blitzstrike 2.4.120 → 2.4.121

package/CHANGELOG.md

@@ -5,6 +5,21 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.121] — 2026-09-29
+
+### Added — empirical ledger auto-feed + benchmark coverage 30/30
+
+- The live probers now auto-record their VERIFIED verdicts into the empirical
+  ledger (`intelligence()`): `cve_verify`/`nuclei_scan` (vector "cve"),
+  `jwt_forge` (jwt_alg_confusion), `proto_pollution_probe`
+  (prototype_pollution), `smuggling_test` (http_request_smuggling) — so a
+  confirmed hit feeds attack_plan's Bayesian hit-rates cross-target.
+- Updated the Hackbot-Arena VECTOR_MAP with the new detectors + live probers
+  (cache_deception, client_trusted_flag, jwt_alg_confusion, prototype_pollution,
+  request-smuggling, password-reset) → detector coverage 26/30 → 30/30 (the 4
+  previously-unmapped labs — CacheKey, PasswordResetHarm, StaffDirectory,
+  NoteLock — are now covered).
+
 ## [2.4.120] — 2026-09-29
 
 ### Added — `nuclei_scan` (fingerprint-driven full DAST) + corpus precision fix

package/dist/index.js

@@ -59779,18 +59779,22 @@ function load5() {
   }
 }
 var VECTOR_MAP = [
-  { re: /jwt|algorithm confusion|rs256|hs256/i, vectors: ["jwt"], detectors: ["missing_authz"], chains: ["jwt"], tools: ["jwt_analyze", "live_recon"] },
+  { re: /jwt|algorithm confusion|rs256|hs256/i, vectors: ["jwt"], detectors: ["missing_authz", "jwt_alg_confusion"], chains: ["jwt"], tools: ["jwt_analyze", "jwt_forge", "live_recon"] },
   { re: /ssrf|server-side request/i, vectors: ["ssrf"], detectors: ["ssrf"], chains: ["ssrf"], tools: ["live_recon", "blind_oracle", "active_scan"] },
   { re: /sql injection|sqli|postgresql|sql/i, vectors: ["sql_injection"], detectors: ["sql_injection"], chains: ["sql_injection"], tools: ["live_recon", "blind_oracle", "active_scan"] },
   { re: /ssti|template injection|liquid|jinja|twig/i, vectors: ["ssti"], detectors: ["ssti"], chains: ["ssti"], tools: ["live_recon", "blind_oracle"] },
   { re: /command injection|os command|command execution/i, vectors: ["command_injection"], detectors: ["command_injection"], chains: ["command_injection"], tools: ["live_recon", "blind_oracle"] },
-  { re: /idor|bola|authorization|broken function|role|membership|ownership|entitlement|directory search|excessive data|data exposure|harvest/i, vectors: ["broken_object_level_authorization"], detectors: ["missing_authz"], chains: ["idor"], tools: ["live_recon", "active_scan", "param_precedence"] },
+  { re: /idor|bola|authorization|broken function|role|membership|ownership|entitlement|directory search|excessive data|data exposure|harvest|substring|search|disclosure/i, vectors: ["broken_object_level_authorization"], detectors: ["missing_authz"], chains: ["idor"], tools: ["live_recon", "active_scan", "param_precedence", "sibling_scan"] },
   { re: /graphql/i, vectors: ["graphql_exposure"], detectors: ["graphql_exposure", "sql_injection"], chains: ["graphql"], tools: ["live_recon", "active_scan"] },
-  { re: /cache/i, vectors: ["web_cache_deception"], detectors: [], chains: ["cache_deception"], tools: ["cache_gap", "live_recon"] },
+  { re: /cache/i, vectors: ["web_cache_deception"], detectors: ["cache_deception"], chains: ["cache_deception"], tools: ["cache_gap", "live_recon"] },
   { re: /credential|key|token|bearer|secret|leak|websocket|rum|api key/i, vectors: ["hardcoded_secret"], detectors: ["hardcoded_secret"], chains: ["secret_leak"], tools: ["live_recon", "drive_devtools", "scan_git_history"] },
   { re: /rate.limit|batching|otp/i, vectors: ["business_logic"], detectors: [], chains: ["rate_limit_bypass"], tools: ["race_test", "active_scan"] },
   { re: /mass assignment|self.regist|admin account|user creation|scope/i, vectors: ["mass_assignment"], detectors: ["mass_assignment", "missing_authz"], chains: ["mass_assignment"], tools: ["live_recon", "active_scan"] },
-  { re: /deserialization|rce|workflow|execution/i, vectors: ["code_execution"], detectors: ["deserialization"], chains: ["deserialization"], tools: ["live_recon", "active_scan"] }
+  { re: /deserialization|rce|workflow|execution/i, vectors: ["code_execution"], detectors: ["deserialization"], chains: ["deserialization"], tools: ["live_recon", "active_scan"] },
+  { re: /read.only|readonly|canedit|can_edit|ui.*bypass|client.*flag|client.*trusted|disabled.*field|isadmin|is_admin|withvip|premium|unmasked/i, vectors: ["client_trusted_flag"], detectors: ["client_trusted_flag"], chains: ["xss_to_account_takeover"], tools: ["live_recon", "active_scan"] },
+  { re: /password reset|reset.*password|third.party harm|password.*reset/i, vectors: ["business_logic"], detectors: ["missing_authz"], chains: ["idor"], tools: ["live_recon", "sibling_scan"] },
+  { re: /prototype|pollution|__proto__/i, vectors: ["prototype_pollution"], detectors: ["prototype_pollution"], chains: ["prototype_pollution"], tools: ["proto_pollution_probe", "live_recon"] },
+  { re: /smuggl|desync|cl\.te|te\.cl/i, vectors: ["http_request_smuggling"], detectors: [], chains: ["http_request_smuggling"], tools: ["smuggling_test", "live_recon"] }
 ];
 function mapLab(lab) {
   const out = { vectors: [], detectors: [], chains: [], tools: [] };
@@ -64161,7 +64165,11 @@ ${statusLine}` : statusLine },
       target: string2().describe("Target URL, e.g. https://target.com")
     }
   }, async ({ cve, target }) => {
-    return { content: [{ type: "text", text: JSON.stringify(cveVerify(cve, target)) }] };
+    const r = cveVerify(cve, target);
+    if (r.status === "verified") {
+      recordVerdict({ vector: "cve", outcome: "confirmed", target, severity: r.matched[0]?.severity });
+    }
+    return { content: [{ type: "text", text: JSON.stringify(r) }] };
   });
   server.registerTool("nuclei_scan", {
     title: "Fingerprint-driven full DAST scan via nuclei",
@@ -64175,7 +64183,11 @@ ${statusLine}` : statusLine },
       max: number2().optional().describe("Max findings to return (default 50)")
     }
   }, async (opts) => {
-    return { content: [{ type: "text", text: JSON.stringify(await nucleiScan(opts)) }] };
+    const r = await nucleiScan(opts);
+    for (const f of r.findings) {
+      recordVerdict({ vector: "cve", outcome: "confirmed", target: opts.target, severity: f.severity });
+    }
+    return { content: [{ type: "text", text: JSON.stringify(r) }] };
   });
   server.registerTool("jwt_forge", {
     title: "Forge JWT confusion tokens and verify which is accepted live",
@@ -64189,7 +64201,11 @@ ${statusLine}` : statusLine },
       public_key: string2().optional().describe("Public key (PEM) to sign HS256 with for the key-confusion attack")
     }
   }, async (opts) => {
-    return { content: [{ type: "text", text: JSON.stringify(await jwtForge(opts)) }] };
+    const r = await jwtForge(opts);
+    if (r.status === "ok" && r.forged.some((f) => f.accepted)) {
+      recordVerdict({ vector: "jwt_alg_confusion", outcome: "confirmed", target: opts.endpoint });
+    }
+    return { content: [{ type: "text", text: JSON.stringify(r) }] };
   });
   server.registerTool("proto_pollution_probe", {
     title: "Probe for prototype pollution with a reflection canary",
@@ -64201,7 +64217,11 @@ ${statusLine}` : statusLine },
       param: string2().optional().describe("JSON key to nest the poison under (default 'data')")
     }
   }, async (opts) => {
-    return { content: [{ type: "text", text: JSON.stringify(await protoPollutionProbe(opts)) }] };
+    const r = await protoPollutionProbe(opts);
+    if (r.status === "verified") {
+      recordVerdict({ vector: "prototype_pollution", outcome: "confirmed", target: opts.target });
+    }
+    return { content: [{ type: "text", text: JSON.stringify(r) }] };
   });
   server.registerTool("smuggling_test", {
     title: "Detect HTTP request-smuggling (CL.TE / TE.CL) desync live",
@@ -64210,7 +64230,11 @@ ${statusLine}` : statusLine },
       target: string2().describe("Target URL, e.g. https://target.com")
     }
   }, async ({ target }) => {
-    return { content: [{ type: "text", text: JSON.stringify(await smugglingTest(target)) }] };
+    const r = await smugglingTest(target);
+    if (r.status === "desync") {
+      recordVerdict({ vector: "http_request_smuggling", outcome: "confirmed", target });
+    }
+    return { content: [{ type: "text", text: JSON.stringify(r) }] };
   });
   server.registerTool("auto_poc", {
     title: "Auto-PoC — generate a copy-paste-ready reproduction recipe",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.120",
+  "version": "2.4.121",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {