blitzstrike 2.4.162 → 2.4.164

package/CHANGELOG.md

@@ -5,6 +5,27 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.164] — 2026-10-11
+
+### Fixed — binary-search case regression on case-insensitive DBMS
+
+- The binary-search charset is now DBMS-aware: MySQL/MSSQL (case-insensitive
+  default collation) use a lowercase-only set, so `> ` ordering isn't ambiguous
+  and extraction no longer returns wrong case (was "SECURITy"/"ROOT@LOCALHOST";
+  now "security"/"root@localhost"). Case-sensitive DBMS keep the full ASCII set.
+- Verified end-to-end on sqli-labs Less-8 (blind boolean): oracle 5 SQL signals →
+  confirm both channels → extract version/database/user all correct case.
+
+## [2.4.163] — 2026-10-11
+
+### Added — cookie discovery in live_recon (hint-free injection surface)
+
+- `live_recon` now reports cookies as name+value pairs (`cookies` field) parsed
+  from the Set-Cookie header(s), plus a next-step telling the LLM to probe each
+  with `blind_sqli_confirm`/`blind_sqli_extract`. Cookies (e.g. PortSwigger's
+  `TrackingId`) are a first-class injection surface invisible to URL/param scans;
+  this lets the LLM discover a cookie-based blind-SQLi point WITHOUT the lab hint.
+
 ## [2.4.162] — 2026-10-11
 
 ### Added — binary-search extraction + marker oracle (blind SQLi)

package/dist/index.js

@@ -37159,6 +37159,26 @@ function extractParams(urls) {
   }
   return [...params];
 }
+function extractCookieNames(headers) {
+  const sc = headers["set-cookie"] ?? "";
+  if (!sc)
+    return [];
+  const out = [];
+  const seen = new Set;
+  for (const part of sc.split(",")) {
+    const seg = part.trim().split(";")[0].trim();
+    const eq = seg.indexOf("=");
+    if (eq <= 0)
+      continue;
+    const name = seg.slice(0, eq).trim();
+    const value = seg.slice(eq + 1).trim();
+    if (/^[A-Za-z0-9_.-]+$/.test(name) && !seen.has(name)) {
+      seen.add(name);
+      out.push({ name, value });
+    }
+  }
+  return out;
+}
 async function subdomainEnum(domain) {
   const out = new Set;
   try {
@@ -37481,6 +37501,7 @@ async function liveRecon(target, includeActive = false) {
   const allUrls = [...links, ...scripts, ...robots, ...sitemap];
   const crawl = { links, scripts, endpoints: [...new Set(allUrls)], robots, sitemap, count: allUrls.length };
   const params = extractParams(allUrls);
+  const cookies = extractCookieNames(root.headers);
   const [subRes, dnsRes, waybackRes, apiRes] = await Promise.all([
     subdomainEnum(host),
     dnsBrute(host),
@@ -37519,6 +37540,8 @@ async function liveRecon(target, includeActive = false) {
     nextSteps.push(`Found ${crawl.endpoints.length} endpoints — feed them to taint_file/blitz_scan for source analysis, or strike_verify for live validation.`);
   if (params.length > 0)
     nextSteps.push(`Discovered input params: ${params.join(", ")} — these are attack-surface entry points; fuzz them with payload_lookup after scope confirms.`);
+  if (cookies.length > 0)
+    nextSteps.push(`Discovered cookies: ${cookies.map((c) => c.name).join(", ")} — cookies are a first-class injection surface (blind SQLi / XSS / auth) invisible to URL/param scans; probe each with blind_sqli_confirm + blind_sqli_extract (cookie= param).`);
   if (subdomains.length > 0)
     nextSteps.push(`Found ${subdomains.length} subdomains — each is a separate scope surface; enumerate further with fofa_search.`);
   if (dnsFindings.length > 0)
@@ -37545,6 +37568,7 @@ async function liveRecon(target, includeActive = false) {
     suggested_surfaces: surfaces.map((s) => ({ id: s.id, name: s.name, high_value_tests: s.high_value_tests, matched_fingerprints: s.hits })),
     crawl,
     params,
+    cookies,
     subdomains,
     dns_findings: dnsFindings,
     wayback_urls: wayback,
@@ -62635,7 +62659,8 @@ async function blindSqliExtract(baseUrl, param, value, dbms, target, opts = {})
     }
   }
   const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789{}_/.-:@";
-  const bsCharset = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+  const caseInsensitive = p.dbms === "mysql" || p.dbms === "mssql";
+  const bsCharset = caseInsensitive ? "0123456789abcdefghijklmnopqrstuvwxyz" : "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
   const baseTpl = (channel === "time" ? p.extraction.time : p.extraction.boolean).replace(/^'/, ctx);
   const render = (tpl, pos, ch) => `${value}${tpl.replace(/\{query\}/g, queryExpr).replace(/\{pos\}/g, String(pos)).replace(/\{char\}/g, ch).replace(/\{sec\}/g, "1")}`;
   const isTrue = async (tpl, pos, ch) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.162",
+  "version": "2.4.164",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {