blitzstrike 2.4.152 → 2.4.153

package/CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.153] — 2026-10-11
+
+### Fixed — blind_oracle/confirm trailing-slash redirect false-negative
+
+- Real-target bug: `baseUrl.replace(/\/+$/,"")` stripped the trailing slash, so a
+  path-based endpoint (e.g. /Less-8) hit a 301 redirect and the probe hashed the
+  redirect body instead of the real response — causing false negatives that a
+  flat mock lab never exposed. Now the base keeps a trailing slash and fetches
+  follow redirects. Verified against sqli-labs Less-8 (boolean blind) and Less-9
+  (time blind): blind_oracle flags sql context, blind_sqli_confirm reports
+  CONFIRMED via boolean (706b vs 722b) + time (~5001ms vs ~2ms) differentials.
+
 ## [2.4.152] — 2026-10-11
 
 ### Added — autonomous blind SQLi confirmation (blind_sqli_confirm)

package/dist/index.js

@@ -62357,7 +62357,7 @@ function classifyBlindProbe(input) {
   return { same_as_baseline: same, signal, reason };
 }
 async function blindOracle(baseUrl, param, value, opts = {}) {
-  const base = baseUrl.replace(/\/+$/, "");
+  const base = baseUrl.replace(/\/+$/, "") + "/";
   const sinks = opts.sinks ?? ["sql", "ssti", "xss"];
   const timeDbms = opts.timeDbms ?? "mysql";
   const marker = `zz${Math.random().toString(36).slice(2, 10)}zz`;
@@ -62368,7 +62368,7 @@ async function blindOracle(baseUrl, param, value, opts = {}) {
   let baselineSize = 0;
   let baselineStatus = 0;
   try {
-    const r = await fetch(build(value), { headers, redirect: "manual", signal: AbortSignal.timeout(timeoutMs) });
+    const r = await fetch(build(value), { headers, redirect: "follow", signal: AbortSignal.timeout(timeoutMs) });
     baselineStatus = r.status;
     const body = await r.text();
     baselineHash = sha256(body);
@@ -62389,7 +62389,7 @@ async function blindOracle(baseUrl, param, value, opts = {}) {
   for (const p of probes) {
     const t0 = Date.now();
     try {
-      const r = await fetch(build(p.payload), { headers, redirect: "manual", signal: AbortSignal.timeout(timeoutMs) });
+      const r = await fetch(build(p.payload), { headers, redirect: "follow", signal: AbortSignal.timeout(timeoutMs) });
       const timing = Date.now() - t0;
       const status = r.status;
       const body = await r.text();
@@ -62444,7 +62444,7 @@ async function blindOracle(baseUrl, param, value, opts = {}) {
   };
 }
 async function confirmBlindSqli(baseUrl, param, value, dbms = "mysql") {
-  const base = baseUrl.replace(/\/+$/, "");
+  const base = baseUrl.replace(/\/+$/, "") + "/";
   const p = blindSqli(dbms);
   if (!p)
     return { error: `no blind-SQLi playbook for '${dbms}'`, known: ["mysql", "postgresql", "mssql", "oracle", "sqlite"] };
@@ -62452,7 +62452,7 @@ async function confirmBlindSqli(baseUrl, param, value, dbms = "mysql") {
   const build = (payload) => `${base}?${encodeURIComponent(param)}=${encodeURIComponent(payload)}`;
   const fetchSize = async (payload) => {
     try {
-      const r = await fetch(build(payload), { headers, redirect: "manual", signal: AbortSignal.timeout(9000) });
+      const r = await fetch(build(payload), { headers, redirect: "follow", signal: AbortSignal.timeout(9000) });
       const body = await r.text();
       return { ok: true, status: r.status, size: body.length };
     } catch (e) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.152",
+  "version": "2.4.153",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {