blitzstrike 2.4.107 → 2.4.109
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +27 -0
- package/dist/index.js +237 -191
- package/intelligence/surface-map.json +159 -0
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -5,6 +5,33 @@ All notable changes to Blitz Strike are documented here.
|
|
|
5
5
|
The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
|
|
6
6
|
and this project adheres to [Semantic Versioning](https://semver.org/).
|
|
7
7
|
|
|
8
|
+
## [2.4.109] — 2026-09-17
|
|
9
|
+
|
|
10
|
+
### Changed — follow-the-money doctrine rule with concrete proven patterns
|
|
11
|
+
|
|
12
|
+
- Extended the `follow_money` doctrine rule with the two proven business-logic
|
|
13
|
+
shapes behind real payouts: (1) a password-reset logic flaw that resets an
|
|
14
|
+
arbitrary account → account takeover; (2) a credit/invite business-logic flaw
|
|
15
|
+
that lets the client mint its own credits/quota → free money without payment.
|
|
16
|
+
Reinforces "if the client can add credits, apply a discount, or reset a
|
|
17
|
+
credential client-side, that is the highest-value test in the program."
|
|
18
|
+
|
|
19
|
+
## [2.4.108] — 2026-09-17
|
|
20
|
+
|
|
21
|
+
### Added — surface-first map (attack surface → high-value tests)
|
|
22
|
+
|
|
23
|
+
- New `surface_map(hint)` tool + `intelligence/surface-map.json`: maps 8 attack
|
|
24
|
+
surfaces to their highest-value test cases, derived from public target-recon
|
|
25
|
+
dossiers (image proxy → SSRF/URL-bypass/XSS; redirect proxy → open-redirect/
|
|
26
|
+
SSRF/bypass; edge cache → IDOR/cache-poisoning; payment portal →
|
|
27
|
+
price-manipulation/IDOR/subscription; AI agent → prompt-injection→SSRF-RCE/
|
|
28
|
+
deser/stored-XSS; file service → XSS-via-content/SSRF/upload-RCE; Electron →
|
|
29
|
+
HTML-injection→BrowserWindow-RCE/IPC; SSO → OAuth-redirect/JWT/2FA).
|
|
30
|
+
- `matchSurfaces(techs, headers, body)` fingerprints the detected stack against
|
|
31
|
+
the map; `live_recon` now emits `suggested_surfaces` + a SURFACE-FIRST next
|
|
32
|
+
step. Added doctrine rule `surface_first` ("map surfaces before spraying
|
|
33
|
+
payloads").
|
|
34
|
+
|
|
8
35
|
## [2.4.107] — 2026-09-17
|
|
9
36
|
|
|
10
37
|
### Added — `review_harness` (per-file review, full-coverage deterministic rubric)
|