blitzstrike 2.4.106 → 2.4.108
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +37 -0
- package/dist/index.js +3549 -3357
- package/intelligence/surface-map.json +159 -0
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -5,6 +5,43 @@ All notable changes to Blitz Strike are documented here.
|
|
|
5
5
|
The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
|
|
6
6
|
and this project adheres to [Semantic Versioning](https://semver.org/).
|
|
7
7
|
|
|
8
|
+
## [2.4.108] — 2026-09-17
|
|
9
|
+
|
|
10
|
+
### Added — surface-first map (attack surface → high-value tests)
|
|
11
|
+
|
|
12
|
+
- New `surface_map(hint)` tool + `intelligence/surface-map.json`: maps 8 attack
|
|
13
|
+
surfaces to their highest-value test cases, derived from public target-recon
|
|
14
|
+
dossiers (image proxy → SSRF/URL-bypass/XSS; redirect proxy → open-redirect/
|
|
15
|
+
SSRF/bypass; edge cache → IDOR/cache-poisoning; payment portal →
|
|
16
|
+
price-manipulation/IDOR/subscription; AI agent → prompt-injection→SSRF-RCE/
|
|
17
|
+
deser/stored-XSS; file service → XSS-via-content/SSRF/upload-RCE; Electron →
|
|
18
|
+
HTML-injection→BrowserWindow-RCE/IPC; SSO → OAuth-redirect/JWT/2FA).
|
|
19
|
+
- `matchSurfaces(techs, headers, body)` fingerprints the detected stack against
|
|
20
|
+
the map; `live_recon` now emits `suggested_surfaces` + a SURFACE-FIRST next
|
|
21
|
+
step. Added doctrine rule `surface_first` ("map surfaces before spraying
|
|
22
|
+
payloads").
|
|
23
|
+
|
|
24
|
+
## [2.4.107] — 2026-09-17
|
|
25
|
+
|
|
26
|
+
### Added — `review_harness` (per-file review, full-coverage deterministic rubric)
|
|
27
|
+
|
|
28
|
+
- New `review_harness(path)` tool implementing the "harness beats model"
|
|
29
|
+
discipline: applies a FIXED 5-signal rubric (entry_points / auth_gates /
|
|
30
|
+
sinks / secrets / logic_bugs) to EVERY enumerated source file and emits a
|
|
31
|
+
structured per-file verdict + a full-coverage report (files reviewed, clean vs
|
|
32
|
+
with-findings, per-class signal frequency). Guarantees no file is skipped and
|
|
33
|
+
every file is reviewed the same way — a COMPLETE map of the codebase, not a
|
|
34
|
+
partial scan. Most signal-dense files are sorted first.
|
|
35
|
+
|
|
36
|
+
### Fixed — scanner endpoint detection blanked string-embedded hooks
|
|
37
|
+
|
|
38
|
+
- `scanFile` matched endpoint hooks against `stripComments`, which blanks string
|
|
39
|
+
literals as well as comments — so `add_action('wp_ajax_nopriv_…')` /
|
|
40
|
+
`register_rest_route('…')` (always quoted) were never detected. Added
|
|
41
|
+
`stripCommentsOnly` (comments only, strings preserved) and matched endpoint
|
|
42
|
+
hooks against it; sinks still use the string-blanking strip. Regression-tested:
|
|
43
|
+
`wp_ajax_nopriv_` now detected.
|
|
44
|
+
|
|
8
45
|
## [2.4.106] — 2026-09-17
|
|
9
46
|
|
|
10
47
|
### Added — report assembly (metadata + vulnerability-location block)
|