blitzstrike 2.4.107 → 2.4.109
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +27 -0
- package/dist/index.js +237 -191
- package/intelligence/surface-map.json +159 -0
- package/package.json +1 -1
|
@@ -0,0 +1,159 @@
|
|
|
1
|
+
{
|
|
2
|
+
"surfaces": [
|
|
3
|
+
{
|
|
4
|
+
"id": "image_proxy",
|
|
5
|
+
"name": "Image proxy / URL-rewrite service",
|
|
6
|
+
"fingerprints": [
|
|
7
|
+
"imgproxy",
|
|
8
|
+
"image proxy",
|
|
9
|
+
"url unfurling",
|
|
10
|
+
"image resize",
|
|
11
|
+
"?url=",
|
|
12
|
+
"slack-imgs",
|
|
13
|
+
"image-resize",
|
|
14
|
+
"proxy.php?url"
|
|
15
|
+
],
|
|
16
|
+
"high_value_tests": [
|
|
17
|
+
"SSRF \u2014 the url= param reaches the proxy; point it at 169.254.169.254 or an internal range",
|
|
18
|
+
"URL validation bypass \u2014 encoded/internal-scheme (file://, gopher://, 127.0.0.1) variants",
|
|
19
|
+
"XSS via image content \u2014 SVG/HTML payloads rendered inline"
|
|
20
|
+
]
|
|
21
|
+
},
|
|
22
|
+
{
|
|
23
|
+
"id": "redirect_proxy",
|
|
24
|
+
"name": "URL redirect / safety proxy",
|
|
25
|
+
"fingerprints": [
|
|
26
|
+
"redirect",
|
|
27
|
+
"safety proxy",
|
|
28
|
+
"redir",
|
|
29
|
+
"url shortener",
|
|
30
|
+
"outbound link",
|
|
31
|
+
"?to=",
|
|
32
|
+
"?redirect=",
|
|
33
|
+
"?url="
|
|
34
|
+
],
|
|
35
|
+
"high_value_tests": [
|
|
36
|
+
"Open redirect \u2014 bypass the safety check to cloak phishing links",
|
|
37
|
+
"SSRF \u2014 the proxy fetches the target URL server-side",
|
|
38
|
+
"URL validation bypass \u2014 scheme/domain confusion (//, @, encoded chars)"
|
|
39
|
+
]
|
|
40
|
+
},
|
|
41
|
+
{
|
|
42
|
+
"id": "edge_cache",
|
|
43
|
+
"name": "Edge cache / entity data service",
|
|
44
|
+
"fingerprints": [
|
|
45
|
+
"edge",
|
|
46
|
+
"cache",
|
|
47
|
+
"conditional fetch",
|
|
48
|
+
"timestamp",
|
|
49
|
+
"entity",
|
|
50
|
+
"flannel",
|
|
51
|
+
"graphql"
|
|
52
|
+
],
|
|
53
|
+
"high_value_tests": [
|
|
54
|
+
"IDOR \u2014 read other entities (user/channel/tenant) by id without auth",
|
|
55
|
+
"Cache poisoning \u2014 inject a key that serves attacker content to other users",
|
|
56
|
+
"Unauthorized entity enumeration \u2014 bulk read via timestamp/resource pattern"
|
|
57
|
+
]
|
|
58
|
+
},
|
|
59
|
+
{
|
|
60
|
+
"id": "payment_portal",
|
|
61
|
+
"name": "Payment / billing portal",
|
|
62
|
+
"fingerprints": [
|
|
63
|
+
"payment",
|
|
64
|
+
"billing",
|
|
65
|
+
"checkout",
|
|
66
|
+
"invoice",
|
|
67
|
+
"subscription",
|
|
68
|
+
"stripe",
|
|
69
|
+
"paypal",
|
|
70
|
+
"braintree",
|
|
71
|
+
"plan",
|
|
72
|
+
"pricing"
|
|
73
|
+
],
|
|
74
|
+
"high_value_tests": [
|
|
75
|
+
"Price/amount manipulation \u2014 alter the client-side total before checkout",
|
|
76
|
+
"IDOR on invoices/payment records \u2014 read or modify other users' billing",
|
|
77
|
+
"Subscription tampering \u2014 upgrade/entitlement without payment",
|
|
78
|
+
"Auth bypass on checkout/order endpoints"
|
|
79
|
+
]
|
|
80
|
+
},
|
|
81
|
+
{
|
|
82
|
+
"id": "ai_agent",
|
|
83
|
+
"name": "AI agent / no-code app builder",
|
|
84
|
+
"fingerprints": [
|
|
85
|
+
"agent",
|
|
86
|
+
"ai",
|
|
87
|
+
"llm",
|
|
88
|
+
"no-code",
|
|
89
|
+
"builder",
|
|
90
|
+
"prompt",
|
|
91
|
+
"gpt",
|
|
92
|
+
"assistant",
|
|
93
|
+
"horizons"
|
|
94
|
+
],
|
|
95
|
+
"high_value_tests": [
|
|
96
|
+
"Prompt injection \u2192 SSRF / RCE / data exfiltration via tool-call abuse",
|
|
97
|
+
"Insecure deserialization of tool-call arguments",
|
|
98
|
+
"Stored XSS in agent-generated output rendered in the dashboard"
|
|
99
|
+
]
|
|
100
|
+
},
|
|
101
|
+
{
|
|
102
|
+
"id": "file_service",
|
|
103
|
+
"name": "File upload / download service",
|
|
104
|
+
"fingerprints": [
|
|
105
|
+
"file",
|
|
106
|
+
"upload",
|
|
107
|
+
"download",
|
|
108
|
+
"supra",
|
|
109
|
+
"miata",
|
|
110
|
+
"attachment",
|
|
111
|
+
"?file=",
|
|
112
|
+
"?download="
|
|
113
|
+
],
|
|
114
|
+
"high_value_tests": [
|
|
115
|
+
"XSS via file content \u2014 SVG/HTML served inline",
|
|
116
|
+
"SSRF via file URL / remote file fetch",
|
|
117
|
+
"Upload \u2192 RCE \u2014 executable file landing web-reachable"
|
|
118
|
+
]
|
|
119
|
+
},
|
|
120
|
+
{
|
|
121
|
+
"id": "electron_desktop",
|
|
122
|
+
"name": "Electron / desktop app",
|
|
123
|
+
"fingerprints": [
|
|
124
|
+
"electron",
|
|
125
|
+
"browserwindow",
|
|
126
|
+
"desktop",
|
|
127
|
+
"chromium",
|
|
128
|
+
"node.js desktop",
|
|
129
|
+
"app.asar"
|
|
130
|
+
],
|
|
131
|
+
"high_value_tests": [
|
|
132
|
+
"HTML injection \u2192 BrowserWindow RCE (nodeIntegration + remote content)",
|
|
133
|
+
"Insecure IPC / preload bridge \u2014 expose privileged APIs to renderer",
|
|
134
|
+
"Remote content loading \u2014 hot-update/CDN resources replaced"
|
|
135
|
+
]
|
|
136
|
+
},
|
|
137
|
+
{
|
|
138
|
+
"id": "auth_sso",
|
|
139
|
+
"name": "Authentication / SSO portal",
|
|
140
|
+
"fingerprints": [
|
|
141
|
+
"auth",
|
|
142
|
+
"sso",
|
|
143
|
+
"oauth",
|
|
144
|
+
"saml",
|
|
145
|
+
"login",
|
|
146
|
+
"passport",
|
|
147
|
+
"jwt",
|
|
148
|
+
"token",
|
|
149
|
+
"signin"
|
|
150
|
+
],
|
|
151
|
+
"high_value_tests": [
|
|
152
|
+
"OAuth open redirect via redirect_uri manipulation",
|
|
153
|
+
"JWT alg:none / weak secret / missing expiry",
|
|
154
|
+
"Token leakage / account enumeration / 2FA bypass"
|
|
155
|
+
]
|
|
156
|
+
}
|
|
157
|
+
],
|
|
158
|
+
"note": "Generalized attack-surface \u2192 high-value-test map, derived from public target-recon dossiers. Each surface is matched by fingerprint keywords against the detected tech stack/headers/body; when a surface is present, test its high-value cases FIRST (surface-first, not payload-spraying)."
|
|
159
|
+
}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "blitzstrike",
|
|
3
|
-
"version": "2.4.
|
|
3
|
+
"version": "2.4.109",
|
|
4
4
|
"description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"bin": {
|