blitzstrike 2.4.13 → 2.4.15

package/CHANGELOG.md

@@ -5,6 +5,29 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.15] — 2026-09-14
+
+### Fixed — detection → verification loop now unmissable
+
+- `run_engagement` / `run_autonomous` now return `status: DETECTED` (was
+  `COMPLETE`), signalling that verification is the NEXT mandatory step instead
+  of implying the job is done with unverified hypotheses.
+- System prompt adds a hard rule: after detection you MUST `strike_verify` /
+  `verify_file_read` / `drive_devtools` each finding before `generate_report`.
+- New generic `verify-phase` playbook (read_playbook) — verdict recipe
+  (confirmed/false-positive/unconfirmed/blocked), tool mapping, no-babysitting
+  rules — so any engagement can load the verify doctrine on demand.
+
+## [2.4.14] — 2026-09-14
+
+### Added — mandatory devtools-MCP precision directive
+
+- System prompt now mandates: when a lead needs DOM/JS precision (DOM-XSS sink
+  execution, AJAX interception, JS runtime errors, redirect chains, SSO/token
+  flow), the LLM MUST call `drive_devtools` (spawns chrome-devtools-mcp + drives
+  a real headless browser) instead of eyeballing static HTML — the precision +
+  consistency layer. Includes a `check_mcp` preflight step.
+
 ## [2.4.13] — 2026-09-14
 
 ### Improved — live install progress

package/dist/index.js

@@ -34062,8 +34062,8 @@ function runEngagement(target, scope = "", mode = "bug-bounty", maxFiles = 2000,
     json: reportJsonText,
     sarif: sarifDoc
   };
-  report.status = "COMPLETE";
-  report.note = "All findings are HYPOTHESES until verified live with strike_verify. " + "Apply each chain's negative_control before reporting. Confidence reflects static evidence only.";
+  report.status = "DETECTED";
+  report.note = "Detection complete — verification is the NEXT mandatory step (do not stop here). " + "Every finding is a HYPOTHESIS until verified: strike_verify (HTTP reflection, marker + negative control), " + "verify_file_read (CWE-22 / path traversal), or drive_devtools (DOM/JS precision). " + "Verify each finding NOW, then generate_report. Never deliver a report with unverified findings.";
   const executedState = "select_chain";
   const scopeAllowed = report.scope?.allowed ?? false;
   const plan = buildPlan(scopeAllowed, mode, executedState);
@@ -34586,8 +34586,8 @@ async function runLiveEngagement(url, scope = "", mode = "bug-bounty") {
       line: 1
     })))
   };
-  report.status = "COMPLETE";
-  report.note = "Autonomous live engagement — full recon + deterministic security checks (reflected " + "input, security headers, open redirect, path traversal, CORS, SSTI, SSRF, SQLi, " + "command injection, XSS) + inline report, all in one call. A hit is reported ONLY when " + "confirmed live (negative controls are tracked in `tested`, not findings). Header/" + "redirect/traversal/CORS/SSTI/SSRF/SQLi/command-injection/XSS checks are deterministic " + "observations — a hit is a HYPOTHESIS until strike_verify confirms it.";
+  report.status = "DETECTED";
+  report.note = "Live sweep complete — findings are HYPOTHESES until verified. " + "Verify each with strike_verify (marker + negative control) / drive_devtools, then generate_report. " + "A hit here is a LEAD, not a confirmed vulnerability — proof of impact is the next mandatory step.";
   return report;
 }
 var CHAIN_ID_TO_ESCALATION = {
@@ -56317,7 +56317,9 @@ function createServer() {
     name: "blitzstrike",
     version: VERSION
   }, {
-    instructions: "Blitz Strike — deterministic security-audit toolbelt. You reason; its tools do the deterministic work (scan, taint, verify, evidence).\\n\\n" + "FIRST ACTION (when the user says test / scan / audit / engagement / pentest <URL or path>):\\n" + "- Call run_engagement(target) — or run_autonomous(target) to also get escalation paths. ONE call runs the whole engagement (recon -> sweep -> checks -> report).\\n" + "- NEVER do manual live_recon / blitz_scan first, and never fall back to manual probing. Manual tools are ONLY for follow-up AFTER run_engagement, or when the user names a specific sub-step.\\n\\n" + "RULES (never violate):\\n" + "- A hit is a HYPOTHESIS; live verification (marker + negative control) is the verdict. Never report unverified.\\n" + "- scope_check is intel-only, never gates. No scope = proceed (repo disclaimer carries responsibility). No authorization gate — hunt the target you are given.\\n" + "- strike_verify + live checks AUTO-attempt WAF bypass. Don't report 'needs bypass' without re-probing.\\n" + "- NEVER ask 'should I continue?' / 'say the word' / 'want me to pursue' / 'next?' — that is a hard violation. Execute the full chain autonomously until COMPLETE. Pause only: destructive/DoS consent, external block (OTP/cred), or COMPLETE.\\n" + "- One hard stop: malicious/third-party infra ('find the actor') -> static + takedown only.\\n\\n" + "CHAIN DECISIONS (a confirmed finding is the START, not the end):\\n" + "- For each confirmed finding, enumerate follow-ups with list_chains + chain_links: ESCALATE (what it becomes), CHAIN (compose with other findings), BYPASS, PIVOT (new surface now reachable).\\n" + "- Ask the chain-aware question: 'I found X -> what can I NOW read / do / access?' e.g. SQLi -> query the DB for credentials AND for the Werkzeug console PIN / secrets / source; LFI -> read configs, keys, PIN inputs; cred dump -> crack offline -> authenticate -> privileged actions.\\n" + "- Every follow-up is a HYPOTHESIS — verify each before it enters the report. Don't stop at 'found SQLi'; follow where the chain leads.\\n" + "- EXECUTE follow-ups NOW, not as 'next phase': any leaked source/error -> scan_leaked_source(text) to enumerate sinks (eval/exec/SECRET_KEY/creds) then exploit each; dumped hashes -> crack_hash(hash) now; hidden-content IDOR -> test the direct route. A 'next chain' you write is a TODO — run it, never leave it as a recommendation.\\n\\n" + `DELIVERABLE + PERSISTENCE (recon is INPUT, not output):
+    instructions: "Blitz Strike — deterministic security-audit toolbelt. You reason; its tools do the deterministic work (scan, taint, verify, evidence).\\n\\n" + "FIRST ACTION (when the user says test / scan / audit / engagement / pentest <URL or path>):\\n" + "- Call run_engagement(target) — or run_autonomous(target) to also get escalation paths. ONE call runs the whole engagement (recon -> sweep -> checks -> report).\\n" + "- NEVER do manual live_recon / blitz_scan first, and never fall back to manual probing. Manual tools are ONLY for follow-up AFTER run_engagement, or when the user names a specific sub-step.\\n\\n" + "RULES (never violate):\\n" + `- A hit is a HYPOTHESIS; live verification (marker + negative control) is the verdict. Never report unverified.
+` + `- run_engagement / run_autonomous return status DETECTED (NOT "complete") — that is the signal to VERIFY. After detection you MUST strike_verify (or verify_file_read for CWE-22, drive_devtools for DOM/JS precision) on each finding, then generate_report. Detection without verification is NOT a deliverable.
+` + "- scope_check is intel-only, never gates. No scope = proceed (repo disclaimer carries responsibility). No authorization gate — hunt the target you are given.\\n" + "- strike_verify + live checks AUTO-attempt WAF bypass. Don't report 'needs bypass' without re-probing.\\n" + "- NEVER ask 'should I continue?' / 'say the word' / 'want me to pursue' / 'next?' — that is a hard violation. Execute the full chain autonomously until COMPLETE. Pause only: destructive/DoS consent, external block (OTP/cred), or COMPLETE.\\n" + "- One hard stop: malicious/third-party infra ('find the actor') -> static + takedown only.\\n\\n" + "CHAIN DECISIONS (a confirmed finding is the START, not the end):\\n" + "- For each confirmed finding, enumerate follow-ups with list_chains + chain_links: ESCALATE (what it becomes), CHAIN (compose with other findings), BYPASS, PIVOT (new surface now reachable).\\n" + "- Ask the chain-aware question: 'I found X -> what can I NOW read / do / access?' e.g. SQLi -> query the DB for credentials AND for the Werkzeug console PIN / secrets / source; LFI -> read configs, keys, PIN inputs; cred dump -> crack offline -> authenticate -> privileged actions.\\n" + "- Every follow-up is a HYPOTHESIS — verify each before it enters the report. Don't stop at 'found SQLi'; follow where the chain leads.\\n" + "- EXECUTE follow-ups NOW, not as 'next phase': any leaked source/error -> scan_leaked_source(text) to enumerate sinks (eval/exec/SECRET_KEY/creds) then exploit each; dumped hashes -> crack_hash(hash) now; hidden-content IDOR -> test the direct route. A 'next chain' you write is a TODO — run it, never leave it as a recommendation.\\n\\n" + `DELIVERABLE + PERSISTENCE (recon is INPUT, not output):
 ` + `- The deliverable is a HackerOne-grade FINDING report via generate_report, NEVER a hand-written recon/surface map. Recon is input; confirmed findings are the output.
 ` + `- After recon, VERIFY every lead before it enters the report: strike_verify (marker + negative control) for HTTP, browser_validate for DOM/JS. A lead is a HYPOTHESIS until verified.
 ` + `- A hard block (Cloudflare/WAF/IP-block/captcha) is NOT the end: mark the finding blocked + note the required vantage (residential / authorized / correct-SNI / --resolve direct-to-origin), then CONTINUE to the next lead (origin bypass, non-prod cluster, mobile APK, subdomain).
@@ -56325,6 +56327,9 @@ function createServer() {
 
 ` + "TWO PATHS:\\n" + "- Source path on disk -> blitz_scan / taint_file / eagle_eye2 (static).\\n" + "- Live URL -> live_recon / active_scan / strike_verify (web-hunting).\\n\\n" + `DEEPEN A FINDING: attack_plan(target, tech, params) to get the prioritized vector plan (decide what to test next with data); list_chains (escalation), chain_links (compose), technique_lookup(cls), payload_lookup, bypass_lookup (blocked). Phase doctrine: read_skill(bs-orchestrate-engagement | bs-web-hunting | bs-source-audit | bs-verify-finding). Campaign plan: read_playbook(target-type). On any failure call retry_guidance(signal) / model_fallback(signal) before giving up.
 ` + `KNOWLEDGE BASE (discover, don't guess): skillLookup(topic) / listSkills for the 40 attack-path + hunting skills (ap-*, hp-*, bs-*); list_attack_vectors / attack_vectors(cat) for the 34-category vector taxonomy; taxonomy(kind) for OWASP/CWE/ASVS/API-top-10; read_playbook(type) for the 17 campaign playbooks; list_manuals / read_tool_manual for 317 tool references; list_tools / run_catalog_tool for the 141-tool catalog. Every tool, skill, and data layer is reachable from these.
+` + `PRECISION ANALYSIS — chrome-devtools MCP is MANDATORY, not optional:
+` + `- When a lead needs DOM/JS precision — DOM-XSS sink execution, AJAX endpoint + payload interception, JS runtime errors, redirect chains, SSO/token flow, or anything a static HTML glance cannot prove — call drive_devtools(target). It spawns chrome-devtools-mcp and drives a REAL headless browser (navigate -> list_network_requests -> list_console_messages -> evaluate_script), giving reproducible evidence instead of a guess.
+` + `- Before calling it, check_mcp() to confirm the browser MCP is available; if not, blitzstrike install-tools or npm i -g chrome-devtools-mcp. Never substitute eyeballing minified JS or a static sink guess when a live browser can PROVE it. This is the precision + consistency layer.
 ` + "EXTERNAL MCP SERVERS (verified, connect them — NOT one-shot CLIs): chrome-devtools-mcp (29 tools: list_network_requests/get_network_request for raw HTTP interception, list_console_messages for JS errors + DOM-XSS, evaluate_script to run JS, take_screenshot) -> stdio chrome-devtools-mcp --headless --chromeArg=--no-sandbox --chromeArg=--disable-gpu (as root/container this is MANDATORY or the browser crashes; add --proxyServer http://127.0.0.1:8080 to route through Burp, --acceptInsecureCerts for bad TLS). burp-suite-mcp (proxy history + active scan + repeater) -> NOT npm: build the JAR (git clone https://github.com/PortSwigger/mcp-server.git && cd mcp-server && ./gradlew embedProxyJar), load it in Burp Extensions, then connect the client to http://127.0.0.1:9876 (SSE) or the stdio proxy java -jar mcp-proxy-all.jar --sse-url http://127.0.0.1:9876."
   });
   server.registerTool("blitz_scan", {

package/manuals/playbooks/verify-phase.md

@@ -0,0 +1,34 @@
+# Verify Phase — turn hypotheses into verdicts (no babysitting)
+
+Use this AFTER detection (run_engagement / run_autonomous returns status DETECTED).
+Detection is INPUT. Verification is the work that produces a FINDING.
+
+## Iron rule
+A hit is a HYPOTHESIS. Live verification (marker + negative control) is the verdict.
+Never report unverified. Sink is not a vulnerability — prove the impact.
+
+## Verdict recipe (per lead)
+For EVERY lead, run marker + negative control and record the raw response (SHA-256 tagged):
+
+| Verdict | Condition | Next |
+|---|---|---|
+| CONFIRMED | marker reflected/read AND control inert | finding_create + evidence + CVSS |
+| FALSE_POSITIVE | marker AND control both reflected (indistinguishable) | reject the finding |
+| UNCONFIRMED | marker not reflected | refine payload once, then mark |
+| BLOCKED | request failed / auth gate / WAF | record required vantage, MOVE ON |
+
+## Tool mapping (call the deterministic verifier, don't eyeball)
+- HTTP reflection / injection → `strike_verify` (marker + negative control + WAF bypass auto)
+- CWE-22 / path traversal / LFI → `verify_file_read` (marker `/etc/passwd` vs non-existent control)
+- DOM-XSS / AJAX interception / JS errors / redirect chains / SSO-token flow → `drive_devtools` (MANDATORY precision layer)
+- Before browser precision → `check_mcp` to confirm chrome-devtools-mcp is available
+
+## No-babysitting rules
+- Execute every lead until confirmed/blocked — NEVER ask "should I continue?".
+- confirmed → escalate (list_chains + chain_links) and follow where the chain leads NOW, not "next phase".
+- blocked → note the vantage and continue to the next lead; a hard block is not the end.
+- Stop only: destructive/DoS consent, external block (OTP/creds), or COMPLETE.
+
+## Deliverable
+When every lead is confirmed / blocked / false-positive → `generate_report` with all findings
+(each carrying evidence). The report is the output — never a hand-written surface map.

package/manuals-index.json

@@ -335,6 +335,7 @@
     "web-application": "playbooks/web-application.md",
     "cloud-native-assessment": "playbooks/cloud-native-assessment.md",
     "forensics-triage": "playbooks/forensics-triage.md",
-    "external-attack-surface": "playbooks/external-attack-surface.md"
+    "external-attack-surface": "playbooks/external-attack-surface.md",
+    "verify-phase": "playbooks/verify-phase.md"
   }
-}
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.13",
+  "version": "2.4.15",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {