blitzstrike 2.4.154 → 2.4.155

package/CHANGELOG.md

@@ -5,6 +5,16 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.155] — 2026-10-11
+
+### Fixed — blind_sqli_extract trailing-space runaway
+
+- Removed space from the extraction charset + trimEnd the result: MySQL's
+  trailing-space-insensitive comparison makes `SUBSTRING(x,n,1)=' '` TRUE for an
+  empty (past-the-end) position, which appended infinite trailing spaces to every
+  extracted value. Verified on sqli-labs Less-8: version=5.7.44, database=security,
+  user=root@172.17.0.3 extracted cleanly via the autonomous chain.
+
 ## [2.4.154] — 2026-10-11
 
 ### Added — autonomous blind SQLi extraction (blind_sqli_extract)

package/dist/index.js

@@ -62535,7 +62535,7 @@ async function blindSqliExtract(baseUrl, param, value, dbms, target, opts = {})
       channel = "time";
     }
   }
-  const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789{}_/.-:@ ";
+  const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789{}_/.-:@";
   let out = "";
   for (let pos = 1;pos <= maxlen; pos++) {
     let found = null;
@@ -62557,6 +62557,7 @@ async function blindSqliExtract(baseUrl, param, value, dbms, target, opts = {})
       break;
     out += found;
   }
+  out = out.trimEnd();
   return {
     dbms,
     target,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.154",
+  "version": "2.4.155",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {