blitzstrike 2.4.17 → 2.4.19

package/CHANGELOG.md

@@ -5,6 +5,31 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.19] — 2026-09-14
+
+### Added — unit tests for 5 deep modules + off-by-one fix
+
+- 25 new hermetic checks: chain-executor dispatch (scan/crack/defer), memory
+  lifecycle (remember/dedup/lookup/forget), complex-bugs (deserialization /
+  type-juggling / mass-assignment / prototype-pollution / SSRF / SSTI / XXE),
+  route-confusion (dynamic dispatch/method/include/batch), universal-taint
+  (PHP command-injection + sanitizer suppression + language detection).
+- Fixed an off-by-one in `detectBatchForwarding`: a single-line
+  `foreach (...) { forward(...); }` was missed because the body scan skipped the
+  `foreach` line itself.
+
+## [2.4.18] — 2026-09-14
+
+### Fixed — catalog placeholder installs (full audit)
+
+- 3 Go tools that had a placeholder install now install for real:
+  cloudfox / ligolo-ng (`go install …@latest`), gophish (`go build`).
+- 4 GUI/C2/versioned tools (havoc, ghidra, cutter, velociraptor) + burp-suite-mcp
+  are now flagged `installable: false` — bulk-install reports them as "manual
+  (install by hand)" instead of failing on a fake "download from github releases".
+- `ensureTool` / `ensure_tool` now return `action: manual` + the note for these
+  tools instead of attempting the placeholder command.
+
 ## [2.4.17] — 2026-09-14
 
 ### Added — auto-provision toolchains + non-interactive installs

package/dist/index.js

@@ -7553,6 +7553,9 @@ function ensureTool(name) {
   if (!t) {
     return { found: false, query: name, suggestions: tools.slice(0, 5).map((x) => x.name) };
   }
+  if (t.installable === false) {
+    return { name: t.name, installed: false, action: "manual", note: t.note ?? "manual install (GUI/C2/versioned — install by hand)" };
+  }
   const check = spawnSync(t.check_installed.command, { shell: true, timeout: 15000 });
   if (check.status !== 127 && check.error === undefined) {
     return { name: t.name, installed: true, action: "none", note: "already installed" };
@@ -7650,6 +7653,10 @@ function ensureToolAsync(name, timeoutMs = 300000) {
       resolve({ found: false, query: name });
       return;
     }
+    if (t.installable === false) {
+      resolve({ name: t.name, installed: false, action: "manual", note: t.note ?? "manual install (GUI/C2/versioned — install by hand)" });
+      return;
+    }
     const check = spawn(t.check_installed.command, { shell: true, timeout: 15000 });
     check.on("error", () => {});
     check.on("close", (code) => {
@@ -7699,9 +7706,9 @@ function ensureToolAsync(name, timeoutMs = 300000) {
 }
 async function installAllTools(opts = {}) {
   const tools = loadTools();
-  const skippedMcp = tools.filter((t) => t.category === "mcp-server" && t.installable !== true).map((t) => t.name);
+  const skippedManual = tools.filter((t) => t.installable === false).map((t) => t.name);
   const cat = opts.category?.toLowerCase();
-  const targets = tools.filter((t) => (t.category !== "mcp-server" || t.installable === true) && (!cat || t.category === cat));
+  const targets = tools.filter((t) => t.installable !== false && (!cat || t.category === cat));
   const concurrency = Math.max(1, opts.concurrency ?? 4);
   const results = [];
   let idx = 0;
@@ -7723,7 +7730,7 @@ async function installAllTools(opts = {}) {
     installed,
     already_installed: already,
     failed,
-    skipped_mcp_servers: skippedMcp,
+    skipped_manual: skippedManual,
     results
   };
 }
@@ -16056,11 +16063,13 @@ async function runInstallTools(args) {
   await Promise.resolve().then(() => init_catalog());
   if (dryRun) {
     const tools = loadTools();
-    const mcp = tools.filter((t) => t.category === "mcp-server" && t.installable !== true);
-    const targets = tools.filter((t) => (t.category !== "mcp-server" || t.installable === true) && (!category || t.category === category.toLowerCase()));
-    console.log(`Dry run — would attempt ${targets.length} tool(s); ${mcp.length} MCP server(s) skipped (GUI/daemon — connect, not install):`);
+    const manual = tools.filter((t) => t.installable === false);
+    const targets = tools.filter((t) => t.installable !== false && (!category || t.category === category.toLowerCase()));
+    console.log(`Dry run — would attempt ${targets.length} tool(s); ${manual.length} manual/skipped (GUI/C2/versioned — install by hand):`);
     for (const t of targets)
       console.log(`  ${t.category.padEnd(11)} ${t.name}`);
+    for (const t of manual)
+      console.log(`  [skip] ${t.name} — ${t.note ?? "manual install"}`);
     return;
   }
   console.log(`Installing catalog tools${category ? ` (category: ${category})` : ""} — concurrency ${concurrency}
@@ -16071,7 +16080,7 @@ async function runInstallTools(args) {
 `);
   }
   const tools = loadTools();
-  const totalTargets = tools.filter((t) => (t.category !== "mcp-server" || t.installable === true) && (!category || t.category === category.toLowerCase())).length;
+  const totalTargets = tools.filter((t) => t.installable !== false && (!category || t.category === category.toLowerCase())).length;
   let done = 0;
   const r = await installAllTools({
     category,
@@ -16085,9 +16094,9 @@ async function runInstallTools(args) {
   });
   console.log(`
 Summary: ${r.target_count} targets · ${r.installed} newly installed · ${r.already_installed} already present · ${r.failed} failed`);
-  const mcp = r.skipped_mcp_servers;
-  if (mcp.length)
-    console.log(`Skipped MCP servers (connect them): ${mcp.join(", ")}`);
+  const manual = r.skipped_manual;
+  if (manual.length)
+    console.log(`Skipped manual tools (GUI/C2/versioned — install by hand): ${manual.join(", ")}`);
   const failedList = r.results.filter((x) => x.installed !== true);
   if (failedList.length) {
     console.log(`
@@ -55673,7 +55682,7 @@ function detectBatchForwarding(code, file, out) {
   let m;
   while ((m = BATCH_LOOP_RE.exec(code)) !== null) {
     const ln = lineNo(code, m.index);
-    const body = lines(code).slice(ln, ln + 8).join(`
+    const body = lines(code).slice(ln - 1, ln + 8).join(`
 `);
     const forwards = /\b(call_user_func|forward|dispatch|resolve_route|invoke|handle|route)\s*\(/i.test(body);
     if (!forwards)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.17",
+  "version": "2.4.19",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {

package/tools-catalog.json

@@ -2696,7 +2696,7 @@
         }
       ],
       "install": {
-        "linux": "download from github releases",
+        "linux": "go install github.com/nicocha30/ligolo-ng@latest",
         "darwin": "manual",
         "win32": "manual"
       },
@@ -2823,7 +2823,9 @@
       ],
       "requires_root": false,
       "pipes": [],
-      "homepage": ""
+      "homepage": "",
+      "installable": false,
+      "note": "C2 framework — source build (Go + Qt), manual setup"
     },
     {
       "name": "metasploit",
@@ -2912,7 +2914,7 @@
         }
       ],
       "install": {
-        "linux": "download from github releases",
+        "linux": "git clone --depth 1 https://github.com/gophish/gophish.git && cd gophish && go build && cp gophish /usr/local/bin/",
         "darwin": "manual",
         "win32": "manual"
       },
@@ -3477,7 +3479,9 @@
       "alternatives": [],
       "requires_root": false,
       "pipes": [],
-      "homepage": ""
+      "homepage": "",
+      "installable": false,
+      "note": "DFIR agent — versioned binary download, manual"
     },
     {
       "name": "ghidra",
@@ -3512,7 +3516,9 @@
       ],
       "requires_root": false,
       "pipes": [],
-      "homepage": ""
+      "homepage": "",
+      "installable": false,
+      "note": "GUI reverse-engineering suite (Java) — download from NSA GitHub releases, manual"
     },
     {
       "name": "radare2",
@@ -3627,7 +3633,9 @@
       ],
       "requires_root": false,
       "pipes": [],
-      "homepage": ""
+      "homepage": "",
+      "installable": false,
+      "note": "GUI reverse-engineering suite (Rizin-based) — AppImage download, manual"
     },
     {
       "name": "gdb",
@@ -4841,7 +4849,7 @@
         }
       ],
       "install": {
-        "linux": "download from github releases",
+        "linux": "go install github.com/BishopFox/cloudfox@latest",
         "darwin": "manual",
         "win32": "manual"
       },
@@ -5633,7 +5641,8 @@
       "requires_root": false,
       "pipes": [],
       "homepage": "https://github.com/PortSwigger/mcp-server",
-      "installable": false
+      "installable": false,
+      "note": "Java GUI (Burp) — build JAR + load in Burp Extensions, then connect SSE"
     }
   ]
 }