hosts.add(h);
+  }
+  for (const m of html.matchAll(/https?:\/\/([a-z0-9.-]+)/gi)) {
+    hosts.add(m[1].toLowerCase());
+  }
+  const base = baseHost.toLowerCase().replace(/^www\./, "");
+  const out = [...hosts].filter((h) => {
+    const lh = h.toLowerCase().replace(/^www\./, "");
+    if (lh === base || lh.endsWith(`.${base}`))
+      return false;
+    if (ALWAYS_ALIVE.has(lh))
+      return false;
+    for (const s of ALWAYS_ALIVE)
+      if (lh.endsWith(`.${s}`))
+        return false;
+    return true;
+  });
+  return [...new Set(out)].sort();
+}
+async function checkDomainStatus(domain) {
+  let resolved = true;
+  try {
+    await resolve43(domain);
+  } catch {
+    resolved = false;
+  }
+  try {
+    const res = await fetch(`https://rdap.org/domain/${domain}`, {
+      signal: AbortSignal.timeout(7000),
+      headers: { accept: "application/json" }
+    });
+    if (res.status === 404) {
+      return { status: "unregistered", claimable: true, evidence: "RDAP 404 — domain not registered, registrable now" };
+    }
+    const data = await res.json();
+    const statuses = data.status ?? [];
+    if (statuses.includes("pendingDelete") || statuses.includes("redemptionPeriod")) {
+      return { status: statuses.join(","), claimable: true, evidence: `RDAP ${statuses.join(",")} — in the drop cycle, registrable soon` };
+    }
+    if (statuses.length > 0) {
+      return { status: statuses.join(","), claimable: false, evidence: `RDAP ${statuses.join(",")} — still registered${resolved ? "" : " (held, no DNS)"}` };
+    }
+    return { status: resolved ? "resolved" : "nxdomain", claimable: false, evidence: "RDAP returned no status (inconclusive)" };
+  } catch {
+    return { status: resolved ? "resolved" : "nxdomain", claimable: false, evidence: resolved ? "RDAP lookup failed — cannot confirm registration status" : "NXDOMAIN + RDAP lookup failed (inconclusive)" };
+  }
+}
+async function brokenLinkScan(url, maxHosts = 30) {
+  const base = url.startsWith("http") ? url : `https://${url}`;
+  const baseHost = (() => {
+    try {
+      return new URL(base).hostname;
+    } catch {
+      return url;
+    }
+  })();
+  let html = "";
+  try {
+    const res = await fetch(base, { signal: AbortSignal.timeout(15000), redirect: "follow", headers: researchHeaders() });
+    html = (await res.text()).slice(0, 1e6);
+  } catch {
+    return { target: base, base_host: baseHost, outbound_hosts: 0, checked: 0, claimable: [], inconclusive: [] };
+  }
+  const hosts = extractOutboundHosts(html, baseHost).slice(0, maxHosts);
+  const claimable = [];
+  const inconclusive = [];
+  for (let i = 0;i < hosts.length; i += 5) {
+    const batch = hosts.slice(i, i + 5);
+    const results = await Promise.all(batch.map(async (h) => {
+      const r = await checkDomainStatus(h);
+      return { domain: h, ...r };
+    }));
+    for (const r of results) {
+      if (r.claimable)
+        claimable.push({ domain: r.domain, status: r.status, claimable: true, evidence: r.evidence, source: "outbound-reference" });
+      else if (r.status === "nxdomain")
+        inconclusive.push(r.domain);
+    }
+  }
+  return {
+    target: base,
+    base_host: baseHost,
+    outbound_hosts: hosts.length,
+    checked: hosts.length,
+    claimable,
+    inconclusive
+  };
+}
+
 // src/benchmark.ts
 import { readFileSync as readFileSync22, readdirSync as readdirSync5, writeFileSync as writeFileSync6, rmSync as rmSync3, mkdirSync as mkdirSync7 } from "node:fs";
 import { join as join22 } from "node:path";
@@ -62890,6 +63070,15 @@ ${statusLine}` : statusLine },
   }, async () => {
     return { content: [{ type: "text", text: JSON.stringify(watchlist()) }] };
   });
+  server.registerTool("broken_link_scan", {
+    title: "Broken-link hijacking / expired-domain takeover (live detector)",
+    description: "Detect expired-domain takeover (broken-link hijacking): crawl the target's outbound references (script/link/img/src + inline JS URLs), then check each referenced hostname's DNS + RDAP registration status. A domain that is unregistered (RDAP 404) or in the drop cycle (pendingDelete/redemptionPeriod) is CLAIMABLE — register it and inherit the trust of every page that still loads it. Distinct from subdomain_takeover (a dangling CNAME); this is a fully-expired registrable domain. Verdict is derived live from DNS + RDAP, never a static list.",
+    inputSchema: {
+      url: string2().describe("Target URL (https://target.com) — crawls outbound references")
+    }
+  }, async ({ url }) => {
+    return { content: [{ type: "text", text: JSON.stringify(await brokenLinkScan(url)) }] };
+  });
   server.registerTool("auto_poc", {
     title: "Auto-PoC — generate a copy-paste-ready reproduction recipe",
     description: "Turn a finding into a concrete reproduction recipe (the 'reproducible' gate question made executable). Given a vuln class + target + endpoint + param, emit the exact request (with a MARKER), a NEGATIVE CONTROL, and the expected differential that PROVES the bug — plus a Patchstack-style title, derived severity, and the fix. Covers sql_injection, missing_authz/idor, ssrf, xss, ssti, command_injection, file_upload, mass_assignment, jwt_alg_confusion, crlf, open_redirect, xxe, prototype_pollution, deserialization, hardcoded_secret, cache_deception, cors_misconfiguration, subdomain_takeover. Pass type='list' to enumerate supported classes.",

package/intelligence/watchlist.json

@@ -181,7 +181,9 @@
       "epss": 1.0,
       "reports": 2669,
       "fingerprint": "Confluence (Server/Data Center) \u2014 /login.action, confluence headers",
-      "match": "confluence|login\\.action|atlassian"
+      "match": "confluence|login\\.action|atlassian",
+      "fixed_in": "7.13.0",
+      "version_key": "confluence"
     },
     {
       "cve": "CVE-2025-29927",
@@ -191,7 +193,9 @@
       "epss": 0.9962,
       "reports": 132,
       "fingerprint": "_next/static/chunks/ bundles; x-middleware-subrequest header",
-      "match": "_next/|__next|next\\.js|middleware"
+      "match": "_next/|__next|next\\.js|middleware",
+      "fixed_in": "15.2.3",
+      "version_key": "next"
     },
     {
       "cve": "CVE-2025-55182",
@@ -201,7 +205,9 @@
       "epss": 0.9956,
       "reports": 415,
       "fingerprint": "_next/ + Server Function / flight endpoints",
-      "match": "_next/|server function|react server|rsc"
+      "match": "_next/|server function|react server|rsc",
+      "fixed_in": null,
+      "version_key": null
     },
     {
       "cve": "CVE-2025-3248",
@@ -211,7 +217,9 @@
       "epss": 0.9997,
       "reports": 29,
       "fingerprint": "/api/v1/validate/code \u2014 AI/agent tooling",
-      "match": "langflow|validate/code"
+      "match": "langflow|validate/code",
+      "fixed_in": null,
+      "version_key": null
     },
     {
       "cve": "CVE-2024-34351",
@@ -221,7 +229,9 @@
       "epss": 0.0545,
       "reports": 50,
       "fingerprint": "Next.js Server Actions (Host header + relative redirect)",
-      "match": "_next/|server action"
+      "match": "_next/|server action",
+      "fixed_in": "14.1.1",
+      "version_key": "next"
     },
     {
       "cve": "CVE-2025-0133",
@@ -231,7 +241,9 @@
       "epss": 0.4352,
       "reports": 1990,
       "fingerprint": "GlobalProtect captive portal",
-      "match": "globalprotect|palo alto|pan-os|pan os"
+      "match": "globalprotect|palo alto|pan-os|pan os",
+      "fixed_in": null,
+      "version_key": null
     },
     {
       "cve": "CVE-2026-0257",
@@ -241,7 +253,9 @@
       "epss": 0.8668,
       "reports": 27,
       "fingerprint": "GlobalProtect portal/gateway",
-      "match": "globalprotect|palo alto|pan-os|pan os"
+      "match": "globalprotect|palo alto|pan-os|pan os",
+      "fixed_in": null,
+      "version_key": null
     },
     {
       "cve": "CVE-2025-4123",
@@ -251,7 +265,9 @@
       "epss": 0.9781,
       "reports": 220,
       "fingerprint": "Grafana path traversal + open redirect (Image Renderer)",
-      "match": "grafana|x-grafana"
+      "match": "grafana|x-grafana",
+      "fixed_in": null,
+      "version_key": null
     },
     {
       "cve": "CVE-2021-20323",
@@ -261,7 +277,9 @@
       "epss": 0.3725,
       "reports": 107,
       "fingerprint": "Keycloak auth flows",
-      "match": "keycloak|kc-|realms/"
+      "match": "keycloak|kc-|realms/",
+      "fixed_in": null,
+      "version_key": null
     },
     {
       "cve": "CVE-2018-5230",
@@ -271,7 +289,9 @@
       "epss": 0.3761,
       "reports": 4694,
       "fingerprint": "Jira /issuecollector custom fields",
-      "match": "jira|issuecollector|atlassian"
+      "match": "jira|issuecollector|atlassian",
+      "fixed_in": null,
+      "version_key": null
     },
     {
       "cve": "CVE-2026-33461",
@@ -281,7 +301,9 @@
       "epss": 0.0028,
       "reports": 8,
       "fingerprint": "Kibana internal Fleet endpoints",
-      "match": "kibana|elastic|fleet"
+      "match": "kibana|elastic|fleet",
+      "fixed_in": null,
+      "version_key": null
     },
     {
       "cve": "CVE-2026-49093",
@@ -291,7 +313,9 @@
       "epss": 0.002,
       "reports": 5,
       "fingerprint": "Kibana connectors / allowlist bypass",
-      "match": "kibana|elastic|connector"
+      "match": "kibana|elastic|connector",
+      "fixed_in": null,
+      "version_key": null
     },
     {
       "cve": "CVE-2026-26938",
@@ -301,7 +325,9 @@
       "epss": 0.0025,
       "reports": 5,
       "fingerprint": "Kibana Workflows",
-      "match": "kibana|elastic|workflow"
+      "match": "kibana|elastic|workflow",
+      "fixed_in": null,
+      "version_key": null
     },
     {
       "cve": "CVE-2026-33068",
@@ -311,7 +337,9 @@
       "epss": 0.0034,
       "reports": 5,
       "fingerprint": "repo .claude/settings.json",
-      "match": "\\.claude/settings"
+      "match": "\\.claude/settings",
+      "fixed_in": null,
+      "version_key": null
     },
     {
       "cve": "CVE-2025-25297",
@@ -321,7 +349,9 @@
       "epss": 0.0062,
       "reports": 2,
       "fingerprint": "Label Studio S3 integration",
-      "match": "label ?studio|labelstudio|label-studio"
+      "match": "label ?studio|labelstudio|label-studio",
+      "fixed_in": null,
+      "version_key": null
     },
     {
       "cve": "CVE-2026-33309",
@@ -331,7 +361,9 @@
       "epss": 0.0142,
       "reports": 6,
       "fingerprint": "Langflow multipart upload filename",
-      "match": "langflow"
+      "match": "langflow",
+      "fixed_in": null,
+      "version_key": null
     },
     {
       "cve": "CVE-2026-45543",
@@ -341,7 +373,9 @@
       "epss": 0.0027,
       "reports": 5,
       "fingerprint": "Nextcloud Forms collaborator removal",
-      "match": "nextcloud|ocs-provider"
+      "match": "nextcloud|ocs-provider",
+      "fixed_in": null,
+      "version_key": null
     },
     {
       "cve": "CVE-2017-15277",
@@ -351,7 +385,9 @@
       "epss": 0.1919,
       "reports": 5914,
       "fingerprint": "image processing (GIF upload)",
-      "match": "imagemagick|graphicsmagick"
+      "match": "imagemagick|graphicsmagick",
+      "fixed_in": null,
+      "version_key": null
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.101",
+  "version": "2.4.103",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {