blitzstrike 2.4.119 → 2.4.121

package/CHANGELOG.md

@@ -5,6 +5,34 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.121] — 2026-09-29
+
+### Added — empirical ledger auto-feed + benchmark coverage 30/30
+
+- The live probers now auto-record their VERIFIED verdicts into the empirical
+  ledger (`intelligence()`): `cve_verify`/`nuclei_scan` (vector "cve"),
+  `jwt_forge` (jwt_alg_confusion), `proto_pollution_probe`
+  (prototype_pollution), `smuggling_test` (http_request_smuggling) — so a
+  confirmed hit feeds attack_plan's Bayesian hit-rates cross-target.
+- Updated the Hackbot-Arena VECTOR_MAP with the new detectors + live probers
+  (cache_deception, client_trusted_flag, jwt_alg_confusion, prototype_pollution,
+  request-smuggling, password-reset) → detector coverage 26/30 → 30/30 (the 4
+  previously-unmapped labs — CacheKey, PasswordResetHarm, StaffDirectory,
+  NoteLock — are now covered).
+
+## [2.4.120] — 2026-09-29
+
+### Added — `nuclei_scan` (fingerprint-driven full DAST) + corpus precision fix
+
+- New `nuclei_scan(target, tech?, tags?, broad?)`: fingerprint the stack (or use
+  the tech you pass), select the fingerprint-matched CVE templates + (broad mode)
+  tech-tag templates, run nuclei rate-limited (critical/high/medium), and return
+  deduped severity-ranked findings — the "scan this target" automation that
+  completes corpus → cve_verify → full DAST. (153 MCP tools.)
+- Tightened the CVE-corpus GENERIC token filter (server/and/domain/check/…) so a
+  generic stack (plain PHP, bare `Server:` header, "Example Domain" page) yields
+  ZERO false CVE matches — regression-tested (example.com → 0).
+
 ## [2.4.119] — 2026-09-29
 
 ### Security — lodash / lodash-es dependency vulnerabilities fixed

package/dist/index.js

@@ -32714,7 +32714,7 @@ class StdioServerTransport {
 // src/server.ts
 init_scanner();
 import { readFileSync as readFileSync31 } from "node:fs";
-import { execFileSync as execFileSync7 } from "node:child_process";
+import { execFileSync as execFileSync8 } from "node:child_process";
 
 // src/review-harness.ts
 init_scanner();
@@ -36487,7 +36487,75 @@ var GENERIC = new Set([
   "use",
   "run",
   "top",
-  "new"
+  "new",
+  "server",
+  "and",
+  "or",
+  "the",
+  "a",
+  "an",
+  "for",
+  "with",
+  "via",
+  "from",
+  "into",
+  "to",
+  "of",
+  "on",
+  "in",
+  "is",
+  "are",
+  "as",
+  "at",
+  "by",
+  "it",
+  "its",
+  "this",
+  "that",
+  "these",
+  "those",
+  "mod",
+  "proxy",
+  "gateway",
+  "adc",
+  "not",
+  "no",
+  "yes",
+  "up",
+  "out",
+  "domain",
+  "check",
+  "report",
+  "reports",
+  "system",
+  "tool",
+  "tools",
+  "management",
+  "monitor",
+  "advanced",
+  "basic",
+  "standard",
+  "lite",
+  "pro",
+  "plus",
+  "main",
+  "feature",
+  "features",
+  "options",
+  "settings",
+  "action",
+  "actions",
+  "type",
+  "types",
+  "name",
+  "names",
+  "value",
+  "values",
+  "field",
+  "fields",
+  "id",
+  "key",
+  "keys"
 ]);
 function tokens(text) {
   const out = [];
@@ -59711,18 +59779,22 @@ function load5() {
   }
 }
 var VECTOR_MAP = [
-  { re: /jwt|algorithm confusion|rs256|hs256/i, vectors: ["jwt"], detectors: ["missing_authz"], chains: ["jwt"], tools: ["jwt_analyze", "live_recon"] },
+  { re: /jwt|algorithm confusion|rs256|hs256/i, vectors: ["jwt"], detectors: ["missing_authz", "jwt_alg_confusion"], chains: ["jwt"], tools: ["jwt_analyze", "jwt_forge", "live_recon"] },
   { re: /ssrf|server-side request/i, vectors: ["ssrf"], detectors: ["ssrf"], chains: ["ssrf"], tools: ["live_recon", "blind_oracle", "active_scan"] },
   { re: /sql injection|sqli|postgresql|sql/i, vectors: ["sql_injection"], detectors: ["sql_injection"], chains: ["sql_injection"], tools: ["live_recon", "blind_oracle", "active_scan"] },
   { re: /ssti|template injection|liquid|jinja|twig/i, vectors: ["ssti"], detectors: ["ssti"], chains: ["ssti"], tools: ["live_recon", "blind_oracle"] },
   { re: /command injection|os command|command execution/i, vectors: ["command_injection"], detectors: ["command_injection"], chains: ["command_injection"], tools: ["live_recon", "blind_oracle"] },
-  { re: /idor|bola|authorization|broken function|role|membership|ownership|entitlement|directory search|excessive data|data exposure|harvest/i, vectors: ["broken_object_level_authorization"], detectors: ["missing_authz"], chains: ["idor"], tools: ["live_recon", "active_scan", "param_precedence"] },
+  { re: /idor|bola|authorization|broken function|role|membership|ownership|entitlement|directory search|excessive data|data exposure|harvest|substring|search|disclosure/i, vectors: ["broken_object_level_authorization"], detectors: ["missing_authz"], chains: ["idor"], tools: ["live_recon", "active_scan", "param_precedence", "sibling_scan"] },
   { re: /graphql/i, vectors: ["graphql_exposure"], detectors: ["graphql_exposure", "sql_injection"], chains: ["graphql"], tools: ["live_recon", "active_scan"] },
-  { re: /cache/i, vectors: ["web_cache_deception"], detectors: [], chains: ["cache_deception"], tools: ["cache_gap", "live_recon"] },
+  { re: /cache/i, vectors: ["web_cache_deception"], detectors: ["cache_deception"], chains: ["cache_deception"], tools: ["cache_gap", "live_recon"] },
   { re: /credential|key|token|bearer|secret|leak|websocket|rum|api key/i, vectors: ["hardcoded_secret"], detectors: ["hardcoded_secret"], chains: ["secret_leak"], tools: ["live_recon", "drive_devtools", "scan_git_history"] },
   { re: /rate.limit|batching|otp/i, vectors: ["business_logic"], detectors: [], chains: ["rate_limit_bypass"], tools: ["race_test", "active_scan"] },
   { re: /mass assignment|self.regist|admin account|user creation|scope/i, vectors: ["mass_assignment"], detectors: ["mass_assignment", "missing_authz"], chains: ["mass_assignment"], tools: ["live_recon", "active_scan"] },
-  { re: /deserialization|rce|workflow|execution/i, vectors: ["code_execution"], detectors: ["deserialization"], chains: ["deserialization"], tools: ["live_recon", "active_scan"] }
+  { re: /deserialization|rce|workflow|execution/i, vectors: ["code_execution"], detectors: ["deserialization"], chains: ["deserialization"], tools: ["live_recon", "active_scan"] },
+  { re: /read.only|readonly|canedit|can_edit|ui.*bypass|client.*flag|client.*trusted|disabled.*field|isadmin|is_admin|withvip|premium|unmasked/i, vectors: ["client_trusted_flag"], detectors: ["client_trusted_flag"], chains: ["xss_to_account_takeover"], tools: ["live_recon", "active_scan"] },
+  { re: /password reset|reset.*password|third.party harm|password.*reset/i, vectors: ["business_logic"], detectors: ["missing_authz"], chains: ["idor"], tools: ["live_recon", "sibling_scan"] },
+  { re: /prototype|pollution|__proto__/i, vectors: ["prototype_pollution"], detectors: ["prototype_pollution"], chains: ["prototype_pollution"], tools: ["proto_pollution_probe", "live_recon"] },
+  { re: /smuggl|desync|cl\.te|te\.cl/i, vectors: ["http_request_smuggling"], detectors: [], chains: ["http_request_smuggling"], tools: ["smuggling_test", "live_recon"] }
 ];
 function mapLab(lab) {
   const out = { vectors: [], detectors: [], chains: [], tools: [] };
@@ -60346,6 +60418,96 @@ x=1\r
   };
 }
 
+// src/nuclei-scan.ts
+import { execFileSync as execFileSync7 } from "node:child_process";
+function normalizeTag(tech) {
+  return tech.toLowerCase().replace(/[^a-z0-9.-]/g, "").replace(/^\.+|\.+$/g, "");
+}
+async function fetchTarget(target) {
+  const res = await fetch(target, { redirect: "follow", headers: { "User-Agent": "Mozilla/5.0 (compatible; BlitzStrike/2.4)" } });
+  const body = await res.text();
+  const headers = {};
+  res.headers.forEach((v, k) => {
+    headers[k] = v;
+  });
+  return { headers, body };
+}
+var SEV_RANK = { critical: 0, high: 1, medium: 2, low: 3, info: 4, unknown: 5 };
+async function nucleiScan(opts) {
+  const target = opts.target;
+  if (!/^https?:\/\//i.test(target)) {
+    return { status: "error", message: "target must be an http(s) URL", target, techs: [], matched_cves: [], templates_ran: 0, findings: [] };
+  }
+  let techs = opts.tech ?? [];
+  let headers = {};
+  let body = "";
+  const needFp = techs.length === 0 && !(opts.tags && opts.tags.length);
+  if (needFp) {
+    try {
+      ({ headers, body } = await fetchTarget(target));
+    } catch {}
+  }
+  if (techs.length === 0 && needFp)
+    techs = detectTech(headers, body);
+  const versions = needFp ? extractVersion(headers, body) : [];
+  const matchedCves = needFp || opts.tech ? watchlistCveMatches(techs, headers, body, versions) : [];
+  const cveIds = matchedCves.map((c) => c.cve);
+  const severity = (opts.severity ?? ["critical", "high", "medium"]).join(",");
+  const args = ["-u", target, "-jsonl", "-silent", "-no-color", "-timeout", "10", "-rate-limit", "150", "-severity", severity];
+  if (cveIds.length > 0)
+    args.push("-id", cveIds.join(","));
+  if (opts.broad || opts.tags && opts.tags.length > 0) {
+    const tags = opts.tags ?? techs.map(normalizeTag).filter(Boolean);
+    if (tags.length > 0)
+      args.push("-tags", tags.join(","));
+  }
+  let out;
+  try {
+    out = execFileSync7("nuclei", args, { timeout: 300000, stdio: ["ignore", "pipe", "pipe"], encoding: "utf8" });
+  } catch (e) {
+    const err = e;
+    if (err.code === "ENOENT") {
+      return { status: "error", message: "nuclei not installed (run blitzstrike install-tools)", target, techs, matched_cves: cveIds, templates_ran: 0, findings: [] };
+    }
+    return { status: "error", message: String(err.stderr ?? err.message ?? e), target, techs, matched_cves: cveIds, templates_ran: 0, findings: [] };
+  }
+  const findings = [];
+  const seen = new Set;
+  for (const line of out.trim().split(`
+`)) {
+    if (!line)
+      continue;
+    let m;
+    try {
+      m = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    const info = m.info ?? {};
+    const tid = String(m["template-id"] ?? "");
+    if (!tid || seen.has(tid))
+      continue;
+    seen.add(tid);
+    findings.push({
+      template_id: tid,
+      name: String(info.name ?? tid),
+      severity: String(info.severity ?? "unknown"),
+      matched_at: String(m["matched-at"] ?? ""),
+      type: typeof m.type === "string" ? m.type : undefined
+    });
+  }
+  findings.sort((a, b) => (SEV_RANK[a.severity] ?? 5) - (SEV_RANK[b.severity] ?? 5));
+  const max = opts.max ?? 50;
+  return {
+    status: "ok",
+    target,
+    techs,
+    matched_cves: cveIds,
+    templates_ran: cveIds.length + (opts.broad || opts.tags && opts.tags.length ? 1 : 0),
+    findings: findings.slice(0, max)
+  };
+}
+
 // src/benchmark.ts
 import { readFileSync as readFileSync25, readdirSync as readdirSync7, writeFileSync as writeFileSync6, rmSync as rmSync3, mkdirSync as mkdirSync7 } from "node:fs";
 import { join as join25 } from "node:path";
@@ -62920,7 +63082,7 @@ function createServer2() {
 ` + `- A hard block (Cloudflare/WAF/IP-block/captcha) is NOT the end: mark the finding blocked + note the required vantage (residential / authorized / correct-SNI / --resolve direct-to-origin), then CONTINUE to the next lead (origin bypass, non-prod cluster, mobile APK, subdomain).
 ` + `- Keep trying every lead AND every chain step until each is verified/executed or blocked, THEN generate_report. Never deliver a bare surface map, and never stop at 'found X' when X enables more.
 
-` + "TWO PATHS:\\n" + "- Source path on disk -> blitz_scan / taint_file / eagle_eye2 (static).\\n" + "- Live URL -> live_recon / active_scan / strike_verify (web-hunting).\\n\\n" + "DEEPEN A FINDING: attack_plan(target, tech, params) to get the prioritized vector plan (decide what to test next with data); list_chains (escalation), chain_links (compose), technique_lookup(cls), payload_lookup, bypass_lookup (blocked). Ground any detector hit empirically with pattern_lookup(id) — it returns the class's CWE, real-world signature, escalation chains, citable references, per-class bypass techniques, and the high-value assets (crown jewels) that class hits, so a raw hit becomes a class-aware finding. Resolve free-form terminology first with synonym_lookup(term) (IDOR/BOLA/SQLi/prompt-injection → canonical id). For an llm_injection hit, its pattern carries a validation discipline — the RUN-TWICE RULE (reproduce token-for-token across two fresh sessions), NON-GUESSABLE ANCHOR (must leak a real key/URL, not a plausible guess), and OOB PROOF (a verifiable callback log) — apply all three before reporting. BEFORE generating a report, run submission_gate(...) and only ship a finding that passes all 7 questions (reproducible, in-scope, real-impact, no-privileged-assumption, verified-live, evidence-redacted, severity-derived); one false = kill it. Generate the concrete reproduction recipe with auto_poc(type, base_url, endpoint, param) — it emits the exact marker request + negative control + expected differential + Patchstack-style title, so 'reproducible' is executable, not abstract. Calibrate severity with severity_calibrate(type, cvss) to get a P1–P5 tier + VRT-style category. Start each engagement with engagement_scaffold(target, scope) for the folder + scope.md structure, and check data_refresh() to confirm the data layers are consistent. Phase doctrine: read_skill(bs-orchestrate-engagement | bs-web-hunting | bs-source-audit | bs-verify-finding). Campaign plan: read_playbook(target-type). On any failure call retry_guidance(signal) / model_fallback(signal) before giving up. HUNTING DOCTRINE (maximize payout rate): (1) SIBLING RULE — if one endpoint requires auth, check every sibling (/export /delete /share); ~30% of paid IDOR/auth bugs come from siblings — AUTOMATE it with sibling_scan(base_url, endpoint, token_a, token_b), the deterministic live logic-bug prober (sibling enumeration + differential IDOR + auth matrix + mass assignment + rate limit, evidence-first). (2) A→B SIGNAL — a confirmed bug signals a class of developer mistake; hunt B and C (20-min box) before reporting. (3) TWO-ACCOUNT IDOR — always test with attacker account A reading victim account B, and state it in the report. (4) PoC ESCALATION — IDOR shows victim data (not 200), XSS shows cookie exfil (not alert), SSRF shows internal response (not DNS), SQLi shows DB content (not error). (5) FOLLOW THE MONEY — billing/credits/refunds/wallet flows. (6) Kill weak findings with kill_list(type) BEFORE the gate — missing headers, self-XSS, open-redirect-alone, SSRF-DNS-only, GraphQL-introspection-alone are always N/A standalone. (7) CI/CD + SAML/SSO are critical attack surfaces (pull_request_target, expression injection, XML signature wrapping, comment injection). Full doctrine: hunting_doctrine(). WHAT TO HUNT NEXT: watchlist() returns the ranked CWE frequency + high-value CVEs with payout + a saturated flag (prioritize high-freq/high-payout/not-saturated: missing-authz, SQLi, SSRF, deserialization; skip saturated XSS/CSRF/open-redirect unless they chain into takeover). The CVE watchlist now spans 4,000+ product fingerprints (live from nuclei-templates when installed — refresh with sync_cve_corpus() before a big recon pass); live_recon's suggested_cves names the SPECIFIC CVE for the detected product/version — then cve_verify(cve, target) CONFIRMS it live by running the matching nuclei template (VERIFIED only when nuclei actually matches; a CVE is report-ready only after cve_verify, never from the fingerprint alone). SURFACE-FIRST: surface_map(surface) maps an attack surface (image/redirect proxy, edge cache, payment portal, AI agent, file service, Electron, SSO) to its highest-value tests — map surfaces then test, don't spray payloads. PRECISION GUARD: resolve_check(host) detects when an ISP/country redirects the domain to a blocking/sinkhole page (gambling/adult/streaming niches) — audit the PUBLIC IP, never the sinkhole.\n" + "KNOWLEDGE BASE (discover, don't guess): skillLookup(topic) / listSkills for the 40 attack-path + hunting skills (ap-*, hp-*, bs-*); list_attack_vectors / attack_vectors(cat) for the 34-category vector taxonomy; taxonomy(kind) for OWASP/CWE/ASVS/API-top-10; read_playbook(type) for the 17 campaign playbooks; list_manuals / read_tool_manual for 317 tool references; list_tools / run_catalog_tool for the 141-tool catalog. Every tool, skill, and data layer is reachable from these. CROSS-TARGET INTELLIGENCE: strike_resolve auto-records confirmed/false_positive verdicts into the empirical ledger; query it with intelligence(action=hit_rates/top_vectors/recall) so a new target on a known tech inherits historical hit-rates (attack_plan already blends them into success_probability). intelligence(action=recall, tech, target) is the per-engagement pattern recall — it returns which patterns historically CONFIRMED on that tech (prioritize them) versus which only ever produced false positives (avoid them), so a new engagement starts from the empirical playbook of past ones. LIVE PENTEST + TARGETING (black-box, WAF-safe): cache_gap(base_url, endpoint) fuzzes path-normalization + static-extension variants for cache deception/poisoning; blind_oracle(base_url, param, value) detects which SINK a param reaches (sql/ssti/xss) via benign arithmetic (id=1+0, test${7*7}) WITHOUT a malicious payload; param_precedence(base_url, param, A, B) maps duplicate-parameter precedence (first/last-wins) for WAF-bypass; broken_link_scan(url) detects expired-domain takeover (crawls outbound refs → DNS/RDAP → flags claimable domains). Logic-bug live probers: jwt_forge(token, endpoint, …) forges JWT confusion tokens (alg:none / RS256→HS256 key-confusion / kid-jku-x5u) and proves which is ACCEPTED live; proto_pollution_probe(target, endpoint) sends __proto__ / constructor.prototype JSON canaries and reports VERIFIED only on reflection; smuggling_test(target) sends CL.TE / TE.CL desync probes over a raw connection. OOB (out-of-band) PROOF for BLIND vulns: oob_start() spins an interactsh listener (unique *.oast.* domain, streams DNS/HTTP interactions — the standard for public targets) or a local HTTP listener for local labs; inject the canary, then oob_poll(id) until the hit arrives; oob_stop(id) to clean up. A blind SSRF/XXE/SQLi/command-injection is CONFIRMED only when the canary actually arrives — never from a guess. SOURCE TARGETING: review_harness(path) FIRST for full coverage — it applies a fixed 5-signal rubric (entry_points/auth_gates/sinks/secrets/logic_bugs) to EVERY source file and sorts the signal-dense ones first (a complete map, not a partial scan); then action_surface(code) maps every wp_ajax_* action to its vuln class + DERIVED priority (what to look for WHERE); security_state(sanitizers, sink) gives a wrong-context sanitization verdict; framework_knowledge(framework) returns auth/nonce primitives for 9 frameworks; variant_scan(root, signature) mass-sweeps an install base for ONE bug family; patch_analyze(old, new) REVERSES a security patch into the 0-day, and its mine_signature feeds variant_scan to sweep unpatched copies. All of these are DETECTION HINTS — verify each live (strike_verify / browser_validate) before it enters the report. NEWEST DETECTORS — understand AND try them: variant_scan also emits priv_esc (privilege escalation — a role/capability/user change fed by request input, traced cross-file via reverse call-graph, e.g. set_role($id, sanitize_key($_POST['um-role'])) or update_user_meta(...,'wp_capabilities', $_POST[...])) and flags uploadAllow=>array('all') unrestricted-upload configs as file_upload (the file-manager/connector shape). TO TRY a priv_esc hit: submit the role field with 'administrator' (or send wp_capabilities meta) and confirm the account actually gains admin. TO TRY an unrestricted-upload hit: POST a .php/.phtml and confirm it lands web-reachable + executes. variant_scan also emits hardcoded_secret (CWE-798) in three tiers: a secret field (api_key/db_password/access_token/aws_*) assigned a literal (HIGH), a known secret FORMAT (JWT eyJ…/AWS AKIA…/GitHub ghp_…/Slack xoxb-…/…) regardless of name (HIGH), or a high-entropy suspect token (MEDIUM — verify before reporting). Verify a frontend/JS secret live via drive_devtools (inspect the JS bundle / network response and confirm the key is actually exposed), and for a backend secret confirm it is reachable/valid. A static hit is a HYPOTHESIS until verified live — never report unverified. For a repo, also scan_git_history(root) — secrets DELETED from HEAD still live in .git history (the removed-later-is-not-fixed trap), and it feeds every recovered pre-deletion blob through the same secret detector. Once you recover a credential, prove it is still ACTIVE with validate_leaked_key(apiBase, endpoints, key|blobUrl) — a READ-ONLY differential test (401-without-key vs 200-with-key = auth bypass PROVEN). Two supply-chain detectors: dependency_confusion (a manifest/build file resolving a package from a public registry — pypi.org/npmjs.org --extra-index-url, or a scoped @company/pkg with no private registry) and ml_supply_chain (torch.load without weights_only=True / joblib.load / np.load(allow_pickle=True) / keras load_model on an untrusted model → pickle RCE). Rust is supported end-to-end: the taint engine (blitz_scan / taint_file) maps Rust sinks (std::process::Command, sqlx/diesel, reqwest/hyper, std::fs, serde/bincode) to the classic classes, plus two Rust-specific detectors — rust_unsafe (transmute / assume_init / from_raw_parts / ptr::* — memory-unsafety surface, CWE-119) and rust_format_string (println!/format! with a variable as the format string — CWE-134). The sqlx query! compile-time macro is treated as safe (suppressed). Two more web-class detectors: jwt_alg_confusion (a JWT verifier that dispatches on the token's alg header and accepts BOTH RS256 and HS256, with the HS256 HMAC secret derived from public/shared key material — CWE-347; the attacker sets alg=HS256 and signs with the public key to forge admin tokens) and cache_deception (a reverse proxy caching static-extension URLs with a cache key that omits the session cookie, over a session-authenticated backend — CWE-525; the victim's cached private response is re-fetched anonymously). TO TRY a jwt_alg_confusion hit: fetch the public key (/.well-known/jwks.json), forge an HS256 token signed with that public key, and confirm admin access. TO TRY a cache_deception hit: request an authenticated path with a static extension appended (.css/.js) and re-fetch it anonymously. Three more detectors: cors_misconfiguration (Access-Control-Allow-Origin reflects the request Origin or is '*' while credentials are true — CWE-942; any site reads the victim's authenticated responses), xss (user input into a DOM sink — innerHTML / dangerouslySetInnerHTML / document.write / .html() / eval — CWE-79), and subdomain_takeover (a dangling CNAME/AliasTarget to a claimable service like *.github.io/*.herokuapp.com/*.amazonaws.com — CWE-404). TO TRY a cors hit: send an evil Origin + confirm the response echoes it with Allow-Credentials:true. TO TRY an xss hit: confirm the sink executes (drive_devtools). TO TRY a takeover hit: verify the CNAME target resolves to an unclaimed/not-found page. Two more client-side detectors: postmessage_no_origin_check (a window message listener that reads event.data but never validates event.origin — CWE-345; any site can drive the handler) and client_trusted_flag (a privilege/entitlement flag like isAdmin/withVip/premium read from request input and used in a security decision — CWE-807/639; derive the flag from server state, never the client). TO TRY a postMessage hit: send a crafted message from an attacker origin and confirm the handler acts on it. TO TRY a client-trusted-flag hit: flip the flag param to true and confirm the privilege is actually granted. WEB3: for Solidity/EVM, call web3_audit(code|path) — a deterministic 13-class smart-contract audit (reentrancy incl. ERC721/ERC1155 callback reentrancy, unchecked return, unchecked arithmetic, tx.origin auth, signature replay, unprotected selfdestruct, delegatecall-to-user-input, missing access control, timestamp dependence, spot-price oracle manipulation incl. slot0/latestRoundData, unbounded loop, abi.encodePacked hash collision, missing address(0) validation) returning ranked findings (class/CWE/severity/line), then foundry_poc(class, contract) to generate an executable Foundry test, and foundry_run(contract_code, poc_code|class_) to actually EXECUTE it — a PASSING PoC test is the proof that the exploit reproduces (deterministic: forge's own test verdict). A web3 hit is a HYPOTHESIS until the Foundry PoC reproduces it.\n" + `PRECISION ANALYSIS — chrome-devtools MCP is MANDATORY, not optional:
+` + "TWO PATHS:\\n" + "- Source path on disk -> blitz_scan / taint_file / eagle_eye2 (static).\\n" + "- Live URL -> live_recon / active_scan / strike_verify (web-hunting).\\n\\n" + "DEEPEN A FINDING: attack_plan(target, tech, params) to get the prioritized vector plan (decide what to test next with data); list_chains (escalation), chain_links (compose), technique_lookup(cls), payload_lookup, bypass_lookup (blocked). Ground any detector hit empirically with pattern_lookup(id) — it returns the class's CWE, real-world signature, escalation chains, citable references, per-class bypass techniques, and the high-value assets (crown jewels) that class hits, so a raw hit becomes a class-aware finding. Resolve free-form terminology first with synonym_lookup(term) (IDOR/BOLA/SQLi/prompt-injection → canonical id). For an llm_injection hit, its pattern carries a validation discipline — the RUN-TWICE RULE (reproduce token-for-token across two fresh sessions), NON-GUESSABLE ANCHOR (must leak a real key/URL, not a plausible guess), and OOB PROOF (a verifiable callback log) — apply all three before reporting. BEFORE generating a report, run submission_gate(...) and only ship a finding that passes all 7 questions (reproducible, in-scope, real-impact, no-privileged-assumption, verified-live, evidence-redacted, severity-derived); one false = kill it. Generate the concrete reproduction recipe with auto_poc(type, base_url, endpoint, param) — it emits the exact marker request + negative control + expected differential + Patchstack-style title, so 'reproducible' is executable, not abstract. Calibrate severity with severity_calibrate(type, cvss) to get a P1–P5 tier + VRT-style category. Start each engagement with engagement_scaffold(target, scope) for the folder + scope.md structure, and check data_refresh() to confirm the data layers are consistent. Phase doctrine: read_skill(bs-orchestrate-engagement | bs-web-hunting | bs-source-audit | bs-verify-finding). Campaign plan: read_playbook(target-type). On any failure call retry_guidance(signal) / model_fallback(signal) before giving up. HUNTING DOCTRINE (maximize payout rate): (1) SIBLING RULE — if one endpoint requires auth, check every sibling (/export /delete /share); ~30% of paid IDOR/auth bugs come from siblings — AUTOMATE it with sibling_scan(base_url, endpoint, token_a, token_b), the deterministic live logic-bug prober (sibling enumeration + differential IDOR + auth matrix + mass assignment + rate limit, evidence-first). (2) A→B SIGNAL — a confirmed bug signals a class of developer mistake; hunt B and C (20-min box) before reporting. (3) TWO-ACCOUNT IDOR — always test with attacker account A reading victim account B, and state it in the report. (4) PoC ESCALATION — IDOR shows victim data (not 200), XSS shows cookie exfil (not alert), SSRF shows internal response (not DNS), SQLi shows DB content (not error). (5) FOLLOW THE MONEY — billing/credits/refunds/wallet flows. (6) Kill weak findings with kill_list(type) BEFORE the gate — missing headers, self-XSS, open-redirect-alone, SSRF-DNS-only, GraphQL-introspection-alone are always N/A standalone. (7) CI/CD + SAML/SSO are critical attack surfaces (pull_request_target, expression injection, XML signature wrapping, comment injection). Full doctrine: hunting_doctrine(). WHAT TO HUNT NEXT: watchlist() returns the ranked CWE frequency + high-value CVEs with payout + a saturated flag (prioritize high-freq/high-payout/not-saturated: missing-authz, SQLi, SSRF, deserialization; skip saturated XSS/CSRF/open-redirect unless they chain into takeover). The CVE watchlist now spans 4,000+ product fingerprints (live from nuclei-templates when installed — refresh with sync_cve_corpus() before a big recon pass); live_recon's suggested_cves names the SPECIFIC CVE for the detected product/version — then cve_verify(cve, target) CONFIRMS it live by running the matching nuclei template (VERIFIED only when nuclei actually matches; a CVE is report-ready only after cve_verify, never from the fingerprint alone). For 'scan this target' automation, nuclei_scan(target) fingerprints the stack and runs the WHOLE matched template set (CVE templates + optional broad tech-tag) in one rate-limited pass — use it instead of verifying CVEs one-by-one. SURFACE-FIRST: surface_map(surface) maps an attack surface (image/redirect proxy, edge cache, payment portal, AI agent, file service, Electron, SSO) to its highest-value tests — map surfaces then test, don't spray payloads. PRECISION GUARD: resolve_check(host) detects when an ISP/country redirects the domain to a blocking/sinkhole page (gambling/adult/streaming niches) — audit the PUBLIC IP, never the sinkhole.\n" + "KNOWLEDGE BASE (discover, don't guess): skillLookup(topic) / listSkills for the 40 attack-path + hunting skills (ap-*, hp-*, bs-*); list_attack_vectors / attack_vectors(cat) for the 34-category vector taxonomy; taxonomy(kind) for OWASP/CWE/ASVS/API-top-10; read_playbook(type) for the 17 campaign playbooks; list_manuals / read_tool_manual for 317 tool references; list_tools / run_catalog_tool for the 141-tool catalog. Every tool, skill, and data layer is reachable from these. CROSS-TARGET INTELLIGENCE: strike_resolve auto-records confirmed/false_positive verdicts into the empirical ledger; query it with intelligence(action=hit_rates/top_vectors/recall) so a new target on a known tech inherits historical hit-rates (attack_plan already blends them into success_probability). intelligence(action=recall, tech, target) is the per-engagement pattern recall — it returns which patterns historically CONFIRMED on that tech (prioritize them) versus which only ever produced false positives (avoid them), so a new engagement starts from the empirical playbook of past ones. LIVE PENTEST + TARGETING (black-box, WAF-safe): cache_gap(base_url, endpoint) fuzzes path-normalization + static-extension variants for cache deception/poisoning; blind_oracle(base_url, param, value) detects which SINK a param reaches (sql/ssti/xss) via benign arithmetic (id=1+0, test${7*7}) WITHOUT a malicious payload; param_precedence(base_url, param, A, B) maps duplicate-parameter precedence (first/last-wins) for WAF-bypass; broken_link_scan(url) detects expired-domain takeover (crawls outbound refs → DNS/RDAP → flags claimable domains). Logic-bug live probers: jwt_forge(token, endpoint, …) forges JWT confusion tokens (alg:none / RS256→HS256 key-confusion / kid-jku-x5u) and proves which is ACCEPTED live; proto_pollution_probe(target, endpoint) sends __proto__ / constructor.prototype JSON canaries and reports VERIFIED only on reflection; smuggling_test(target) sends CL.TE / TE.CL desync probes over a raw connection. OOB (out-of-band) PROOF for BLIND vulns: oob_start() spins an interactsh listener (unique *.oast.* domain, streams DNS/HTTP interactions — the standard for public targets) or a local HTTP listener for local labs; inject the canary, then oob_poll(id) until the hit arrives; oob_stop(id) to clean up. A blind SSRF/XXE/SQLi/command-injection is CONFIRMED only when the canary actually arrives — never from a guess. SOURCE TARGETING: review_harness(path) FIRST for full coverage — it applies a fixed 5-signal rubric (entry_points/auth_gates/sinks/secrets/logic_bugs) to EVERY source file and sorts the signal-dense ones first (a complete map, not a partial scan); then action_surface(code) maps every wp_ajax_* action to its vuln class + DERIVED priority (what to look for WHERE); security_state(sanitizers, sink) gives a wrong-context sanitization verdict; framework_knowledge(framework) returns auth/nonce primitives for 9 frameworks; variant_scan(root, signature) mass-sweeps an install base for ONE bug family; patch_analyze(old, new) REVERSES a security patch into the 0-day, and its mine_signature feeds variant_scan to sweep unpatched copies. All of these are DETECTION HINTS — verify each live (strike_verify / browser_validate) before it enters the report. NEWEST DETECTORS — understand AND try them: variant_scan also emits priv_esc (privilege escalation — a role/capability/user change fed by request input, traced cross-file via reverse call-graph, e.g. set_role($id, sanitize_key($_POST['um-role'])) or update_user_meta(...,'wp_capabilities', $_POST[...])) and flags uploadAllow=>array('all') unrestricted-upload configs as file_upload (the file-manager/connector shape). TO TRY a priv_esc hit: submit the role field with 'administrator' (or send wp_capabilities meta) and confirm the account actually gains admin. TO TRY an unrestricted-upload hit: POST a .php/.phtml and confirm it lands web-reachable + executes. variant_scan also emits hardcoded_secret (CWE-798) in three tiers: a secret field (api_key/db_password/access_token/aws_*) assigned a literal (HIGH), a known secret FORMAT (JWT eyJ…/AWS AKIA…/GitHub ghp_…/Slack xoxb-…/…) regardless of name (HIGH), or a high-entropy suspect token (MEDIUM — verify before reporting). Verify a frontend/JS secret live via drive_devtools (inspect the JS bundle / network response and confirm the key is actually exposed), and for a backend secret confirm it is reachable/valid. A static hit is a HYPOTHESIS until verified live — never report unverified. For a repo, also scan_git_history(root) — secrets DELETED from HEAD still live in .git history (the removed-later-is-not-fixed trap), and it feeds every recovered pre-deletion blob through the same secret detector. Once you recover a credential, prove it is still ACTIVE with validate_leaked_key(apiBase, endpoints, key|blobUrl) — a READ-ONLY differential test (401-without-key vs 200-with-key = auth bypass PROVEN). Two supply-chain detectors: dependency_confusion (a manifest/build file resolving a package from a public registry — pypi.org/npmjs.org --extra-index-url, or a scoped @company/pkg with no private registry) and ml_supply_chain (torch.load without weights_only=True / joblib.load / np.load(allow_pickle=True) / keras load_model on an untrusted model → pickle RCE). Rust is supported end-to-end: the taint engine (blitz_scan / taint_file) maps Rust sinks (std::process::Command, sqlx/diesel, reqwest/hyper, std::fs, serde/bincode) to the classic classes, plus two Rust-specific detectors — rust_unsafe (transmute / assume_init / from_raw_parts / ptr::* — memory-unsafety surface, CWE-119) and rust_format_string (println!/format! with a variable as the format string — CWE-134). The sqlx query! compile-time macro is treated as safe (suppressed). Two more web-class detectors: jwt_alg_confusion (a JWT verifier that dispatches on the token's alg header and accepts BOTH RS256 and HS256, with the HS256 HMAC secret derived from public/shared key material — CWE-347; the attacker sets alg=HS256 and signs with the public key to forge admin tokens) and cache_deception (a reverse proxy caching static-extension URLs with a cache key that omits the session cookie, over a session-authenticated backend — CWE-525; the victim's cached private response is re-fetched anonymously). TO TRY a jwt_alg_confusion hit: fetch the public key (/.well-known/jwks.json), forge an HS256 token signed with that public key, and confirm admin access. TO TRY a cache_deception hit: request an authenticated path with a static extension appended (.css/.js) and re-fetch it anonymously. Three more detectors: cors_misconfiguration (Access-Control-Allow-Origin reflects the request Origin or is '*' while credentials are true — CWE-942; any site reads the victim's authenticated responses), xss (user input into a DOM sink — innerHTML / dangerouslySetInnerHTML / document.write / .html() / eval — CWE-79), and subdomain_takeover (a dangling CNAME/AliasTarget to a claimable service like *.github.io/*.herokuapp.com/*.amazonaws.com — CWE-404). TO TRY a cors hit: send an evil Origin + confirm the response echoes it with Allow-Credentials:true. TO TRY an xss hit: confirm the sink executes (drive_devtools). TO TRY a takeover hit: verify the CNAME target resolves to an unclaimed/not-found page. Two more client-side detectors: postmessage_no_origin_check (a window message listener that reads event.data but never validates event.origin — CWE-345; any site can drive the handler) and client_trusted_flag (a privilege/entitlement flag like isAdmin/withVip/premium read from request input and used in a security decision — CWE-807/639; derive the flag from server state, never the client). TO TRY a postMessage hit: send a crafted message from an attacker origin and confirm the handler acts on it. TO TRY a client-trusted-flag hit: flip the flag param to true and confirm the privilege is actually granted. WEB3: for Solidity/EVM, call web3_audit(code|path) — a deterministic 13-class smart-contract audit (reentrancy incl. ERC721/ERC1155 callback reentrancy, unchecked return, unchecked arithmetic, tx.origin auth, signature replay, unprotected selfdestruct, delegatecall-to-user-input, missing access control, timestamp dependence, spot-price oracle manipulation incl. slot0/latestRoundData, unbounded loop, abi.encodePacked hash collision, missing address(0) validation) returning ranked findings (class/CWE/severity/line), then foundry_poc(class, contract) to generate an executable Foundry test, and foundry_run(contract_code, poc_code|class_) to actually EXECUTE it — a PASSING PoC test is the proof that the exploit reproduces (deterministic: forge's own test verdict). A web3 hit is a HYPOTHESIS until the Foundry PoC reproduces it.\n" + `PRECISION ANALYSIS — chrome-devtools MCP is MANDATORY, not optional:
 ` + `- When a lead needs DOM/JS precision — DOM-XSS sink execution, AJAX endpoint + payload interception, JS runtime errors, redirect chains, SSO/token flow, or anything a static HTML glance cannot prove — call drive_devtools(target). It spawns chrome-devtools-mcp and drives a REAL headless browser (navigate -> list_network_requests -> list_console_messages -> evaluate_script), giving reproducible evidence instead of a guess.
 ` + `- Before calling it, check_mcp() to confirm the browser MCP is available; if not, blitzstrike install-tools or npm i -g chrome-devtools-mcp. Never substitute eyeballing minified JS or a static sink guess when a live browser can PROVE it. This is the precision + consistency layer.
 ` + "EXTERNAL MCP SERVERS (verified, connect them — NOT one-shot CLIs): chrome-devtools-mcp (29 tools: list_network_requests/get_network_request for raw HTTP interception, list_console_messages for JS errors + DOM-XSS, evaluate_script to run JS, take_screenshot) -> stdio chrome-devtools-mcp --headless --chromeArg=--no-sandbox --chromeArg=--disable-gpu (as root/container this is MANDATORY or the browser crashes; add --proxyServer http://127.0.0.1:8080 to route through Burp, --acceptInsecureCerts for bad TLS). burp-suite-mcp (proxy history + active scan + repeater) -> NOT npm: build the JAR (git clone https://github.com/PortSwigger/mcp-server.git && cd mcp-server && ./gradlew embedProxyJar), load it in Burp Extensions, then connect the client to http://127.0.0.1:9876 (SSE) or the stdio proxy java -jar mcp-proxy-all.jar --sse-url http://127.0.0.1:9876."
@@ -63981,7 +64143,7 @@ ${statusLine}` : statusLine },
   }, async () => {
     let update = "skipped (nuclei not found)";
     try {
-      execFileSync7("nuclei", ["-update-templates"], { timeout: 120000, stdio: "pipe" });
+      execFileSync8("nuclei", ["-update-templates"], { timeout: 120000, stdio: "pipe" });
       update = "ok";
     } catch {}
     invalidateCorpusCache();
@@ -64003,7 +64165,29 @@ ${statusLine}` : statusLine },
       target: string2().describe("Target URL, e.g. https://target.com")
     }
   }, async ({ cve, target }) => {
-    return { content: [{ type: "text", text: JSON.stringify(cveVerify(cve, target)) }] };
+    const r = cveVerify(cve, target);
+    if (r.status === "verified") {
+      recordVerdict({ vector: "cve", outcome: "confirmed", target, severity: r.matched[0]?.severity });
+    }
+    return { content: [{ type: "text", text: JSON.stringify(r) }] };
+  });
+  server.registerTool("nuclei_scan", {
+    title: "Fingerprint-driven full DAST scan via nuclei",
+    description: "Run the WHOLE relevant nuclei template set against a live target in one command: fingerprint the stack (or use the tech you pass), select the fingerprint-matched CVE templates + (broad mode) tech-tag templates, run nuclei rate-limited (critical/high/medium), and return deduped severity-ranked findings. Findings are HINTS — verify each before reporting. Use this for 'scan this target' automation instead of verifying CVEs one-by-one.",
+    inputSchema: {
+      target: string2().describe("Target URL, e.g. https://target.com"),
+      tech: array(string2()).optional().describe("Optional tech list (from live_recon) to skip fingerprinting"),
+      tags: array(string2()).optional().describe("Optional direct nuclei tags (e.g. ['wordpress','php'])"),
+      severity: array(string2()).optional().describe("Severities to run (default critical,high,medium)"),
+      broad: boolean2().optional().describe("Run full tech-tag templates too (default false = CVE templates only)"),
+      max: number2().optional().describe("Max findings to return (default 50)")
+    }
+  }, async (opts) => {
+    const r = await nucleiScan(opts);
+    for (const f of r.findings) {
+      recordVerdict({ vector: "cve", outcome: "confirmed", target: opts.target, severity: f.severity });
+    }
+    return { content: [{ type: "text", text: JSON.stringify(r) }] };
   });
   server.registerTool("jwt_forge", {
     title: "Forge JWT confusion tokens and verify which is accepted live",
@@ -64017,7 +64201,11 @@ ${statusLine}` : statusLine },
       public_key: string2().optional().describe("Public key (PEM) to sign HS256 with for the key-confusion attack")
     }
   }, async (opts) => {
-    return { content: [{ type: "text", text: JSON.stringify(await jwtForge(opts)) }] };
+    const r = await jwtForge(opts);
+    if (r.status === "ok" && r.forged.some((f) => f.accepted)) {
+      recordVerdict({ vector: "jwt_alg_confusion", outcome: "confirmed", target: opts.endpoint });
+    }
+    return { content: [{ type: "text", text: JSON.stringify(r) }] };
   });
   server.registerTool("proto_pollution_probe", {
     title: "Probe for prototype pollution with a reflection canary",
@@ -64029,7 +64217,11 @@ ${statusLine}` : statusLine },
       param: string2().optional().describe("JSON key to nest the poison under (default 'data')")
     }
   }, async (opts) => {
-    return { content: [{ type: "text", text: JSON.stringify(await protoPollutionProbe(opts)) }] };
+    const r = await protoPollutionProbe(opts);
+    if (r.status === "verified") {
+      recordVerdict({ vector: "prototype_pollution", outcome: "confirmed", target: opts.target });
+    }
+    return { content: [{ type: "text", text: JSON.stringify(r) }] };
   });
   server.registerTool("smuggling_test", {
     title: "Detect HTTP request-smuggling (CL.TE / TE.CL) desync live",
@@ -64038,7 +64230,11 @@ ${statusLine}` : statusLine },
       target: string2().describe("Target URL, e.g. https://target.com")
     }
   }, async ({ target }) => {
-    return { content: [{ type: "text", text: JSON.stringify(await smugglingTest(target)) }] };
+    const r = await smugglingTest(target);
+    if (r.status === "desync") {
+      recordVerdict({ vector: "http_request_smuggling", outcome: "confirmed", target });
+    }
+    return { content: [{ type: "text", text: JSON.stringify(r) }] };
   });
   server.registerTool("auto_poc", {
     title: "Auto-PoC — generate a copy-paste-ready reproduction recipe",