blitzstrike 2.4.115 → 2.4.116

package/CHANGELOG.md

@@ -5,29 +5,18 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
-## [2.4.115] — 2026-09-17
+## [2.4.116] — 2026-09-29
 
-### Reverted — brand guard on the CVE corpus
+### Changed — system prompt tells the LLM about the new tooling
 
-- The CVE corpus is a factual reference (CVE id → product name), so
-  competitor/vendor product names (elFinder / RevSlider / wpcf7 / ultimate-member
-  / …) are allowed there — the brand guard applies to FRAMING (README/CHANGELOG/
-  tool descriptions), not the CVE list. Removed the BRAND_GUARD filter from both
-  the sync script and the live loader; the corpus is back to 4,113 entries.
+- The LLM-facing system prompt now documents the new tools/features added this
+  cycle: `review_harness` (full-coverage 5-signal per-file rubric — run it FIRST
+  on any source repo), `broken_link_scan` (expired-domain takeover via DNS/RDAP),
+  `surface_map` (surface-first targeting), `sync_cve_corpus` (refresh the 4,000+
+  CVE fingerprint corpus), and the nuclei-derived CVE corpus behind
+  `live_recon`'s `suggested_cves`.
 
-## [2.4.114] — 2026-09-17
-
-### Fixed — brand guard in the nuclei CVE corpus
-
-- The nuclei-derived `cve-corpus.json` contained competitor/vendor product
-  names (elFinder / RevSlider / wpcf7 / ultimate-member / argus / forminator /
-  ai1wm / …) as CVE subjects. Added a BRAND_GUARD blacklist filter to both the
-  sync script (`scripts/sync-cve-corpus.py`) and the live loader
-  (`src/nuclei-corpus.ts`) so those CVEs are excluded (21 → 0); the corpus is
-  now brand-clean (4,113 → 4,092 entries). The blacklist definition itself is a
-  functional filter (like `waf_signatures.json`), not competitor framing.
-
-## [2.4.113] — 2026-09-17
+## [2.4.113] — 2026-09-29
 
 ### Added — auto-updating nuclei CVE corpus (live-read + sync tool)
 
@@ -41,7 +30,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
   or the bundled snapshot — call it before a large recon pass to pick up
   newly-disclosed CVEs.
 
-## [2.4.112] — 2026-09-17
+## [2.4.112] — 2026-09-29
 
 ### Added — nuclei-templates CVE corpus (watchlist 35 → 4,100+ fingerprints)
 
@@ -58,7 +47,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
   so a plain PHP/HTML target yields ZERO false matches — regression-tested
   (plain php → 0; vite/gradio/ollama/n8n → their specific CVEs).
 
-## [2.4.111] — 2026-09-17
+## [2.4.111] — 2026-09-29
 
 ### Added — CVE watchlist expanded 18 → 35 (2025-2026 fingerprints)
 
@@ -77,7 +66,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
   "workflow" keyword that false-positived n8n↔Kibana); regression-tested
   fingerprint precision (n8n ≠ kibana).
 
-## [2.4.110] — 2026-09-17
+## [2.4.110] — 2026-09-29
 
 ### Added — hash length extension + concrete payload enrichment
 
@@ -93,7 +82,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
   `sql_injection` (Kona-style WAF bypass: MID/LIKE//**//double-quote),
   `command_injection` (i'''d, brace expansion, Shellshock, Werkzeug debugger PIN).
 
-## [2.4.109] — 2026-09-17
+## [2.4.109] — 2026-09-29
 
 ### Changed — follow-the-money doctrine rule with concrete proven patterns
 
@@ -104,7 +93,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
   Reinforces "if the client can add credits, apply a discount, or reset a
   credential client-side, that is the highest-value test in the program."
 
-## [2.4.108] — 2026-09-17
+## [2.4.108] — 2026-09-29
 
 ### Added — surface-first map (attack surface → high-value tests)
 
@@ -120,7 +109,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
   step. Added doctrine rule `surface_first` ("map surfaces before spraying
   payloads").
 
-## [2.4.107] — 2026-09-17
+## [2.4.107] — 2026-09-29
 
 ### Added — `review_harness` (per-file review, full-coverage deterministic rubric)
 
@@ -141,7 +130,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
   hooks against it; sinks still use the string-blanking strip. Regression-tested:
   `wp_ajax_nopriv_` now detected.
 
-## [2.4.106] — 2026-09-17
+## [2.4.106] — 2026-09-29
 
 ### Added — report assembly (metadata + vulnerability-location block)
 
@@ -155,7 +144,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
   matching the report-template structure (Executive Summary → Location →
   Description → numbered Steps → Impact → Remediation → References).
 
-## [2.4.105] — 2026-09-17
+## [2.4.105] — 2026-09-29
 
 ### Added — technique depth (concrete tools + payloads in the technique base)
 
@@ -172,7 +161,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
     (alg:none / key confusion / jku-x5u / kid traversal / CVE-2022-21449).
   - `nosql_injection` — $ne/$gt/$regex/$where payloads (form + JSON) + $where RCE.
 
-## [2.4.104] — 2026-09-17
+## [2.4.104] — 2026-09-29
 
 ### Added — two client-side detectors (postMessage + client-trusted flag)
 
@@ -187,7 +176,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
   permission). Both grounded (pattern + CWE + severity + synonym + chain) and
   covered by fire-vs-clean regression checks.
 
-## [2.4.103] — 2026-09-17
+## [2.4.103] — 2026-09-29
 
 ### Added — version-precise fingerprint-first (semver narrowing)
 
@@ -199,7 +188,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
   CVE-2025-29927 (affected) but not CVE-2024-34351 (patched 14.1.1); Next.js
   15.3.0 → both excluded; unknown version → full product list (fallback).
 
-## [2.4.102] — 2026-09-17
+## [2.4.102] — 2026-09-29
 
 ### Added — `broken_link_scan` (broken-link hijacking live detector)
 
@@ -213,7 +202,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
   domain. Verified live: example.com → registered (not claimable), a
   nonexistent domain → RDAP 404 → claimable.
 
-## [2.4.101] — 2026-09-17
+## [2.4.101] — 2026-09-29
 
 ### Added — three new hunting classes (techniques + attack vectors)
 
@@ -224,7 +213,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
   how-to-test steps, concrete techniques, and verify (marker + negative
   control) — matching the existing per-class methodology shape.
 
-## [2.4.100] — 2026-09-17
+## [2.4.100] — 2026-09-29
 
 ### Fixed — data-file resolution was `process.cwd()`-dependent (broke under npx)
 
@@ -236,7 +225,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
   every other data loader (`patterns.ts`, `chains.json`, `tools-catalog.json`).
   Verified: `watchlist()` and the enterprise fixtures load from an arbitrary cwd.
 
-## [2.4.99] — 2026-09-17
+## [2.4.99] — 2026-09-29
 
 ### Fixed — grounding completeness for the CVE watchlist class tags
 
@@ -246,7 +235,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
   `hardcoded_secret`). Every one of the 18 CVE class tags now resolves to a
   grounded pattern (locked by a regression check).
 
-## [2.4.98] — 2026-09-17
+## [2.4.98] — 2026-09-29
 
 ### Added — fingerprint-first CVE matching wired into live_recon
 
@@ -257,7 +246,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
   Grafana, Keycloak, …) it names the specific CVEs to test first (with EPSS)
   instead of relying on generic scanning.
 
-## [2.4.97] — 2026-09-17
+## [2.4.97] — 2026-09-29
 
 ### Added — hunting-intel upgrade (Hacktivity-ranked CVE watchlist + dedup doctrine)
 
@@ -272,7 +261,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
   public reports) for the same endpoint/tech/vuln class before writing the
   report; the #1 cause of "Duplicate"/"N/A" rejections is not searching first.
 
-## [2.4.96] — 2026-09-17
+## [2.4.96] — 2026-09-29
 
 ### Security — self-audit (command injection + path traversal fixed)
 
@@ -287,7 +276,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 - Added regression checks: `isValidHostname` rejects shell metacharacters
   (`;`, backticks, `$()`, `|`, `../`, newlines); the identifier regex is shared.
 
-## [2.4.95] — 2026-09-17
+## [2.4.95] — 2026-09-29
 
 ### Fixed — full interconnection audit (unreachable template + 2 ungrounded classes)
 
@@ -304,7 +293,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 - `SINK_TO_VECTOR` mapped the `code_execution` sink to a non-pattern vector name;
   now maps to `command_injection` (consistent with the "code execution" synonym).
 
-## [2.4.94] — 2026-09-17
+## [2.4.94] — 2026-09-29
 
 ### Added — Hunting intel (DNS sinkhole detection + CWE/CVE watchlist)
 
@@ -321,7 +310,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
   deserialization) and flags saturated low-value ones (XSS/CSRF/open-redirect).
   Data: intelligence/watchlist.json.
 
-## [2.4.93] — 2026-09-17
+## [2.4.93] — 2026-09-29
 
 ### Fixed — reproducible verify harness (flaky wordlist test)
 
@@ -330,7 +319,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
   verify` was not reproducible. Now uses a bundled `test/fixtures/wordlist.txt` via
   the `opts.wordlist` argument — deterministic, no external wordlist required.
 
-## [2.4.92] — 2026-09-17
+## [2.4.92] — 2026-09-29
 
 ### Fixed — interconnection audit (grounding gaps + reversed PoC semantics)
 
@@ -350,7 +339,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
   detector types) to a subset invariant (every detector type grounded), so extra
   classes like command_injection don't fail it.
 
-## [2.4.91] — 2026-09-17
+## [2.4.91] — 2026-09-29
 
 ### Added — Foundry runner (execute Web3 PoC to PROVE a finding)
 
@@ -362,7 +351,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
   Deterministic differential (passes on the vulnerable contract, fails on the fixed
   one). Requires forge installed.
 
-## [2.4.90] — 2026-09-17
+## [2.4.90] — 2026-09-29
 
 ### Added — Auto-PoC (reproduction recipe generator)
 
@@ -375,7 +364,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
   open_redirect, xxe, prototype_pollution, deserialization, hardcoded_secret,
   cache_deception, cors_misconfiguration, subdomain_takeover.
 
-## [2.4.89] — 2026-09-17
+## [2.4.89] — 2026-09-29
 
 ### Added — Sibling Rule Engine (deterministic live logic-bug prober)
 
@@ -388,7 +377,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
   (4) mass assignment — role/admin field injection on POST/PUT, (5) rate limit —
   15 rapid requests. Hits-only, differential (status + body), real-time append.
 
-## [2.4.88] — 2026-09-17
+## [2.4.88] — 2026-09-29
 
 ### Changed — XSS detector precision (local taint flow)
 
@@ -398,7 +387,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
   is a direct source expression. Removes the "source + sink co-occurrence" false
   positives (4 FPs on the 30-lab benchmark) with zero recall loss.
 
-## [2.4.87] — 2026-09-17
+## [2.4.87] — 2026-09-29
 
 ### Fixed — web3 class naming consistency + jwt grounding
 
@@ -407,7 +396,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 - Added the `jwt` → `jwt_alg_confusion` synonym so the `jwt` attack-vector resolves
   to its pattern grounding + payout (previously returned no bounty signal).
 
-## [2.4.86] — 2026-09-17
+## [2.4.86] — 2026-09-29
 
 ### Added — Web3 audit extended to 13 bug classes
 
@@ -422,7 +411,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
   `initialize` assigning an address param without `!= address(0)` (CWE-20).
 - Foundry PoC templates added for both new classes; web3 severity now supports `low`.
 
-## [2.4.85] — 2026-09-17
+## [2.4.85] — 2026-09-29
 
 ### Added — CORS, XSS (DOM sinks), and subdomain-takeover detectors
 
@@ -441,7 +430,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
   updated.
 
 
-## [2.4.84] — 2026-09-17
+## [2.4.84] — 2026-09-29
 
 ### Added — hunting doctrine + always-rejected kill-list (LLM-facing methodology)
 
@@ -460,7 +449,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 reporting.md).
 
-## [2.4.83] — 2026-09-17
+## [2.4.83] — 2026-09-29
 
 ### Added — Web3 / Solidity audit (10 bug classes + Foundry PoC)
 
@@ -476,7 +465,7 @@ reporting.md).
 - `.sol` added to the scan extensions.
 
 
-## [2.4.82] — 2026-09-17
+## [2.4.82] — 2026-09-29
 
 ### Added — out-of-band (OOB) listener for blind vuln proof
 
@@ -489,7 +478,7 @@ reporting.md).
   interactsh's ANSI-colored `[INF]` banner + JSONL interaction parsing.
 
 
-## [2.4.81] — 2026-09-17
+## [2.4.81] — 2026-09-29
 
 ### Added — impact-first prioritization via typical bounty payout
 
@@ -504,7 +493,7 @@ reporting.md).
   curated PAYOUT_FALLBACK table.
 
 
-## [2.4.80] — 2026-09-17
+## [2.4.80] — 2026-09-29
 
 ### Changed — LLM-facing wiring for the two new web-class detectors
 
@@ -520,7 +509,7 @@ reporting.md).
 Full end-to-end ground: synonym_lookup → pattern_lookup (CWE + chains + bypass)
 → severity_calibrate (P1/P2) → list_chains → coverage_matrix.
 
-## [2.4.79] — 2026-09-17
+## [2.4.79] — 2026-09-29
 
 ### Changed — precision pass (FP reduction, benchmark-driven)
 
@@ -539,7 +528,7 @@ Full end-to-end ground: synonym_lookup → pattern_lookup (CWE + chains + bypass
 
 FP labs on the 30-lab benchmark dropped 16 → 8 (TP 12 unchanged).
 
-## [2.4.78] — 2026-09-17
+## [2.4.78] — 2026-09-29
 
 ### Fixed — taint-engine sanitizer name collision (whole-class FN)
 
@@ -552,7 +541,7 @@ FP labs on the 30-lab benchmark dropped 16 → 8 (TP 12 unchanged).
   string literals. Python f-string SQLi (`request.args.get -> f"{var}" -> execute`)
   is now caught.
 
-## [2.4.77] — 2026-09-17
+## [2.4.77] — 2026-09-29
 
 ### Changed — SQLi Node/Python coverage + missing_authz root-path precision
 
@@ -564,7 +553,7 @@ FP labs on the 30-lab benchmark dropped 16 → 8 (TP 12 unchanged).
 - `detectRouteAuthz` now skips root/empty paths (`@app.get("/")`) as public-by-design
   (was flagging the index route), plus `home`/`index`/`root` route segments.
 
-## [2.4.76] — 2026-09-17
+## [2.4.76] — 2026-09-29
 
 ### Fixed — config/manifest files were not scanned (whole-class FN)
 
@@ -575,7 +564,7 @@ FP labs on the 30-lab benchmark dropped 16 → 8 (TP 12 unchanged).
   `cache_deception` (nginx.conf — caught labs01) and `dependency_confusion` /
   `oauth_misconfig` / `grpc_reflection` (package.json / requirements.txt / yaml).
 
-## [2.4.75] — 2026-09-17
+## [2.4.75] — 2026-09-29
 
 ### Fixed — detection FP/FN remediation (Hackbot Arena benchmark-driven)
 
@@ -603,7 +592,7 @@ Four fixes driven by the 30-lab detection benchmark (TP/FP/FN):
    bare `FLAG` env marker, and quoted-prefix concatenations (`'usr_' + random`) so
    seeded CTF flags and runtime-built values aren't reported as CWE-798.
 
-## [2.4.74] — 2026-09-17
+## [2.4.74] — 2026-09-29
 
 ### Fixed — live_recon tech fingerprint false-positive (benchmark-driven)
 
@@ -618,7 +607,7 @@ Four fixes driven by the 30-lab detection benchmark (TP/FP/FN):
 - `gunicorn` no longer implies "flask" (it's a generic WSGI server shared by
   Flask/Django/FastAPI); only `werkzeug` maps to flask.
 
-## [2.4.73] — 2026-09-17
+## [2.4.73] — 2026-09-29
 
 ### Changed — crack_hash wordlist support (benchmark-driven fix)
 

package/dist/index.js

@@ -62640,7 +62640,7 @@ function createServer2() {
 ` + `- A hard block (Cloudflare/WAF/IP-block/captcha) is NOT the end: mark the finding blocked + note the required vantage (residential / authorized / correct-SNI / --resolve direct-to-origin), then CONTINUE to the next lead (origin bypass, non-prod cluster, mobile APK, subdomain).
 ` + `- Keep trying every lead AND every chain step until each is verified/executed or blocked, THEN generate_report. Never deliver a bare surface map, and never stop at 'found X' when X enables more.
 
-` + "TWO PATHS:\\n" + "- Source path on disk -> blitz_scan / taint_file / eagle_eye2 (static).\\n" + "- Live URL -> live_recon / active_scan / strike_verify (web-hunting).\\n\\n" + "DEEPEN A FINDING: attack_plan(target, tech, params) to get the prioritized vector plan (decide what to test next with data); list_chains (escalation), chain_links (compose), technique_lookup(cls), payload_lookup, bypass_lookup (blocked). Ground any detector hit empirically with pattern_lookup(id) — it returns the class's CWE, real-world signature, escalation chains, citable references, per-class bypass techniques, and the high-value assets (crown jewels) that class hits, so a raw hit becomes a class-aware finding. Resolve free-form terminology first with synonym_lookup(term) (IDOR/BOLA/SQLi/prompt-injection → canonical id). For an llm_injection hit, its pattern carries a validation discipline — the RUN-TWICE RULE (reproduce token-for-token across two fresh sessions), NON-GUESSABLE ANCHOR (must leak a real key/URL, not a plausible guess), and OOB PROOF (a verifiable callback log) — apply all three before reporting. BEFORE generating a report, run submission_gate(...) and only ship a finding that passes all 7 questions (reproducible, in-scope, real-impact, no-privileged-assumption, verified-live, evidence-redacted, severity-derived); one false = kill it. Generate the concrete reproduction recipe with auto_poc(type, base_url, endpoint, param) — it emits the exact marker request + negative control + expected differential + Patchstack-style title, so 'reproducible' is executable, not abstract. Calibrate severity with severity_calibrate(type, cvss) to get a P1–P5 tier + VRT-style category. Start each engagement with engagement_scaffold(target, scope) for the folder + scope.md structure, and check data_refresh() to confirm the data layers are consistent. Phase doctrine: read_skill(bs-orchestrate-engagement | bs-web-hunting | bs-source-audit | bs-verify-finding). Campaign plan: read_playbook(target-type). On any failure call retry_guidance(signal) / model_fallback(signal) before giving up. HUNTING DOCTRINE (maximize payout rate): (1) SIBLING RULE — if one endpoint requires auth, check every sibling (/export /delete /share); ~30% of paid IDOR/auth bugs come from siblings — AUTOMATE it with sibling_scan(base_url, endpoint, token_a, token_b), the deterministic live logic-bug prober (sibling enumeration + differential IDOR + auth matrix + mass assignment + rate limit, evidence-first). (2) A→B SIGNAL — a confirmed bug signals a class of developer mistake; hunt B and C (20-min box) before reporting. (3) TWO-ACCOUNT IDOR — always test with attacker account A reading victim account B, and state it in the report. (4) PoC ESCALATION — IDOR shows victim data (not 200), XSS shows cookie exfil (not alert), SSRF shows internal response (not DNS), SQLi shows DB content (not error). (5) FOLLOW THE MONEY — billing/credits/refunds/wallet flows. (6) Kill weak findings with kill_list(type) BEFORE the gate — missing headers, self-XSS, open-redirect-alone, SSRF-DNS-only, GraphQL-introspection-alone are always N/A standalone. (7) CI/CD + SAML/SSO are critical attack surfaces (pull_request_target, expression injection, XML signature wrapping, comment injection). Full doctrine: hunting_doctrine(). WHAT TO HUNT NEXT: watchlist() returns the ranked CWE frequency + high-value CVEs with payout + a saturated flag (prioritize high-freq/high-payout/not-saturated: missing-authz, SQLi, SSRF, deserialization; skip saturated XSS/CSRF/open-redirect unless they chain into takeover). PRECISION GUARD: resolve_check(host) detects when an ISP/country redirects the domain to a blocking/sinkhole page (gambling/adult/streaming niches) — audit the PUBLIC IP, never the sinkhole.\n" + "KNOWLEDGE BASE (discover, don't guess): skillLookup(topic) / listSkills for the 40 attack-path + hunting skills (ap-*, hp-*, bs-*); list_attack_vectors / attack_vectors(cat) for the 34-category vector taxonomy; taxonomy(kind) for OWASP/CWE/ASVS/API-top-10; read_playbook(type) for the 17 campaign playbooks; list_manuals / read_tool_manual for 317 tool references; list_tools / run_catalog_tool for the 141-tool catalog. Every tool, skill, and data layer is reachable from these. CROSS-TARGET INTELLIGENCE: strike_resolve auto-records confirmed/false_positive verdicts into the empirical ledger; query it with intelligence(action=hit_rates/top_vectors/recall) so a new target on a known tech inherits historical hit-rates (attack_plan already blends them into success_probability). intelligence(action=recall, tech, target) is the per-engagement pattern recall — it returns which patterns historically CONFIRMED on that tech (prioritize them) versus which only ever produced false positives (avoid them), so a new engagement starts from the empirical playbook of past ones. LIVE PENTEST + TARGETING (black-box, WAF-safe): cache_gap(base_url, endpoint) fuzzes path-normalization + static-extension variants for cache deception/poisoning; blind_oracle(base_url, param, value) detects which SINK a param reaches (sql/ssti/xss) via benign arithmetic (id=1+0, test${7*7}) WITHOUT a malicious payload; param_precedence(base_url, param, A, B) maps duplicate-parameter precedence (first/last-wins) for WAF-bypass. OOB (out-of-band) PROOF for BLIND vulns: oob_start() spins an interactsh listener (unique *.oast.* domain, streams DNS/HTTP interactions — the standard for public targets) or a local HTTP listener for local labs; inject the canary, then oob_poll(id) until the hit arrives; oob_stop(id) to clean up. A blind SSRF/XXE/SQLi/command-injection is CONFIRMED only when the canary actually arrives — never from a guess. SOURCE TARGETING: action_surface(code) maps every wp_ajax_* action to its vuln class + DERIVED priority (what to look for WHERE); security_state(sanitizers, sink) gives a wrong-context sanitization verdict; framework_knowledge(framework) returns auth/nonce primitives for 9 frameworks; variant_scan(root, signature) mass-sweeps an install base for ONE bug family; patch_analyze(old, new) REVERSES a security patch into the 0-day, and its mine_signature feeds variant_scan to sweep unpatched copies. All of these are DETECTION HINTS — verify each live (strike_verify / browser_validate) before it enters the report. NEWEST DETECTORS — understand AND try them: variant_scan also emits priv_esc (privilege escalation — a role/capability/user change fed by request input, traced cross-file via reverse call-graph, e.g. set_role($id, sanitize_key($_POST['um-role'])) or update_user_meta(...,'wp_capabilities', $_POST[...])) and flags uploadAllow=>array('all') unrestricted-upload configs as file_upload (the file-manager/connector shape). TO TRY a priv_esc hit: submit the role field with 'administrator' (or send wp_capabilities meta) and confirm the account actually gains admin. TO TRY an unrestricted-upload hit: POST a .php/.phtml and confirm it lands web-reachable + executes. variant_scan also emits hardcoded_secret (CWE-798) in three tiers: a secret field (api_key/db_password/access_token/aws_*) assigned a literal (HIGH), a known secret FORMAT (JWT eyJ…/AWS AKIA…/GitHub ghp_…/Slack xoxb-…/…) regardless of name (HIGH), or a high-entropy suspect token (MEDIUM — verify before reporting). Verify a frontend/JS secret live via drive_devtools (inspect the JS bundle / network response and confirm the key is actually exposed), and for a backend secret confirm it is reachable/valid. A static hit is a HYPOTHESIS until verified live — never report unverified. For a repo, also scan_git_history(root) — secrets DELETED from HEAD still live in .git history (the removed-later-is-not-fixed trap), and it feeds every recovered pre-deletion blob through the same secret detector. Once you recover a credential, prove it is still ACTIVE with validate_leaked_key(apiBase, endpoints, key|blobUrl) — a READ-ONLY differential test (401-without-key vs 200-with-key = auth bypass PROVEN). Two supply-chain detectors: dependency_confusion (a manifest/build file resolving a package from a public registry — pypi.org/npmjs.org --extra-index-url, or a scoped @company/pkg with no private registry) and ml_supply_chain (torch.load without weights_only=True / joblib.load / np.load(allow_pickle=True) / keras load_model on an untrusted model → pickle RCE). Rust is supported end-to-end: the taint engine (blitz_scan / taint_file) maps Rust sinks (std::process::Command, sqlx/diesel, reqwest/hyper, std::fs, serde/bincode) to the classic classes, plus two Rust-specific detectors — rust_unsafe (transmute / assume_init / from_raw_parts / ptr::* — memory-unsafety surface, CWE-119) and rust_format_string (println!/format! with a variable as the format string — CWE-134). The sqlx query! compile-time macro is treated as safe (suppressed). Two more web-class detectors: jwt_alg_confusion (a JWT verifier that dispatches on the token's alg header and accepts BOTH RS256 and HS256, with the HS256 HMAC secret derived from public/shared key material — CWE-347; the attacker sets alg=HS256 and signs with the public key to forge admin tokens) and cache_deception (a reverse proxy caching static-extension URLs with a cache key that omits the session cookie, over a session-authenticated backend — CWE-525; the victim's cached private response is re-fetched anonymously). TO TRY a jwt_alg_confusion hit: fetch the public key (/.well-known/jwks.json), forge an HS256 token signed with that public key, and confirm admin access. TO TRY a cache_deception hit: request an authenticated path with a static extension appended (.css/.js) and re-fetch it anonymously. Three more detectors: cors_misconfiguration (Access-Control-Allow-Origin reflects the request Origin or is '*' while credentials are true — CWE-942; any site reads the victim's authenticated responses), xss (user input into a DOM sink — innerHTML / dangerouslySetInnerHTML / document.write / .html() / eval — CWE-79), and subdomain_takeover (a dangling CNAME/AliasTarget to a claimable service like *.github.io/*.herokuapp.com/*.amazonaws.com — CWE-404). TO TRY a cors hit: send an evil Origin + confirm the response echoes it with Allow-Credentials:true. TO TRY an xss hit: confirm the sink executes (drive_devtools). TO TRY a takeover hit: verify the CNAME target resolves to an unclaimed/not-found page. Two more client-side detectors: postmessage_no_origin_check (a window message listener that reads event.data but never validates event.origin — CWE-345; any site can drive the handler) and client_trusted_flag (a privilege/entitlement flag like isAdmin/withVip/premium read from request input and used in a security decision — CWE-807/639; derive the flag from server state, never the client). TO TRY a postMessage hit: send a crafted message from an attacker origin and confirm the handler acts on it. TO TRY a client-trusted-flag hit: flip the flag param to true and confirm the privilege is actually granted. WEB3: for Solidity/EVM, call web3_audit(code|path) — a deterministic 13-class smart-contract audit (reentrancy incl. ERC721/ERC1155 callback reentrancy, unchecked return, unchecked arithmetic, tx.origin auth, signature replay, unprotected selfdestruct, delegatecall-to-user-input, missing access control, timestamp dependence, spot-price oracle manipulation incl. slot0/latestRoundData, unbounded loop, abi.encodePacked hash collision, missing address(0) validation) returning ranked findings (class/CWE/severity/line), then foundry_poc(class, contract) to generate an executable Foundry test, and foundry_run(contract_code, poc_code|class_) to actually EXECUTE it — a PASSING PoC test is the proof that the exploit reproduces (deterministic: forge's own test verdict). A web3 hit is a HYPOTHESIS until the Foundry PoC reproduces it.\n" + `PRECISION ANALYSIS — chrome-devtools MCP is MANDATORY, not optional:
+` + "TWO PATHS:\\n" + "- Source path on disk -> blitz_scan / taint_file / eagle_eye2 (static).\\n" + "- Live URL -> live_recon / active_scan / strike_verify (web-hunting).\\n\\n" + "DEEPEN A FINDING: attack_plan(target, tech, params) to get the prioritized vector plan (decide what to test next with data); list_chains (escalation), chain_links (compose), technique_lookup(cls), payload_lookup, bypass_lookup (blocked). Ground any detector hit empirically with pattern_lookup(id) — it returns the class's CWE, real-world signature, escalation chains, citable references, per-class bypass techniques, and the high-value assets (crown jewels) that class hits, so a raw hit becomes a class-aware finding. Resolve free-form terminology first with synonym_lookup(term) (IDOR/BOLA/SQLi/prompt-injection → canonical id). For an llm_injection hit, its pattern carries a validation discipline — the RUN-TWICE RULE (reproduce token-for-token across two fresh sessions), NON-GUESSABLE ANCHOR (must leak a real key/URL, not a plausible guess), and OOB PROOF (a verifiable callback log) — apply all three before reporting. BEFORE generating a report, run submission_gate(...) and only ship a finding that passes all 7 questions (reproducible, in-scope, real-impact, no-privileged-assumption, verified-live, evidence-redacted, severity-derived); one false = kill it. Generate the concrete reproduction recipe with auto_poc(type, base_url, endpoint, param) — it emits the exact marker request + negative control + expected differential + Patchstack-style title, so 'reproducible' is executable, not abstract. Calibrate severity with severity_calibrate(type, cvss) to get a P1–P5 tier + VRT-style category. Start each engagement with engagement_scaffold(target, scope) for the folder + scope.md structure, and check data_refresh() to confirm the data layers are consistent. Phase doctrine: read_skill(bs-orchestrate-engagement | bs-web-hunting | bs-source-audit | bs-verify-finding). Campaign plan: read_playbook(target-type). On any failure call retry_guidance(signal) / model_fallback(signal) before giving up. HUNTING DOCTRINE (maximize payout rate): (1) SIBLING RULE — if one endpoint requires auth, check every sibling (/export /delete /share); ~30% of paid IDOR/auth bugs come from siblings — AUTOMATE it with sibling_scan(base_url, endpoint, token_a, token_b), the deterministic live logic-bug prober (sibling enumeration + differential IDOR + auth matrix + mass assignment + rate limit, evidence-first). (2) A→B SIGNAL — a confirmed bug signals a class of developer mistake; hunt B and C (20-min box) before reporting. (3) TWO-ACCOUNT IDOR — always test with attacker account A reading victim account B, and state it in the report. (4) PoC ESCALATION — IDOR shows victim data (not 200), XSS shows cookie exfil (not alert), SSRF shows internal response (not DNS), SQLi shows DB content (not error). (5) FOLLOW THE MONEY — billing/credits/refunds/wallet flows. (6) Kill weak findings with kill_list(type) BEFORE the gate — missing headers, self-XSS, open-redirect-alone, SSRF-DNS-only, GraphQL-introspection-alone are always N/A standalone. (7) CI/CD + SAML/SSO are critical attack surfaces (pull_request_target, expression injection, XML signature wrapping, comment injection). Full doctrine: hunting_doctrine(). WHAT TO HUNT NEXT: watchlist() returns the ranked CWE frequency + high-value CVEs with payout + a saturated flag (prioritize high-freq/high-payout/not-saturated: missing-authz, SQLi, SSRF, deserialization; skip saturated XSS/CSRF/open-redirect unless they chain into takeover). The CVE watchlist now spans 4,000+ product fingerprints (live from nuclei-templates when installed — refresh with sync_cve_corpus() before a big recon pass); live_recon's suggested_cves names the SPECIFIC CVE for the detected product/version. SURFACE-FIRST: surface_map(surface) maps an attack surface (image/redirect proxy, edge cache, payment portal, AI agent, file service, Electron, SSO) to its highest-value tests — map surfaces then test, don't spray payloads. PRECISION GUARD: resolve_check(host) detects when an ISP/country redirects the domain to a blocking/sinkhole page (gambling/adult/streaming niches) — audit the PUBLIC IP, never the sinkhole.\n" + "KNOWLEDGE BASE (discover, don't guess): skillLookup(topic) / listSkills for the 40 attack-path + hunting skills (ap-*, hp-*, bs-*); list_attack_vectors / attack_vectors(cat) for the 34-category vector taxonomy; taxonomy(kind) for OWASP/CWE/ASVS/API-top-10; read_playbook(type) for the 17 campaign playbooks; list_manuals / read_tool_manual for 317 tool references; list_tools / run_catalog_tool for the 141-tool catalog. Every tool, skill, and data layer is reachable from these. CROSS-TARGET INTELLIGENCE: strike_resolve auto-records confirmed/false_positive verdicts into the empirical ledger; query it with intelligence(action=hit_rates/top_vectors/recall) so a new target on a known tech inherits historical hit-rates (attack_plan already blends them into success_probability). intelligence(action=recall, tech, target) is the per-engagement pattern recall — it returns which patterns historically CONFIRMED on that tech (prioritize them) versus which only ever produced false positives (avoid them), so a new engagement starts from the empirical playbook of past ones. LIVE PENTEST + TARGETING (black-box, WAF-safe): cache_gap(base_url, endpoint) fuzzes path-normalization + static-extension variants for cache deception/poisoning; blind_oracle(base_url, param, value) detects which SINK a param reaches (sql/ssti/xss) via benign arithmetic (id=1+0, test${7*7}) WITHOUT a malicious payload; param_precedence(base_url, param, A, B) maps duplicate-parameter precedence (first/last-wins) for WAF-bypass; broken_link_scan(url) detects expired-domain takeover (crawls outbound refs → DNS/RDAP → flags claimable domains). OOB (out-of-band) PROOF for BLIND vulns: oob_start() spins an interactsh listener (unique *.oast.* domain, streams DNS/HTTP interactions — the standard for public targets) or a local HTTP listener for local labs; inject the canary, then oob_poll(id) until the hit arrives; oob_stop(id) to clean up. A blind SSRF/XXE/SQLi/command-injection is CONFIRMED only when the canary actually arrives — never from a guess. SOURCE TARGETING: review_harness(path) FIRST for full coverage — it applies a fixed 5-signal rubric (entry_points/auth_gates/sinks/secrets/logic_bugs) to EVERY source file and sorts the signal-dense ones first (a complete map, not a partial scan); then action_surface(code) maps every wp_ajax_* action to its vuln class + DERIVED priority (what to look for WHERE); security_state(sanitizers, sink) gives a wrong-context sanitization verdict; framework_knowledge(framework) returns auth/nonce primitives for 9 frameworks; variant_scan(root, signature) mass-sweeps an install base for ONE bug family; patch_analyze(old, new) REVERSES a security patch into the 0-day, and its mine_signature feeds variant_scan to sweep unpatched copies. All of these are DETECTION HINTS — verify each live (strike_verify / browser_validate) before it enters the report. NEWEST DETECTORS — understand AND try them: variant_scan also emits priv_esc (privilege escalation — a role/capability/user change fed by request input, traced cross-file via reverse call-graph, e.g. set_role($id, sanitize_key($_POST['um-role'])) or update_user_meta(...,'wp_capabilities', $_POST[...])) and flags uploadAllow=>array('all') unrestricted-upload configs as file_upload (the file-manager/connector shape). TO TRY a priv_esc hit: submit the role field with 'administrator' (or send wp_capabilities meta) and confirm the account actually gains admin. TO TRY an unrestricted-upload hit: POST a .php/.phtml and confirm it lands web-reachable + executes. variant_scan also emits hardcoded_secret (CWE-798) in three tiers: a secret field (api_key/db_password/access_token/aws_*) assigned a literal (HIGH), a known secret FORMAT (JWT eyJ…/AWS AKIA…/GitHub ghp_…/Slack xoxb-…/…) regardless of name (HIGH), or a high-entropy suspect token (MEDIUM — verify before reporting). Verify a frontend/JS secret live via drive_devtools (inspect the JS bundle / network response and confirm the key is actually exposed), and for a backend secret confirm it is reachable/valid. A static hit is a HYPOTHESIS until verified live — never report unverified. For a repo, also scan_git_history(root) — secrets DELETED from HEAD still live in .git history (the removed-later-is-not-fixed trap), and it feeds every recovered pre-deletion blob through the same secret detector. Once you recover a credential, prove it is still ACTIVE with validate_leaked_key(apiBase, endpoints, key|blobUrl) — a READ-ONLY differential test (401-without-key vs 200-with-key = auth bypass PROVEN). Two supply-chain detectors: dependency_confusion (a manifest/build file resolving a package from a public registry — pypi.org/npmjs.org --extra-index-url, or a scoped @company/pkg with no private registry) and ml_supply_chain (torch.load without weights_only=True / joblib.load / np.load(allow_pickle=True) / keras load_model on an untrusted model → pickle RCE). Rust is supported end-to-end: the taint engine (blitz_scan / taint_file) maps Rust sinks (std::process::Command, sqlx/diesel, reqwest/hyper, std::fs, serde/bincode) to the classic classes, plus two Rust-specific detectors — rust_unsafe (transmute / assume_init / from_raw_parts / ptr::* — memory-unsafety surface, CWE-119) and rust_format_string (println!/format! with a variable as the format string — CWE-134). The sqlx query! compile-time macro is treated as safe (suppressed). Two more web-class detectors: jwt_alg_confusion (a JWT verifier that dispatches on the token's alg header and accepts BOTH RS256 and HS256, with the HS256 HMAC secret derived from public/shared key material — CWE-347; the attacker sets alg=HS256 and signs with the public key to forge admin tokens) and cache_deception (a reverse proxy caching static-extension URLs with a cache key that omits the session cookie, over a session-authenticated backend — CWE-525; the victim's cached private response is re-fetched anonymously). TO TRY a jwt_alg_confusion hit: fetch the public key (/.well-known/jwks.json), forge an HS256 token signed with that public key, and confirm admin access. TO TRY a cache_deception hit: request an authenticated path with a static extension appended (.css/.js) and re-fetch it anonymously. Three more detectors: cors_misconfiguration (Access-Control-Allow-Origin reflects the request Origin or is '*' while credentials are true — CWE-942; any site reads the victim's authenticated responses), xss (user input into a DOM sink — innerHTML / dangerouslySetInnerHTML / document.write / .html() / eval — CWE-79), and subdomain_takeover (a dangling CNAME/AliasTarget to a claimable service like *.github.io/*.herokuapp.com/*.amazonaws.com — CWE-404). TO TRY a cors hit: send an evil Origin + confirm the response echoes it with Allow-Credentials:true. TO TRY an xss hit: confirm the sink executes (drive_devtools). TO TRY a takeover hit: verify the CNAME target resolves to an unclaimed/not-found page. Two more client-side detectors: postmessage_no_origin_check (a window message listener that reads event.data but never validates event.origin — CWE-345; any site can drive the handler) and client_trusted_flag (a privilege/entitlement flag like isAdmin/withVip/premium read from request input and used in a security decision — CWE-807/639; derive the flag from server state, never the client). TO TRY a postMessage hit: send a crafted message from an attacker origin and confirm the handler acts on it. TO TRY a client-trusted-flag hit: flip the flag param to true and confirm the privilege is actually granted. WEB3: for Solidity/EVM, call web3_audit(code|path) — a deterministic 13-class smart-contract audit (reentrancy incl. ERC721/ERC1155 callback reentrancy, unchecked return, unchecked arithmetic, tx.origin auth, signature replay, unprotected selfdestruct, delegatecall-to-user-input, missing access control, timestamp dependence, spot-price oracle manipulation incl. slot0/latestRoundData, unbounded loop, abi.encodePacked hash collision, missing address(0) validation) returning ranked findings (class/CWE/severity/line), then foundry_poc(class, contract) to generate an executable Foundry test, and foundry_run(contract_code, poc_code|class_) to actually EXECUTE it — a PASSING PoC test is the proof that the exploit reproduces (deterministic: forge's own test verdict). A web3 hit is a HYPOTHESIS until the Foundry PoC reproduces it.\n" + `PRECISION ANALYSIS — chrome-devtools MCP is MANDATORY, not optional:
 ` + `- When a lead needs DOM/JS precision — DOM-XSS sink execution, AJAX endpoint + payload interception, JS runtime errors, redirect chains, SSO/token flow, or anything a static HTML glance cannot prove — call drive_devtools(target). It spawns chrome-devtools-mcp and drives a REAL headless browser (navigate -> list_network_requests -> list_console_messages -> evaluate_script), giving reproducible evidence instead of a guess.
 ` + `- Before calling it, check_mcp() to confirm the browser MCP is available; if not, blitzstrike install-tools or npm i -g chrome-devtools-mcp. Never substitute eyeballing minified JS or a static sink guess when a live browser can PROVE it. This is the precision + consistency layer.
 ` + "EXTERNAL MCP SERVERS (verified, connect them — NOT one-shot CLIs): chrome-devtools-mcp (29 tools: list_network_requests/get_network_request for raw HTTP interception, list_console_messages for JS errors + DOM-XSS, evaluate_script to run JS, take_screenshot) -> stdio chrome-devtools-mcp --headless --chromeArg=--no-sandbox --chromeArg=--disable-gpu (as root/container this is MANDATORY or the browser crashes; add --proxyServer http://127.0.0.1:8080 to route through Burp, --acceptInsecureCerts for bad TLS). burp-suite-mcp (proxy history + active scan + repeater) -> NOT npm: build the JAR (git clone https://github.com/PortSwigger/mcp-server.git && cd mcp-server && ./gradlew embedProxyJar), load it in Burp Extensions, then connect the client to http://127.0.0.1:9876 (SSE) or the stdio proxy java -jar mcp-proxy-all.jar --sse-url http://127.0.0.1:9876."

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.115",
+  "version": "2.4.116",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {