blitzstrike 2.4.149 → 2.4.150

package/CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.150] — 2026-10-11
+
+### Fixed — func-paren-split WAF bypass (MySQL 8.0 correctness)
+
+- Lab-verified correction: `SUBSTRING/**/(...)` (comment between a function name
+  and its paren) does NOT work on MySQL 8.0 — IGNORE_SPACE was removed in 8.0, so
+  the parser treats it as a stored-function call. It only works on MySQL ≤5.7.
+- Added the correct MySQL 8.0 function-name-filter bypasses: `sUbStRiNg()` case
+  swap + `SUBSTR()` / `MID()` / `SUBSTRING_INDEX()` aliases. Verified against a
+  live MySQL 8.0 blind-SQLi lab (boolean oracle, version/db/user/flag extracted).
+  539/539 tests.
+
 ## [2.4.149] — 2026-10-10
 
 ### Added — exhaustion checklist tool + English terminology

package/dist/index.js

@@ -59810,9 +59810,9 @@ var WAF_BYPASS_GENERIC = [
   {
     category: "func-paren-split",
     techniques: [
-      "SUBSTRING/**/(...) — comment between function name and (",
-      "SUBSTR/*x*/(...) — comment with content",
-      "FUNC/*!50000*/(...) — version-gated inline comment (MySQL)"
+      "SUBSTRING/**/(...) — comment between function name and ( — MySQL ≤5.7 ONLY (IGNORE_SPACE; removed in 8.0)",
+      "SUBSTR/*x*/(...) — comment with content (same ≤5.7 caveat)",
+      "MySQL 8.0 alternative: sUbStRiNg(...) case-swap + SUBSTR()/MID()/SUBSTRING_INDEX() aliases"
     ]
   },
   {
@@ -59889,6 +59889,7 @@ var WAF_BYPASS_DBMS = {
       category: "mysql-specific",
       techniques: [
         "/*!50000...*/ inline comment — MySQL executes, old WAF ignores",
+        "function-name filter (8.0): sUbStRiNg() case-swap + SUBSTR()/MID()/SUBSTRING_INDEX() aliases — comment-between-func-and-paren does NOT work on 8.0",
         "BENCHMARK(10000000,MD5(1)) as SLEEP alternative",
         "backtick obfuscation: SELECT `column` FROM `table`",
         "-- - and # comment terminators",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.149",
+  "version": "2.4.150",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {