blitzstrike 2.4.167 → 2.4.168

package/CHANGELOG.md

@@ -5,6 +5,20 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.168] — 2026-10-11
+
+### Fixed — blind_sqli_extract: space extraction + drift-proof time fallback
+
+- Added SPACE (+ parens/comma) to the extraction linear-fallback charset, so
+  version/database strings with embedded spaces (e.g. "Microsoft SQL Server 2012")
+  extract fully instead of stopping at the first space.
+- Auto-fall back to the TIME oracle when a marker-less byte-count boolean oracle
+  extracts nothing — the time oracle is deterministic and immune to page-size
+  drift on dynamic remote pages.
+- Excluded WAF-sensitive chars (#, =, <, >, quotes, %, &, ;, |, *) from the
+  charset: a WAF that strips one of them turns the comparison into `= ''`
+  (always-true past the string end), which previously produced a false trailing run.
+
 ## [2.4.167] — 2026-10-11
 
 ### Fixed — blind_oracle detection false-negative + false-positive (real target)

package/dist/index.js

@@ -62729,7 +62729,7 @@ async function blindSqliExtract(baseUrl, param, value, dbms, target, opts = {})
       }
     }
   }
-  const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789{}_/.-:@";
+  const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789{}_/.-:@(), ";
   const caseInsensitive = p.dbms === "mysql" || p.dbms === "mssql";
   const bsCharset = caseInsensitive ? "0123456789abcdefghijklmnopqrstuvwxyz" : "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
   const baseTpl = (channel === "time" ? p.extraction.time : p.extraction.boolean).replace(/^'/, ctx);
@@ -62792,6 +62792,9 @@ async function blindSqliExtract(baseUrl, param, value, dbms, target, opts = {})
     out += ch;
   }
   out = out.trimEnd();
+  if (out.length === 0 && channel === "boolean" && !marker) {
+    return await blindSqliExtract(baseUrl, param, value, dbms, target, { ...opts, channel: "time" });
+  }
   return {
     dbms,
     target,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.167",
+  "version": "2.4.168",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {