blitzstrike 2.4.127 → 2.4.129

package/CHANGELOG.md

@@ -5,6 +5,36 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.129] — 2026-10-02
+
+### Added — 4 deterministic detectors (open_redirect, missing_nonce/CSRF, toctou, second_order)
+
+- `open_redirect` (CWE-601): user input into a redirect/Location sink (header
+  Location, wp_redirect, window.location), with a 2-line lookback so `$url =
+  $_GET["url"]; header("Location: " . $url)` is caught; `wp_safe_redirect` suppressed.
+- `missing_nonce` / CSRF (CWE-352): a file with a state-changing surface (wp_ajax_,
+  admin_post, Express post/put/delete, update_/delete_/insert_/… mutation) and no
+  nonce/CSRF token anywhere. REST routes are excluded (permission_callback is
+  `missing_authz`'s job, not CSRF).
+- `toctou` (CWE-367): a check-then-act gap (file_exists→unlink, is_admin→delete,
+  balance-check→withdraw) within a 3-line window, same-line included.
+- `second_order` (CWE-79/89): a DB read assigned to a variable then reaching
+  echo/query/eval without escaping — the stored XSS / second-order SQLi shape
+  single-pass source→sink misses.
+- 8 corpus fixtures + 4 regression tests + patterns/synonyms/CWE/VRT grounding.
+  (37 patterns; 505/505 tests; 161 MCP tools.)
+
+## [2.4.128] — 2026-10-02
+
+### Changed — API recon doctrine (LLM reasons OpenAPI/OAuth, not a new tool)
+
+- The system prompt now instructs the agent to FETCH + PARSE OpenAPI/Swagger
+  specs itself (plain JSON/YAML) when discoverApi/live_recon surfaces one —
+  extract every endpoint/method/parameter/auth requirement, map the object-level
+  paths to BOLA/IDOR candidates, then test with sibling_scan. OAuth/SSO flows are
+  also the agent's reasoning job. This is a reasoning task, so it lives in the
+  prompt — no new tool.
+
 ## [2.4.127] — 2026-10-02
 
 ### Added — asset discovery + screenshot + authenticated session

package/bench/corpus/cb-nonce-safe.md

@@ -0,0 +1,11 @@
+- id: cb-nonce-safe
+- language: php
+- vulnerable: false
+- detector: complex_bugs
+
+```php
+<?php
+add_action("wp_ajax_delete", "del");
+function del() { check_ajax_referer("del"); update_option("x", $_POST["v"]); }
+
+```

package/bench/corpus/cb-nonce-vuln.md

@@ -0,0 +1,11 @@
+- id: cb-nonce-vuln
+- language: php
+- vulnerable: true
+- detector: complex_bugs
+
+```php
+<?php
+add_action("wp_ajax_delete", "del");
+function del() { update_option("x", $_POST["v"]); }
+
+```

package/bench/corpus/cb-openredir-safe.md

@@ -0,0 +1,10 @@
+- id: cb-openredir-safe
+- language: php
+- vulnerable: false
+- detector: complex_bugs
+
+```php
+<?php
+wp_safe_redirect($_GET["url"]);
+
+```

package/bench/corpus/cb-openredir-vuln.md

@@ -0,0 +1,10 @@
+- id: cb-openredir-vuln
+- language: php
+- vulnerable: true
+- detector: complex_bugs
+
+```php
+<?php
+header("Location: " . $_GET["url"]);
+
+```

package/bench/corpus/cb-secondorder-safe.md

@@ -0,0 +1,11 @@
+- id: cb-secondorder-safe
+- language: php
+- vulnerable: false
+- detector: complex_bugs
+
+```php
+<?php
+$row = $wpdb->get_results("SELECT name FROM users");
+echo esc_html($row->name);
+
+```

package/bench/corpus/cb-secondorder-vuln.md

@@ -0,0 +1,11 @@
+- id: cb-secondorder-vuln
+- language: php
+- vulnerable: true
+- detector: complex_bugs
+
+```php
+<?php
+$row = $wpdb->get_results("SELECT name FROM users");
+echo $row->name;
+
+```

package/bench/corpus/cb-toctou-safe.md

@@ -0,0 +1,10 @@
+- id: cb-toctou-safe
+- language: php
+- vulnerable: false
+- detector: complex_bugs
+
+```php
+<?php
+unlink($f);
+
+```

package/bench/corpus/cb-toctou-vuln.md

@@ -0,0 +1,10 @@
+- id: cb-toctou-vuln
+- language: php
+- vulnerable: true
+- detector: complex_bugs
+
+```php
+<?php
+if (file_exists($f)) { unlink($f); }
+
+```

package/dist/index.js

@@ -8155,6 +8155,10 @@ function detectComplexBugs(code, file) {
   detectSubdomainTakeover(code, file, out);
   detectPostMessageOrigin(code, file, out);
   detectClientTrustedFlag(code, file, out);
+  detectOpenRedirect(code, file, out);
+  detectMissingNonce(code, file, out);
+  detectToctou(code, file, out);
+  detectSecondOrder(code, file, out);
   out.push(...detectWrongSanitizer(code, file));
   out.push(...detectMissingAuthz(code, file));
   const seen = new Set;
@@ -8901,6 +8905,132 @@ function detectSubdomainTakeover(code, file, out) {
     }
   }
 }
+function detectOpenRedirect(code, file, out) {
+  const clean = stripCommentsOnly2(code);
+  const ls = lines(code);
+  const cleanLines = lines(clean);
+  const sink = /(?:header\s*\(\s*["']Location|wp_redirect\s*\(|\bredirect\s*\(|->redirect\s*\(|response\.redirect\s*\(|\.redirect\s*\(|window\.location\s*=|location\.href\s*=|document\.location\s*=|location\.replace\s*\()/i;
+  const seen = new Set;
+  for (let i = 0;i < cleanLines.length; i++) {
+    const line = cleanLines[i];
+    if (!sink.test(line))
+      continue;
+    const window2 = cleanLines.slice(Math.max(0, i - 2), i + 1).join(" ");
+    if (!SOURCE_TOKENS2.test(window2))
+      continue;
+    if (/wp_safe_redirect\s*\(/.test(line))
+      continue;
+    const ln = i + 1;
+    if (seen.has(ln))
+      continue;
+    seen.add(ln);
+    out.push({
+      file,
+      line: ln,
+      type: "open_redirect",
+      category: "Open redirect (user input → redirect/Location sink)",
+      severity: "medium",
+      evidence: (ls[ln - 1] ?? "").trim(),
+      detail: `A redirect target is built from user input without a safe-redirect allowlist — an attacker crafts a link that redirects to a phishing site (or, chained with OAuth, steals the authorization code). Fix with an allowlist of trusted domains or wp_safe_redirect(). Verify by supplying a marker redirect URL and confirming the 3xx Location reflects it.`
+    });
+  }
+}
+function detectMissingNonce(code, file, out) {
+  const clean = stripCommentsOnly2(code);
+  const ls = lines(code);
+  const stateChange = /wp_ajax_|add_action\s*\(\s*["'](?:admin_post|wp_ajax)|app\.(?:post|put|delete|patch)\s*\(|router\.(?:post|put|delete|patch)\s*\(|->(?:post|put|delete|patch)\s*\(|(?:update_|delete_|insert_|save_|remove_|drop_|create_)[A-Za-z_]*\s*\(/i;
+  const nonceCheck = /wp_verify_nonce|check_ajax_referer|check_admin_referer|csrf|csrf_token|_token|X-CSRF|x-csrf|verifyCsrf|csrfProtection|authenticity_token/i;
+  if (!stateChange.test(clean))
+    return;
+  if (nonceCheck.test(clean))
+    return;
+  const cleanLines = lines(clean);
+  let first = -1;
+  for (let i = 0;i < cleanLines.length; i++) {
+    if (stateChange.test(cleanLines[i])) {
+      first = i + 1;
+      break;
+    }
+  }
+  if (first < 0)
+    return;
+  out.push({
+    file,
+    line: first,
+    type: "missing_nonce",
+    category: "Missing CSRF token / nonce on state-changing actions",
+    severity: "medium",
+    evidence: (ls[first - 1] ?? "").trim(),
+    detail: `This file handles state-changing requests (form POST / wp_ajax / REST mutation) but contains no CSRF protection (wp_verify_nonce / check_ajax_referer / CSRF token / _token). An attacker can drive a cross-site request in a victim's session. Confirm by replaying a state-changing request without any token and observing the state change.`
+  });
+}
+function detectToctou(code, file, out) {
+  const clean = stripCommentsOnly2(code);
+  const ls = lines(code);
+  const checks = /(?:file_exists|is_file|is_dir|is_writable|is_admin|current_user_can|hasPermission|isAuthorized|->exists\s*\(|access\s*\(|fopen\s*\(|stat\s*\(|lstat\s*\()/i;
+  const acts = /(?:unlink\s*\(|rmdir\s*\(|rename\s*\(|chmod\s*\(|chown\s*\(|file_put_contents\s*\(|fwrite\s*\(|\bdelete\s*\(|\bremove\s*\(|\bdrop\s*\(|withdraw|transfer|deduct|->remove\s*\(|->delete\s*\(|->unlink\s*\()/i;
+  const cleanLines = lines(clean);
+  const seen = new Set;
+  for (let i = 0;i < cleanLines.length; i++) {
+    const line = cleanLines[i];
+    if (!/if\s*\(/.test(line) || !checks.test(line))
+      continue;
+    for (let j = i;j <= Math.min(i + 3, cleanLines.length - 1); j++) {
+      if (!acts.test(cleanLines[j]))
+        continue;
+      const ln = i + 1;
+      if (seen.has(ln))
+        break;
+      seen.add(ln);
+      out.push({
+        file,
+        line: ln,
+        type: "toctou",
+        category: "Race condition (TOCTOU) — check then act on the same resource",
+        severity: "medium",
+        evidence: (ls[ln - 1] ?? "").trim(),
+        detail: `A permission/existence check is followed (within a few lines) by a mutating operation on the same resource — a time-of-check-to-time-of-use gap (e.g. file_exists then unlink, is_admin then delete, balance check then withdraw). Between the check and the act the state can change, letting an attacker race the operation (symlink swap, balance double-spend, auth bypass). Verify with race_test / concurrent requests.`
+      });
+      break;
+    }
+  }
+}
+function detectSecondOrder(code, file, out) {
+  const clean = stripCommentsOnly2(code);
+  const ls = lines(code);
+  const dbRead = /(?:get_results|get_row|get_var|->query\s*\(|->find\(|->findOne\s*\(|findOne\s*\(|findBy\w*\s*\(|->get\s*\(|\bSELECT\b|select\s*\(|->all\s*\()/i;
+  const sink = /(?:echo\s|print\s|\bprintf\s*\(|->query\s*\(|->whereRaw\s*\(|->selectRaw\s*\(|\beval\s*\()/i;
+  const escape2 = /(?:htmlspecialchars|esc_html|esc_attr|esc_sql|->prepare\s*\(|htmlentities|htmlspecialchars_decode)/i;
+  const assign = /\$[A-Za-z_]\w*\s*=|const\s+[A-Za-z_]\w*\s*=|let\s+[A-Za-z_]\w*\s*=|var\s+[A-Za-z_]\w*\s*=/;
+  const cleanLines = lines(clean);
+  const seen = new Set;
+  for (let i = 0;i < cleanLines.length; i++) {
+    const line = cleanLines[i];
+    if (!dbRead.test(line) || !assign.test(line))
+      continue;
+    for (let j = i + 1;j <= Math.min(i + 5, cleanLines.length - 1); j++) {
+      if (!sink.test(cleanLines[j]))
+        continue;
+      const between = cleanLines.slice(i + 1, j + 1).join(" ");
+      if (escape2.test(between))
+        break;
+      const ln = i + 1;
+      if (seen.has(ln))
+        break;
+      seen.add(ln);
+      out.push({
+        file,
+        line: ln,
+        type: "second_order",
+        category: "Second-order injection (stored data → sink without escaping)",
+        severity: "medium",
+        evidence: (ls[ln - 1] ?? "").trim(),
+        detail: `A value read from storage (DB) reaches a rendering/query/exec sink without escaping/parameterization. If the stored value was written from user input (stored XSS / second-order SQLi), the injection triggers on a later request — the classic 'stored, not reflected' shape that single-pass source→sink analysis misses. Verify by seeding the stored field with a marker and observing it render.`
+      });
+      break;
+    }
+  }
+}
 var SOURCE_TOKENS2, MAGIC_METHODS, SECRET_FIELD_RE, SECRET_PLACEHOLDER_RE, ENTROPY_EXCLUDE_VAR;
 var init_complex_bugs = __esm(() => {
   init_security_state();
@@ -34671,7 +34801,10 @@ var ALIASES = {
   "llm prompt injection": "llm_injection",
   graphql: "graphql_exposure",
   oauth: "oauth_misconfig",
-  "open redirect": "oauth_misconfig",
+  "open redirect": "open_redirect",
+  "open-redirect": "open_redirect",
+  "url redirect": "open_redirect",
+  "redirect to untrusted": "open_redirect",
   grpc: "grpc_reflection",
   "hardcoded credential": "hardcoded_secret",
   "hardcoded secret": "hardcoded_secret",
@@ -34757,7 +34890,16 @@ var ALIASES = {
   "client trusted boolean": "client_trusted_flag",
   "client controlled flag": "client_trusted_flag",
   "privilege flag": "client_trusted_flag",
-  "entitlement flag": "client_trusted_flag"
+  "entitlement flag": "client_trusted_flag",
+  toctou: "toctou",
+  "race condition": "toctou",
+  "time of check time of use": "toctou",
+  "check then act": "toctou",
+  "second order": "second_order",
+  "second order injection": "second_order",
+  "second-order injection": "second_order",
+  "second order sqli": "second_order",
+  "stored injection": "second_order"
 };
 function normalize(term) {
   return term.trim().toLowerCase().replace(/[_-]+/g, " ").replace(/\s+/g, " ").trim();
@@ -59902,7 +60044,10 @@ var VRT_MAP = {
   cache_deception: { vrt: "cryptographic_failure > web_cache_deception", priority: "P2", severity: "high", rationale: "Cookie-less static cache keys leak per-session private responses to anonymous callers." },
   cors_misconfiguration: { vrt: "configuration > cors_misconfiguration", priority: "P3", severity: "medium", rationale: "A reflected/wildcard origin with credentials lets any website read authenticated responses cross-origin (CWE-942)." },
   xss: { vrt: "injection > cross_site_scripting", priority: "P2", severity: "high", rationale: "User input into a DOM sink executes script in the victim's origin (CWE-79)." },
-  subdomain_takeover: { vrt: "configuration > subdomain_takeover", priority: "P3", severity: "medium", rationale: "A dangling CNAME lets an attacker host content on the victim's subdomain (CWE-404)." }
+  subdomain_takeover: { vrt: "configuration > subdomain_takeover", priority: "P3", severity: "medium", rationale: "A dangling CNAME lets an attacker host content on the victim's subdomain (CWE-404)." },
+  open_redirect: { vrt: "broken_access_control > open_redirect", priority: "P4", severity: "medium", rationale: "A user-controlled redirect target enables phishing or OAuth code theft (CWE-601)." },
+  toctou: { vrt: "insecure_design > race_condition", priority: "P2", severity: "high", rationale: "A check-then-act gap lets an attacker race the operation — balance double-spend, symlink swap, auth bypass (CWE-367)." },
+  second_order: { vrt: "injection > second_order_injection", priority: "P2", severity: "high", rationale: "Stored data rendered/queried without escaping — stored XSS or second-order SQLi (CWE-79/89)." }
 };
 function severityCalibrate(input) {
   const type = input.type?.toLowerCase() ?? "";
@@ -62990,6 +63135,15 @@ var POC_TEMPLATES = {
     expected: "The response issues a 30x to `https://attacker.example`.",
     fix: "Allowlist redirect targets and validate the exact destination."
   },
+  open_redirect: {
+    severity: "medium",
+    marker: "https://attacker.example",
+    request: (i) => qs(i, encodeURIComponent("https://attacker.example")),
+    control: (i) => qs(i, encodeURIComponent("https://target.com/legit")),
+    title: (i) => `Open redirect via ${i.param ?? "redirect"} on ${i.endpoint} forwards users to an attacker-controlled domain`,
+    expected: "The response issues a 30x whose Location reflects `https://attacker.example` (marker reflected); the control redirects to the legitimate domain.",
+    fix: "Allowlist redirect targets and validate the exact destination."
+  },
   xxe: {
     severity: "high",
     marker: MK,
@@ -63430,7 +63584,7 @@ function createServer2() {
 ` + `- A hard block (Cloudflare/WAF/IP-block/captcha) is NOT the end: mark the finding blocked + note the required vantage (residential / authorized / correct-SNI / --resolve direct-to-origin), then CONTINUE to the next lead (origin bypass, non-prod cluster, mobile APK, subdomain).
 ` + `- Keep trying every lead AND every chain step until each is verified/executed or blocked, THEN generate_report. Never deliver a bare surface map, and never stop at 'found X' when X enables more.
 
-` + "TWO PATHS:\\n" + "- Source path on disk -> blitz_scan / taint_file / eagle_eye2 (static).\\n" + "- Live URL -> live_recon / active_scan / strike_verify (web-hunting).\\n\\n" + "DEEPEN A FINDING: attack_plan(target, tech, params) to get the prioritized vector plan (decide what to test next with data); list_chains (escalation), chain_links (compose), technique_lookup(cls), payload_lookup, bypass_lookup (blocked). Ground any detector hit empirically with pattern_lookup(id) — it returns the class's CWE, real-world signature, escalation chains, citable references, per-class bypass techniques, and the high-value assets (crown jewels) that class hits, so a raw hit becomes a class-aware finding. Resolve free-form terminology first with synonym_lookup(term) (IDOR/BOLA/SQLi/prompt-injection → canonical id). For an llm_injection hit, its pattern carries a validation discipline — the RUN-TWICE RULE (reproduce token-for-token across two fresh sessions), NON-GUESSABLE ANCHOR (must leak a real key/URL, not a plausible guess), and OOB PROOF (a verifiable callback log) — apply all three before reporting. BEFORE generating a report, run submission_gate(...) and only ship a finding that passes all 7 questions (reproducible, in-scope, real-impact, no-privileged-assumption, verified-live, evidence-redacted, severity-derived); one false = kill it. When a PoC/report comes out under-enriched, wet_dry(type, wet, dry) diagnoses WHERE it broke — WET (model/prompt/timeout) vs DRY (parser) vs template. Generate the concrete reproduction recipe with auto_poc(type, base_url, endpoint, param) — it emits the exact marker request + negative control + expected differential + Patchstack-style title, so 'reproducible' is executable, not abstract. Calibrate severity with severity_calibrate(type, cvss) to get a P1–P5 tier + VRT-style category. Start each engagement with engagement_scaffold(target, scope) for the folder + scope.md structure, and check data_refresh() to confirm the data layers are consistent. Phase doctrine: read_skill(bs-orchestrate-engagement | bs-web-hunting | bs-source-audit | bs-verify-finding). Campaign plan: read_playbook(target-type). On any failure call retry_guidance(signal) / model_fallback(signal) before giving up. HUNTING DOCTRINE (maximize payout rate): (1) SIBLING RULE — if one endpoint requires auth, check every sibling (/export /delete /share); ~30% of paid IDOR/auth bugs come from siblings — AUTOMATE it with sibling_scan(base_url, endpoint, token_a, token_b), the deterministic live logic-bug prober (sibling enumeration + differential IDOR + auth matrix + mass assignment + rate limit, evidence-first). (2) A→B SIGNAL — a confirmed bug signals a class of developer mistake; hunt B and C (20-min box) before reporting. (3) TWO-ACCOUNT IDOR — always test with attacker account A reading victim account B, and state it in the report. (4) PoC ESCALATION — IDOR shows victim data (not 200), XSS shows cookie exfil (not alert), SSRF shows internal response (not DNS), SQLi shows DB content (not error). (5) FOLLOW THE MONEY — billing/credits/refunds/wallet flows. (6) Kill weak findings with kill_list(type) BEFORE the gate — missing headers, self-XSS, open-redirect-alone, SSRF-DNS-only, GraphQL-introspection-alone are always N/A standalone. (7) CI/CD + SAML/SSO are critical attack surfaces (pull_request_target, expression injection, XML signature wrapping, comment injection). Full doctrine: hunting_doctrine(). WHAT TO HUNT NEXT: watchlist() returns the ranked CWE frequency + high-value CVEs with payout + a saturated flag (prioritize high-freq/high-payout/not-saturated: missing-authz, SQLi, SSRF, deserialization; skip saturated XSS/CSRF/open-redirect unless they chain into takeover). The CVE watchlist now spans 4,000+ product fingerprints (live from nuclei-templates when installed — refresh with sync_cve_corpus() before a big recon pass); live_recon's suggested_cves names the SPECIFIC CVE for the detected product/version — then cve_verify(cve, target) CONFIRMS it live by running the matching nuclei template (VERIFIED only when nuclei actually matches; a CVE is report-ready only after cve_verify, never from the fingerprint alone). For 'scan this target' automation, nuclei_scan(target) fingerprints the stack and runs the WHOLE matched template set (CVE templates + optional broad tech-tag) in one rate-limited pass — use it instead of verifying CVEs one-by-one. SURFACE-FIRST: surface_map(surface) maps an attack surface (image/redirect proxy, edge cache, payment portal, AI agent, file service, Electron, SSO) to its highest-value tests — map surfaces then test, don't spray payloads; then param_surface(target, class) discovers EVERY testable parameter (URL query, form fields, /users/123 path ids + UUIDs, JS refs) + per-class specialist hints — test the DISCOVERED params, not just the hinted one. PRECISION GUARD: resolve_check(host) detects when an ISP/country redirects the domain to a blocking/sinkhole page (gambling/adult/streaming niches) — audit the PUBLIC IP, never the sinkhole. CIRCUIT BREAKER: target_health(target) probes the target and tracks consecutive failures — if the circuit OPENS (5 consecutive timeouts/5xx) PAUSE the target and resume when it recovers (auto-closes on a successful probe); circuit_status() lists every tracked target's state.\n" + "KNOWLEDGE BASE (discover, don't guess): skillLookup(topic) / listSkills for the 40 attack-path + hunting skills (ap-*, hp-*, bs-*); list_attack_vectors / attack_vectors(cat) for the 34-category vector taxonomy; taxonomy(kind) for OWASP/CWE/ASVS/API-top-10; read_playbook(type) for the 17 campaign playbooks; list_manuals / read_tool_manual for 317 tool references; list_tools / run_catalog_tool for the 141-tool catalog. Every tool, skill, and data layer is reachable from these. CROSS-TARGET INTELLIGENCE: strike_resolve auto-records confirmed/false_positive verdicts into the empirical ledger; query it with intelligence(action=hit_rates/top_vectors/recall) so a new target on a known tech inherits historical hit-rates (attack_plan already blends them into success_probability). intelligence(action=recall, tech, target) is the per-engagement pattern recall — it returns which patterns historically CONFIRMED on that tech (prioritize them) versus which only ever produced false positives (avoid them), so a new engagement starts from the empirical playbook of past ones. LIVE PENTEST + TARGETING (black-box, WAF-safe): cache_gap(base_url, endpoint) fuzzes path-normalization + static-extension variants for cache deception/poisoning; blind_oracle(base_url, param, value) detects which SINK a param reaches (sql/ssti/xss) via benign arithmetic (id=1+0, test${7*7}) WITHOUT a malicious payload; param_precedence(base_url, param, A, B) maps duplicate-parameter precedence (first/last-wins) for WAF-bypass; broken_link_scan(url) detects expired-domain takeover (crawls outbound refs → DNS/RDAP → flags claimable domains); asset_discovery(domain) enumerates the FULL passive attack surface — crt.sh subdomains + DNS brute + A-record resolution + optional port scan. Logic-bug live probers: jwt_forge(token, endpoint, …) forges JWT confusion tokens (alg:none / RS256→HS256 key-confusion / kid-jku-x5u) and proves which is ACCEPTED live; proto_pollution_probe(target, endpoint) sends __proto__ / constructor.prototype JSON canaries and reports VERIFIED only on reflection; smuggling_test(target) sends CL.TE / TE.CL desync probes over a raw connection; totp(secret) generates an RFC 6238 TOTP token so the agent can fill a 2FA field itself; auth_login(login_url, user, pass, …) POSTs credentials and extracts the session cookie/token for authenticated scanning (use browser_agent navigate/type/click/get_cookie for JS-heavy logins); screenshot(url) captures a page image for vision-based proof. OOB (out-of-band) PROOF for BLIND vulns: oob_start() spins an interactsh listener (unique *.oast.* domain, streams DNS/HTTP interactions — the standard for public targets) or a local HTTP listener for local labs; inject the canary, then oob_poll(id) until the hit arrives; oob_stop(id) to clean up. A blind SSRF/XXE/SQLi/command-injection is CONFIRMED only when the canary actually arrives — never from a guess. SOURCE TARGETING: review_harness(path) FIRST for full coverage — it applies a fixed 5-signal rubric (entry_points/auth_gates/sinks/secrets/logic_bugs) to EVERY source file and sorts the signal-dense ones first (a complete map, not a partial scan); then action_surface(code) maps every wp_ajax_* action to its vuln class + DERIVED priority (what to look for WHERE); security_state(sanitizers, sink) gives a wrong-context sanitization verdict; framework_knowledge(framework) returns auth/nonce primitives for 9 frameworks; variant_scan(root, signature) mass-sweeps an install base for ONE bug family; patch_analyze(old, new) REVERSES a security patch into the 0-day, and its mine_signature feeds variant_scan to sweep unpatched copies. All of these are DETECTION HINTS — verify each live (strike_verify / browser_validate) before it enters the report. NEWEST DETECTORS — understand AND try them: variant_scan also emits priv_esc (privilege escalation — a role/capability/user change fed by request input, traced cross-file via reverse call-graph, e.g. set_role($id, sanitize_key($_POST['um-role'])) or update_user_meta(...,'wp_capabilities', $_POST[...])) and flags uploadAllow=>array('all') unrestricted-upload configs as file_upload (the file-manager/connector shape). TO TRY a priv_esc hit: submit the role field with 'administrator' (or send wp_capabilities meta) and confirm the account actually gains admin. TO TRY an unrestricted-upload hit: POST a .php/.phtml and confirm it lands web-reachable + executes. variant_scan also emits hardcoded_secret (CWE-798) in three tiers: a secret field (api_key/db_password/access_token/aws_*) assigned a literal (HIGH), a known secret FORMAT (JWT eyJ…/AWS AKIA…/GitHub ghp_…/Slack xoxb-…/…) regardless of name (HIGH), or a high-entropy suspect token (MEDIUM — verify before reporting). Verify a frontend/JS secret live via drive_devtools (inspect the JS bundle / network response and confirm the key is actually exposed), and for a backend secret confirm it is reachable/valid. A static hit is a HYPOTHESIS until verified live — never report unverified. For a repo, also scan_git_history(root) — secrets DELETED from HEAD still live in .git history (the removed-later-is-not-fixed trap), and it feeds every recovered pre-deletion blob through the same secret detector. Once you recover a credential, prove it is still ACTIVE with validate_leaked_key(apiBase, endpoints, key|blobUrl) — a READ-ONLY differential test (401-without-key vs 200-with-key = auth bypass PROVEN). Two supply-chain detectors: dependency_confusion (a manifest/build file resolving a package from a public registry — pypi.org/npmjs.org --extra-index-url, or a scoped @company/pkg with no private registry) and ml_supply_chain (torch.load without weights_only=True / joblib.load / np.load(allow_pickle=True) / keras load_model on an untrusted model → pickle RCE). Rust is supported end-to-end: the taint engine (blitz_scan / taint_file) maps Rust sinks (std::process::Command, sqlx/diesel, reqwest/hyper, std::fs, serde/bincode) to the classic classes, plus two Rust-specific detectors — rust_unsafe (transmute / assume_init / from_raw_parts / ptr::* — memory-unsafety surface, CWE-119) and rust_format_string (println!/format! with a variable as the format string — CWE-134). The sqlx query! compile-time macro is treated as safe (suppressed). Two more web-class detectors: jwt_alg_confusion (a JWT verifier that dispatches on the token's alg header and accepts BOTH RS256 and HS256, with the HS256 HMAC secret derived from public/shared key material — CWE-347; the attacker sets alg=HS256 and signs with the public key to forge admin tokens) and cache_deception (a reverse proxy caching static-extension URLs with a cache key that omits the session cookie, over a session-authenticated backend — CWE-525; the victim's cached private response is re-fetched anonymously). TO TRY a jwt_alg_confusion hit: fetch the public key (/.well-known/jwks.json), forge an HS256 token signed with that public key, and confirm admin access. TO TRY a cache_deception hit: request an authenticated path with a static extension appended (.css/.js) and re-fetch it anonymously. Three more detectors: cors_misconfiguration (Access-Control-Allow-Origin reflects the request Origin or is '*' while credentials are true — CWE-942; any site reads the victim's authenticated responses), xss (user input into a DOM sink — innerHTML / dangerouslySetInnerHTML / document.write / .html() / eval — CWE-79), and subdomain_takeover (a dangling CNAME/AliasTarget to a claimable service like *.github.io/*.herokuapp.com/*.amazonaws.com — CWE-404). TO TRY a cors hit: send an evil Origin + confirm the response echoes it with Allow-Credentials:true. TO TRY an xss hit: confirm the sink executes (drive_devtools). TO TRY a takeover hit: verify the CNAME target resolves to an unclaimed/not-found page. Two more client-side detectors: postmessage_no_origin_check (a window message listener that reads event.data but never validates event.origin — CWE-345; any site can drive the handler) and client_trusted_flag (a privilege/entitlement flag like isAdmin/withVip/premium read from request input and used in a security decision — CWE-807/639; derive the flag from server state, never the client). TO TRY a postMessage hit: send a crafted message from an attacker origin and confirm the handler acts on it. TO TRY a client-trusted-flag hit: flip the flag param to true and confirm the privilege is actually granted. WEB3: for Solidity/EVM, call web3_audit(code|path) — a deterministic 13-class smart-contract audit (reentrancy incl. ERC721/ERC1155 callback reentrancy, unchecked return, unchecked arithmetic, tx.origin auth, signature replay, unprotected selfdestruct, delegatecall-to-user-input, missing access control, timestamp dependence, spot-price oracle manipulation incl. slot0/latestRoundData, unbounded loop, abi.encodePacked hash collision, missing address(0) validation) returning ranked findings (class/CWE/severity/line), then foundry_poc(class, contract) to generate an executable Foundry test, and foundry_run(contract_code, poc_code|class_) to actually EXECUTE it — a PASSING PoC test is the proof that the exploit reproduces (deterministic: forge's own test verdict). A web3 hit is a HYPOTHESIS until the Foundry PoC reproduces it.\n" + `PRECISION ANALYSIS — chrome-devtools MCP is MANDATORY, not optional:
+` + "TWO PATHS:\\n" + "- Source path on disk -> blitz_scan / taint_file / eagle_eye2 (static).\\n" + "- Live URL -> live_recon / active_scan / strike_verify (web-hunting).\\n\\n" + "DEEPEN A FINDING: attack_plan(target, tech, params) to get the prioritized vector plan (decide what to test next with data); list_chains (escalation), chain_links (compose), technique_lookup(cls), payload_lookup, bypass_lookup (blocked). Ground any detector hit empirically with pattern_lookup(id) — it returns the class's CWE, real-world signature, escalation chains, citable references, per-class bypass techniques, and the high-value assets (crown jewels) that class hits, so a raw hit becomes a class-aware finding. Resolve free-form terminology first with synonym_lookup(term) (IDOR/BOLA/SQLi/prompt-injection → canonical id). For an llm_injection hit, its pattern carries a validation discipline — the RUN-TWICE RULE (reproduce token-for-token across two fresh sessions), NON-GUESSABLE ANCHOR (must leak a real key/URL, not a plausible guess), and OOB PROOF (a verifiable callback log) — apply all three before reporting. BEFORE generating a report, run submission_gate(...) and only ship a finding that passes all 7 questions (reproducible, in-scope, real-impact, no-privileged-assumption, verified-live, evidence-redacted, severity-derived); one false = kill it. When a PoC/report comes out under-enriched, wet_dry(type, wet, dry) diagnoses WHERE it broke — WET (model/prompt/timeout) vs DRY (parser) vs template. Generate the concrete reproduction recipe with auto_poc(type, base_url, endpoint, param) — it emits the exact marker request + negative control + expected differential + Patchstack-style title, so 'reproducible' is executable, not abstract. Calibrate severity with severity_calibrate(type, cvss) to get a P1–P5 tier + VRT-style category. Start each engagement with engagement_scaffold(target, scope) for the folder + scope.md structure, and check data_refresh() to confirm the data layers are consistent. Phase doctrine: read_skill(bs-orchestrate-engagement | bs-web-hunting | bs-source-audit | bs-verify-finding). Campaign plan: read_playbook(target-type). On any failure call retry_guidance(signal) / model_fallback(signal) before giving up. HUNTING DOCTRINE (maximize payout rate): (1) SIBLING RULE — if one endpoint requires auth, check every sibling (/export /delete /share); ~30% of paid IDOR/auth bugs come from siblings — AUTOMATE it with sibling_scan(base_url, endpoint, token_a, token_b), the deterministic live logic-bug prober (sibling enumeration + differential IDOR + auth matrix + mass assignment + rate limit, evidence-first). (2) A→B SIGNAL — a confirmed bug signals a class of developer mistake; hunt B and C (20-min box) before reporting. (3) TWO-ACCOUNT IDOR — always test with attacker account A reading victim account B, and state it in the report. (4) PoC ESCALATION — IDOR shows victim data (not 200), XSS shows cookie exfil (not alert), SSRF shows internal response (not DNS), SQLi shows DB content (not error). (5) FOLLOW THE MONEY — billing/credits/refunds/wallet flows. (6) Kill weak findings with kill_list(type) BEFORE the gate — missing headers, self-XSS, open-redirect-alone, SSRF-DNS-only, GraphQL-introspection-alone are always N/A standalone. (7) CI/CD + SAML/SSO are critical attack surfaces (pull_request_target, expression injection, XML signature wrapping, comment injection). Full doctrine: hunting_doctrine(). WHAT TO HUNT NEXT: watchlist() returns the ranked CWE frequency + high-value CVEs with payout + a saturated flag (prioritize high-freq/high-payout/not-saturated: missing-authz, SQLi, SSRF, deserialization; skip saturated XSS/CSRF/open-redirect unless they chain into takeover). The CVE watchlist now spans 4,000+ product fingerprints (live from nuclei-templates when installed — refresh with sync_cve_corpus() before a big recon pass); live_recon's suggested_cves names the SPECIFIC CVE for the detected product/version — then cve_verify(cve, target) CONFIRMS it live by running the matching nuclei template (VERIFIED only when nuclei actually matches; a CVE is report-ready only after cve_verify, never from the fingerprint alone). For 'scan this target' automation, nuclei_scan(target) fingerprints the stack and runs the WHOLE matched template set (CVE templates + optional broad tech-tag) in one rate-limited pass — use it instead of verifying CVEs one-by-one. SURFACE-FIRST: surface_map(surface) maps an attack surface (image/redirect proxy, edge cache, payment portal, AI agent, file service, Electron, SSO) to its highest-value tests — map surfaces then test, don't spray payloads; then param_surface(target, class) discovers EVERY testable parameter (URL query, form fields, /users/123 path ids + UUIDs, JS refs) + per-class specialist hints — test the DISCOVERED params, not just the hinted one. API RECON (you reason this — no tool needed): when discoverApi/live_recon surfaces an OpenAPI/Swagger spec (/openapi.json /swagger.json /api-docs), FETCH and PARSE it yourself (plain JSON/YAML) — extract every endpoint + method + parameter + auth requirement, map the object-level paths ({id}/{uuid}) to BOLA/IDOR candidates, then test them with sibling_scan. OAuth/SSO flows are also your reasoning job — follow the redirect/state sequence manually. PRECISION GUARD: resolve_check(host) detects when an ISP/country redirects the domain to a blocking/sinkhole page (gambling/adult/streaming niches) — audit the PUBLIC IP, never the sinkhole. CIRCUIT BREAKER: target_health(target) probes the target and tracks consecutive failures — if the circuit OPENS (5 consecutive timeouts/5xx) PAUSE the target and resume when it recovers (auto-closes on a successful probe); circuit_status() lists every tracked target's state.\n" + "KNOWLEDGE BASE (discover, don't guess): skillLookup(topic) / listSkills for the 40 attack-path + hunting skills (ap-*, hp-*, bs-*); list_attack_vectors / attack_vectors(cat) for the 34-category vector taxonomy; taxonomy(kind) for OWASP/CWE/ASVS/API-top-10; read_playbook(type) for the 17 campaign playbooks; list_manuals / read_tool_manual for 317 tool references; list_tools / run_catalog_tool for the 141-tool catalog. Every tool, skill, and data layer is reachable from these. CROSS-TARGET INTELLIGENCE: strike_resolve auto-records confirmed/false_positive verdicts into the empirical ledger; query it with intelligence(action=hit_rates/top_vectors/recall) so a new target on a known tech inherits historical hit-rates (attack_plan already blends them into success_probability). intelligence(action=recall, tech, target) is the per-engagement pattern recall — it returns which patterns historically CONFIRMED on that tech (prioritize them) versus which only ever produced false positives (avoid them), so a new engagement starts from the empirical playbook of past ones. LIVE PENTEST + TARGETING (black-box, WAF-safe): cache_gap(base_url, endpoint) fuzzes path-normalization + static-extension variants for cache deception/poisoning; blind_oracle(base_url, param, value) detects which SINK a param reaches (sql/ssti/xss) via benign arithmetic (id=1+0, test${7*7}) WITHOUT a malicious payload; param_precedence(base_url, param, A, B) maps duplicate-parameter precedence (first/last-wins) for WAF-bypass; broken_link_scan(url) detects expired-domain takeover (crawls outbound refs → DNS/RDAP → flags claimable domains); asset_discovery(domain) enumerates the FULL passive attack surface — crt.sh subdomains + DNS brute + A-record resolution + optional port scan. Logic-bug live probers: jwt_forge(token, endpoint, …) forges JWT confusion tokens (alg:none / RS256→HS256 key-confusion / kid-jku-x5u) and proves which is ACCEPTED live; proto_pollution_probe(target, endpoint) sends __proto__ / constructor.prototype JSON canaries and reports VERIFIED only on reflection; smuggling_test(target) sends CL.TE / TE.CL desync probes over a raw connection; totp(secret) generates an RFC 6238 TOTP token so the agent can fill a 2FA field itself; auth_login(login_url, user, pass, …) POSTs credentials and extracts the session cookie/token for authenticated scanning (use browser_agent navigate/type/click/get_cookie for JS-heavy logins); screenshot(url) captures a page image for vision-based proof. OOB (out-of-band) PROOF for BLIND vulns: oob_start() spins an interactsh listener (unique *.oast.* domain, streams DNS/HTTP interactions — the standard for public targets) or a local HTTP listener for local labs; inject the canary, then oob_poll(id) until the hit arrives; oob_stop(id) to clean up. A blind SSRF/XXE/SQLi/command-injection is CONFIRMED only when the canary actually arrives — never from a guess. SOURCE TARGETING: review_harness(path) FIRST for full coverage — it applies a fixed 5-signal rubric (entry_points/auth_gates/sinks/secrets/logic_bugs) to EVERY source file and sorts the signal-dense ones first (a complete map, not a partial scan); then action_surface(code) maps every wp_ajax_* action to its vuln class + DERIVED priority (what to look for WHERE); security_state(sanitizers, sink) gives a wrong-context sanitization verdict; framework_knowledge(framework) returns auth/nonce primitives for 9 frameworks; variant_scan(root, signature) mass-sweeps an install base for ONE bug family; patch_analyze(old, new) REVERSES a security patch into the 0-day, and its mine_signature feeds variant_scan to sweep unpatched copies. All of these are DETECTION HINTS — verify each live (strike_verify / browser_validate) before it enters the report. NEWEST DETECTORS — understand AND try them: variant_scan also emits priv_esc (privilege escalation — a role/capability/user change fed by request input, traced cross-file via reverse call-graph, e.g. set_role($id, sanitize_key($_POST['um-role'])) or update_user_meta(...,'wp_capabilities', $_POST[...])) and flags uploadAllow=>array('all') unrestricted-upload configs as file_upload (the file-manager/connector shape). TO TRY a priv_esc hit: submit the role field with 'administrator' (or send wp_capabilities meta) and confirm the account actually gains admin. TO TRY an unrestricted-upload hit: POST a .php/.phtml and confirm it lands web-reachable + executes. variant_scan also emits hardcoded_secret (CWE-798) in three tiers: a secret field (api_key/db_password/access_token/aws_*) assigned a literal (HIGH), a known secret FORMAT (JWT eyJ…/AWS AKIA…/GitHub ghp_…/Slack xoxb-…/…) regardless of name (HIGH), or a high-entropy suspect token (MEDIUM — verify before reporting). Verify a frontend/JS secret live via drive_devtools (inspect the JS bundle / network response and confirm the key is actually exposed), and for a backend secret confirm it is reachable/valid. A static hit is a HYPOTHESIS until verified live — never report unverified. For a repo, also scan_git_history(root) — secrets DELETED from HEAD still live in .git history (the removed-later-is-not-fixed trap), and it feeds every recovered pre-deletion blob through the same secret detector. Once you recover a credential, prove it is still ACTIVE with validate_leaked_key(apiBase, endpoints, key|blobUrl) — a READ-ONLY differential test (401-without-key vs 200-with-key = auth bypass PROVEN). Two supply-chain detectors: dependency_confusion (a manifest/build file resolving a package from a public registry — pypi.org/npmjs.org --extra-index-url, or a scoped @company/pkg with no private registry) and ml_supply_chain (torch.load without weights_only=True / joblib.load / np.load(allow_pickle=True) / keras load_model on an untrusted model → pickle RCE). Rust is supported end-to-end: the taint engine (blitz_scan / taint_file) maps Rust sinks (std::process::Command, sqlx/diesel, reqwest/hyper, std::fs, serde/bincode) to the classic classes, plus two Rust-specific detectors — rust_unsafe (transmute / assume_init / from_raw_parts / ptr::* — memory-unsafety surface, CWE-119) and rust_format_string (println!/format! with a variable as the format string — CWE-134). The sqlx query! compile-time macro is treated as safe (suppressed). Two more web-class detectors: jwt_alg_confusion (a JWT verifier that dispatches on the token's alg header and accepts BOTH RS256 and HS256, with the HS256 HMAC secret derived from public/shared key material — CWE-347; the attacker sets alg=HS256 and signs with the public key to forge admin tokens) and cache_deception (a reverse proxy caching static-extension URLs with a cache key that omits the session cookie, over a session-authenticated backend — CWE-525; the victim's cached private response is re-fetched anonymously). TO TRY a jwt_alg_confusion hit: fetch the public key (/.well-known/jwks.json), forge an HS256 token signed with that public key, and confirm admin access. TO TRY a cache_deception hit: request an authenticated path with a static extension appended (.css/.js) and re-fetch it anonymously. Three more detectors: cors_misconfiguration (Access-Control-Allow-Origin reflects the request Origin or is '*' while credentials are true — CWE-942; any site reads the victim's authenticated responses), xss (user input into a DOM sink — innerHTML / dangerouslySetInnerHTML / document.write / .html() / eval — CWE-79), and subdomain_takeover (a dangling CNAME/AliasTarget to a claimable service like *.github.io/*.herokuapp.com/*.amazonaws.com — CWE-404). TO TRY a cors hit: send an evil Origin + confirm the response echoes it with Allow-Credentials:true. TO TRY an xss hit: confirm the sink executes (drive_devtools). TO TRY a takeover hit: verify the CNAME target resolves to an unclaimed/not-found page. Two more client-side detectors: postmessage_no_origin_check (a window message listener that reads event.data but never validates event.origin — CWE-345; any site can drive the handler) and client_trusted_flag (a privilege/entitlement flag like isAdmin/withVip/premium read from request input and used in a security decision — CWE-807/639; derive the flag from server state, never the client). TO TRY a postMessage hit: send a crafted message from an attacker origin and confirm the handler acts on it. TO TRY a client-trusted-flag hit: flip the flag param to true and confirm the privilege is actually granted. Four newest detectors: open_redirect (user input into a redirect/Location sink — CWE-601; TO TRY: supply a marker redirect URL and confirm the 30x Location reflects it), missing_nonce/CSRF (a state-changing wp_ajax/form/Express handler with no nonce or CSRF token — CWE-352; TO TRY: replay the state-changing request without the token and watch the state change), toctou (a check-then-act gap like file_exists→unlink or balance-check→withdraw — CWE-367; TO TRY: race the gap with concurrent requests via race_test), and second_order (a DB read reaching echo/query/eval without escaping — stored XSS or second-order SQLi that single-pass source→sink misses; TO TRY: seed the stored field with a marker and observe it render). WEB3: for Solidity/EVM, call web3_audit(code|path) — a deterministic 13-class smart-contract audit (reentrancy incl. ERC721/ERC1155 callback reentrancy, unchecked return, unchecked arithmetic, tx.origin auth, signature replay, unprotected selfdestruct, delegatecall-to-user-input, missing access control, timestamp dependence, spot-price oracle manipulation incl. slot0/latestRoundData, unbounded loop, abi.encodePacked hash collision, missing address(0) validation) returning ranked findings (class/CWE/severity/line), then foundry_poc(class, contract) to generate an executable Foundry test, and foundry_run(contract_code, poc_code|class_) to actually EXECUTE it — a PASSING PoC test is the proof that the exploit reproduces (deterministic: forge's own test verdict). A web3 hit is a HYPOTHESIS until the Foundry PoC reproduces it.\n" + `PRECISION ANALYSIS — chrome-devtools MCP is MANDATORY, not optional:
 ` + `- When a lead needs DOM/JS precision — DOM-XSS sink execution, AJAX endpoint + payload interception, JS runtime errors, redirect chains, SSO/token flow, or anything a static HTML glance cannot prove — call drive_devtools(target). It spawns chrome-devtools-mcp and drives a REAL headless browser (navigate -> list_network_requests -> list_console_messages -> evaluate_script), giving reproducible evidence instead of a guess.
 ` + `- Before calling it, check_mcp() to confirm the browser MCP is available; if not, blitzstrike install-tools or npm i -g chrome-devtools-mcp. Never substitute eyeballing minified JS or a static sink guess when a live browser can PROVE it. This is the precision + consistency layer.
 ` + "EXTERNAL MCP SERVERS (verified, connect them — NOT one-shot CLIs): chrome-devtools-mcp (29 tools: list_network_requests/get_network_request for raw HTTP interception, list_console_messages for JS errors + DOM-XSS, evaluate_script to run JS, take_screenshot) -> stdio chrome-devtools-mcp --headless --chromeArg=--no-sandbox --chromeArg=--disable-gpu (as root/container this is MANDATORY or the browser crashes; add --proxyServer http://127.0.0.1:8080 to route through Burp, --acceptInsecureCerts for bad TLS). burp-suite-mcp (proxy history + active scan + repeater) -> NOT npm: build the JAR (git clone https://github.com/PortSwigger/mcp-server.git && cd mcp-server && ./gradlew embedProxyJar), load it in Burp Extensions, then connect the client to http://127.0.0.1:9876 (SSE) or the stdio proxy java -jar mcp-proxy-all.jar --sse-url http://127.0.0.1:9876."

package/intelligence/cwe_map.json

@@ -357,6 +357,16 @@
       "id": "client_trusted_flag",
       "cwe": "CWE-807",
       "name": "Reliance on Untrusted Inputs in a Security Decision"
+    },
+    {
+      "id": "toctou",
+      "cwe": "CWE-367",
+      "name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
+    },
+    {
+      "id": "second_order",
+      "cwe": "CWE-79",
+      "name": "Improper Neutralization of Input During Web Page Generation (Stored XSS)"
     }
   ]
 }

package/intelligence/patterns.json

@@ -1113,6 +1113,87 @@
       "payout_min": 1000,
       "payout_max": 15000,
       "typical_payout": "$1K\u2013$15K"
+    },
+    {
+      "id": "open_redirect",
+      "name": "Open Redirect",
+      "cwe": "CWE-601",
+      "real_world": "A redirect target is built from user input (a 'next'/'return'/'redirect' parameter) without an allowlist. Used for phishing, or chained with OAuth/SSO to steal authorization codes/tokens.",
+      "detection_signatures": [
+        "user input into a redirect/Location sink (header('Location'), wp_redirect, window.location)"
+      ],
+      "chain_templates": [],
+      "references": [
+        "CWE-601",
+        "OWASP A01:2021 Broken Access Control"
+      ],
+      "bypass_techniques": [
+        "double-URL encoding",
+        "//evil.com protocol-relative URLs",
+        "@ and \\\\ scheme tricks"
+      ],
+      "crown_jewels": [
+        "OAuth authorization codes",
+        "session tokens leaked via referer",
+        "phishing victims"
+      ],
+      "payout_min": 50,
+      "payout_max": 500,
+      "typical_payout": 150
+    },
+    {
+      "id": "toctou",
+      "name": "Race Condition (TOCTOU)",
+      "cwe": "CWE-367",
+      "real_world": "A check (permission/existence/balance) is separated in time from the act that depends on it, so an attacker races the gap \u2014 symlink swap, balance double-spend, auth bypass, coupon/limit bypass.",
+      "detection_signatures": [
+        "if(check(resource)) { ... act(resource) } with a mutating act shortly after the check"
+      ],
+      "chain_templates": [],
+      "references": [
+        "CWE-367",
+        "CWE-362"
+      ],
+      "bypass_techniques": [
+        "parallel concurrent requests",
+        "symlink/hardlink swap",
+        "large payloads to widen the window"
+      ],
+      "crown_jewels": [
+        "balance/credit flows",
+        "voucher/coupon codes",
+        "file deletion/chmod"
+      ],
+      "payout_min": 100,
+      "payout_max": 3000,
+      "typical_payout": 600
+    },
+    {
+      "id": "second_order",
+      "name": "Second-Order Injection (Stored)",
+      "cwe": "CWE-79",
+      "real_world": "User input is stored (DB/cache), then later read and rendered/executed without escaping \u2014 stored XSS or second-order SQLi. Single-pass source\u2192sink analysis misses it because the source and sink are in different requests.",
+      "detection_signatures": [
+        "a DB read (get_results/SELECT/findOne) assigned to a variable, then reached by echo/query/eval without escaping"
+      ],
+      "chain_templates": [],
+      "references": [
+        "CWE-79",
+        "CWE-89",
+        "OWASP A03:2021 Injection"
+      ],
+      "bypass_techniques": [
+        "stored payloads (persistent XSS)",
+        "second-order SQLi (stored then re-queried)"
+      ],
+      "crown_jewels": [
+        "admin sessions (stored XSS \u2192 ATO)",
+        "all users (persistent payload)",
+        "database records"
+      ],
+      "payout_min": 100,
+      "payout_max": 5000,
+      "typical_payout": 800
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.127",
+  "version": "2.4.129",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {