blitzstrike 2.4.180 → 2.4.182

package/CHANGELOG.md

@@ -5,7 +5,15 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
-## [2.4.180] — 2026-10-11
+## [2.4.182] — 2026-10-11
+
+### Added — HTTP-level asset fingerprinting (Shodan-style MMH3)
+
+- New `favicon_hash` tool + `src/fingerprint.ts`: MurmurHash3 (x86 32-bit) favicon
+  fingerprint — the Shodan-compatible `http.favicon.hash` (verified against the
+  python `mmh3` reference: 9/9 vectors match) — plus body SHA-256 for content dedup
+  and the base64 `mmh3:` form. The same favicon hash means the same product/tech
+  even across unrelated hosts, so it is the strongest web-asset pivoting signal.
 
 ### Changed — goal decomposition corrected (goal = deliverable, not process)
 
@@ -20,12 +28,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
   a new target discovered outside the constraints is recorded as an out-of-scope
   fact and skipped, never authorized.
 
-### Added — 4 doctrine rules
+### Added — 6 doctrine rules
 
 - `constraint_self_contained`, `record_is_memory` (write-back is anti-compaction
   long-term memory — record immediately, only increments), `wrapup_highest_priority`
   (land conclusions then stop), `high_value_surface` (parsing/charset, upload,
-  (de)serialization, cache race, TOCTOU, type confusion, mass assignment).
+  (de)serialization, cache race, TOCTOU, type confusion, mass assignment),
+  `serial_chain_discipline` (each chain step consumes the prior step's REAL output),
+  `compression_discipline` (synthesize causally, preserve observed/inferred + source ids).
 
 ## [2.4.179] — 2026-10-11
 

package/dist/index.js

@@ -63794,6 +63794,16 @@ var HUNTING_DOCTRINE = [
     id: "high_value_surface",
     title: "High-Value Attack Surface — The Often-Overlooked Faces",
     rule: "When mapping the attack surface, prioritize these often-overlooked high-value faces (pick what applies, not a checklist obligation): input parsing / encoding / charset boundaries; file upload; (de)serialization; built-in routing + pre-auth-reachable handlers; error-handling leaks; cache poisoning / cache race; race conditions (TOCTOU); type confusion (scalar vs array); and mass assignment. These are where the highest-impact bugs hide when the obvious endpoints come up clean — before declaring a surface exhausted, confirm none of these faces remain untested."
+  },
+  {
+    id: "serial_chain_discipline",
+    title: "Serial Chain — Each Step Depends on the Prior Step's REAL Output",
+    rule: "For a serial exploitation chain (①→②→③, where each later step consumes the PRIOR step's actual output — a leaked key, an auth cookie, a session id, a written file, a generated nonce): drive it ONE STEP AT A TIME. Execute step ① and capture its REAL output first; only then design and run step ② against that concrete output; never imagine or assume the output of a step you have not actually run, and never plan/execute step ③ while step ②'s prerequisite still does not exist. Across codebases/interfaces, actively pull the FULL detail of every known clue into the current session to chain gadgets together — do not stop at the summary. A chain is only as real as the weakest link you actually produced."
+  },
+  {
+    id: "compression_discipline",
+    title: "Compression — Synthesize Causally, Preserve Confidence + Provenance",
+    rule: "When summarizing or compressing a set of related exploration nodes (facts/intents/findings), do NOT enumerate — synthesize: trace the causality (which fact birthed which intent, which intent produced which conclusion) and state what this region of the exploration CONCLUDED. Preserve distinctions between different conclusions (do not merge them into one vague sentence). Preserve evidence strength: mark observed vs inferred, and flag an inferred NEGATIVE/doubtful conclusion as inference-that-can-be-rechecked, never as a settled fact. Tag each conclusion with its source id(s) (e.g. #12, #28) so it can be traced back. State only what the inputs contain — never introduce a judgment the inputs do not support. Let length follow content: short when the conclusions are few, long only when they are many and genuinely distinct — always well under the sum of the inputs."
   }
 ];
 var DOMAIN_EXHAUSTION_CHECKLIST = [
@@ -64109,6 +64119,81 @@ function coverageSummary() {
   };
 }
 
+// src/fingerprint.ts
+function mmh3(data, seed = 0) {
+  const c1 = 3432918353;
+  const c2 = 461845907;
+  let h1 = seed | 0;
+  const len = data.length;
+  const nblocks = len >> 2;
+  for (let i = 0;i < nblocks; i++) {
+    const o = i << 2;
+    let k1 = data[o] | data[o + 1] << 8 | data[o + 2] << 16 | data[o + 3] << 24 | 0;
+    k1 = Math.imul(k1, c1) | 0;
+    k1 = k1 << 15 | k1 >>> 17;
+    k1 = Math.imul(k1, c2) | 0;
+    h1 ^= k1;
+    h1 = h1 << 13 | h1 >>> 19;
+    h1 = Math.imul(h1, 5) + 3864292196 | 0;
+  }
+  let k1 = 0;
+  const tail = nblocks << 2;
+  switch (len & 3) {
+    case 3:
+      k1 ^= data[tail + 2] << 16;
+    case 2:
+      k1 ^= data[tail + 1] << 8;
+    case 1:
+      k1 ^= data[tail];
+      k1 = Math.imul(k1, c1) | 0;
+      k1 = k1 << 15 | k1 >>> 17;
+      k1 = Math.imul(k1, c2) | 0;
+      h1 ^= k1;
+  }
+  h1 ^= len;
+  h1 ^= h1 >>> 16;
+  h1 = Math.imul(h1, 2246822507) | 0;
+  h1 ^= h1 >>> 13;
+  h1 = Math.imul(h1, 3266489909) | 0;
+  h1 ^= h1 >>> 16;
+  return h1 | 0;
+}
+function faviconHash(bytes) {
+  return mmh3(bytes, 0);
+}
+function fingerprintBundle(faviconBytes, body) {
+  let favicon_mmh3 = null;
+  let favicon_mmh3_b64 = null;
+  if (faviconBytes && faviconBytes.length > 0) {
+    favicon_mmh3 = faviconHash(faviconBytes);
+    const buf = new ArrayBuffer(4);
+    const dv = new DataView(buf);
+    dv.setInt32(0, favicon_mmh3, false);
+    favicon_mmh3_b64 = btoa(String.fromCharCode(...new Uint8Array(buf)));
+  }
+  return { favicon_mmh3, favicon_mmh3_b64, body_sha256: sha256(body) };
+}
+function decodeFavicon(data, encoding = "base64") {
+  try {
+    if (encoding === "hex") {
+      const s = data.replace(/[^0-9a-fA-F]/g, "");
+      if (s.length % 2 !== 0 || s.length === 0)
+        return null;
+      const out = new Uint8Array(s.length / 2);
+      for (let i = 0;i < out.length; i++)
+        out[i] = parseInt(s.slice(i * 2, i * 2 + 2), 16);
+      return out;
+    }
+    const bin = atob(data);
+    const out = new Uint8Array(bin.length);
+    for (let i = 0;i < bin.length; i++)
+      out[i] = bin.charCodeAt(i);
+    return out;
+  } catch {
+    return null;
+  }
+}
+
 // src/sibling-scan.ts
 var SIBLING_SUFFIXES = [
   "export",
@@ -67220,6 +67305,21 @@ ${statusLine}` : statusLine },
       }]
     };
   });
+  server.registerTool("favicon_hash", {
+    title: "Favicon MMH3 hash (Shodan-style asset fingerprint)",
+    description: "RECON: compute the Shodan-compatible MurmurHash3 (MMH3) fingerprint of a favicon (or any raw bytes) — the strongest pivoting signal for web assets: the SAME favicon hash means the SAME product/tech even across unrelated hosts. Pass base64/hex-encoded favicon bytes (or the response body to also get its SHA-256 for content dedup). Use to fingerprint a live target, dedup assets by body hash, and pivot to every host serving the same favicon.",
+    inputSchema: {
+      data: string2().describe("Favicon bytes as base64 (default) or hex"),
+      encoding: _enum(["base64", "hex"]).optional().describe("How `data` is encoded (default base64)"),
+      body: string2().optional().describe("Optional response body — returns its SHA-256 for content-based asset dedup")
+    }
+  }, async ({ data, encoding, body }) => {
+    const bytes = decodeFavicon(data, encoding ?? "base64");
+    if (!bytes)
+      return { content: [{ type: "text", text: JSON.stringify({ error: "invalid favicon data" }) }] };
+    const bundle = fingerprintBundle(bytes, body ?? "");
+    return { content: [{ type: "text", text: JSON.stringify(bundle) }] };
+  });
   server.registerTool("framework_intel", {
     title: "Framework security knowledge",
     description: "PHASE 5: return a framework's security knowledge (sources, sinks, sanitizers, auth gates, routing, ORM, middleware, and — for WordPress — the P1-P6 vulnerability pattern taxonomy: RCE / upload / ATO / reset / priv-esc / AJAX-REST-authz, each with signals, detect, fixed, and anchor WPVDB ids) and optionally scan code with those patterns.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.180",
+  "version": "2.4.182",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {