blitzstrike 2.4.163 → 2.4.164

package/CHANGELOG.md

@@ -5,6 +5,17 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.164] — 2026-10-11
+
+### Fixed — binary-search case regression on case-insensitive DBMS
+
+- The binary-search charset is now DBMS-aware: MySQL/MSSQL (case-insensitive
+  default collation) use a lowercase-only set, so `> ` ordering isn't ambiguous
+  and extraction no longer returns wrong case (was "SECURITy"/"ROOT@LOCALHOST";
+  now "security"/"root@localhost"). Case-sensitive DBMS keep the full ASCII set.
+- Verified end-to-end on sqli-labs Less-8 (blind boolean): oracle 5 SQL signals →
+  confirm both channels → extract version/database/user all correct case.
+
 ## [2.4.163] — 2026-10-11
 
 ### Added — cookie discovery in live_recon (hint-free injection surface)

package/dist/index.js

@@ -62659,7 +62659,8 @@ async function blindSqliExtract(baseUrl, param, value, dbms, target, opts = {})
     }
   }
   const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789{}_/.-:@";
-  const bsCharset = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+  const caseInsensitive = p.dbms === "mysql" || p.dbms === "mssql";
+  const bsCharset = caseInsensitive ? "0123456789abcdefghijklmnopqrstuvwxyz" : "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
   const baseTpl = (channel === "time" ? p.extraction.time : p.extraction.boolean).replace(/^'/, ctx);
   const render = (tpl, pos, ch) => `${value}${tpl.replace(/\{query\}/g, queryExpr).replace(/\{pos\}/g, String(pos)).replace(/\{char\}/g, ch).replace(/\{sec\}/g, "1")}`;
   const isTrue = async (tpl, pos, ch) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.163",
+  "version": "2.4.164",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {