blitzstrike 2.4.181 → 2.4.182

package/CHANGELOG.md

@@ -5,7 +5,15 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
-## [2.4.180] — 2026-10-11
+## [2.4.182] — 2026-10-11
+
+### Added — HTTP-level asset fingerprinting (Shodan-style MMH3)
+
+- New `favicon_hash` tool + `src/fingerprint.ts`: MurmurHash3 (x86 32-bit) favicon
+  fingerprint — the Shodan-compatible `http.favicon.hash` (verified against the
+  python `mmh3` reference: 9/9 vectors match) — plus body SHA-256 for content dedup
+  and the base64 `mmh3:` form. The same favicon hash means the same product/tech
+  even across unrelated hosts, so it is the strongest web-asset pivoting signal.
 
 ### Changed — goal decomposition corrected (goal = deliverable, not process)
 
@@ -20,7 +28,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
   a new target discovered outside the constraints is recorded as an out-of-scope
   fact and skipped, never authorized.
 
-### Added — 4 doctrine rules
+### Added — 6 doctrine rules
 
 - `constraint_self_contained`, `record_is_memory` (write-back is anti-compaction
   long-term memory — record immediately, only increments), `wrapup_highest_priority`

package/dist/index.js

@@ -64119,6 +64119,81 @@ function coverageSummary() {
   };
 }
 
+// src/fingerprint.ts
+function mmh3(data, seed = 0) {
+  const c1 = 3432918353;
+  const c2 = 461845907;
+  let h1 = seed | 0;
+  const len = data.length;
+  const nblocks = len >> 2;
+  for (let i = 0;i < nblocks; i++) {
+    const o = i << 2;
+    let k1 = data[o] | data[o + 1] << 8 | data[o + 2] << 16 | data[o + 3] << 24 | 0;
+    k1 = Math.imul(k1, c1) | 0;
+    k1 = k1 << 15 | k1 >>> 17;
+    k1 = Math.imul(k1, c2) | 0;
+    h1 ^= k1;
+    h1 = h1 << 13 | h1 >>> 19;
+    h1 = Math.imul(h1, 5) + 3864292196 | 0;
+  }
+  let k1 = 0;
+  const tail = nblocks << 2;
+  switch (len & 3) {
+    case 3:
+      k1 ^= data[tail + 2] << 16;
+    case 2:
+      k1 ^= data[tail + 1] << 8;
+    case 1:
+      k1 ^= data[tail];
+      k1 = Math.imul(k1, c1) | 0;
+      k1 = k1 << 15 | k1 >>> 17;
+      k1 = Math.imul(k1, c2) | 0;
+      h1 ^= k1;
+  }
+  h1 ^= len;
+  h1 ^= h1 >>> 16;
+  h1 = Math.imul(h1, 2246822507) | 0;
+  h1 ^= h1 >>> 13;
+  h1 = Math.imul(h1, 3266489909) | 0;
+  h1 ^= h1 >>> 16;
+  return h1 | 0;
+}
+function faviconHash(bytes) {
+  return mmh3(bytes, 0);
+}
+function fingerprintBundle(faviconBytes, body) {
+  let favicon_mmh3 = null;
+  let favicon_mmh3_b64 = null;
+  if (faviconBytes && faviconBytes.length > 0) {
+    favicon_mmh3 = faviconHash(faviconBytes);
+    const buf = new ArrayBuffer(4);
+    const dv = new DataView(buf);
+    dv.setInt32(0, favicon_mmh3, false);
+    favicon_mmh3_b64 = btoa(String.fromCharCode(...new Uint8Array(buf)));
+  }
+  return { favicon_mmh3, favicon_mmh3_b64, body_sha256: sha256(body) };
+}
+function decodeFavicon(data, encoding = "base64") {
+  try {
+    if (encoding === "hex") {
+      const s = data.replace(/[^0-9a-fA-F]/g, "");
+      if (s.length % 2 !== 0 || s.length === 0)
+        return null;
+      const out = new Uint8Array(s.length / 2);
+      for (let i = 0;i < out.length; i++)
+        out[i] = parseInt(s.slice(i * 2, i * 2 + 2), 16);
+      return out;
+    }
+    const bin = atob(data);
+    const out = new Uint8Array(bin.length);
+    for (let i = 0;i < bin.length; i++)
+      out[i] = bin.charCodeAt(i);
+    return out;
+  } catch {
+    return null;
+  }
+}
+
 // src/sibling-scan.ts
 var SIBLING_SUFFIXES = [
   "export",
@@ -67230,6 +67305,21 @@ ${statusLine}` : statusLine },
       }]
     };
   });
+  server.registerTool("favicon_hash", {
+    title: "Favicon MMH3 hash (Shodan-style asset fingerprint)",
+    description: "RECON: compute the Shodan-compatible MurmurHash3 (MMH3) fingerprint of a favicon (or any raw bytes) — the strongest pivoting signal for web assets: the SAME favicon hash means the SAME product/tech even across unrelated hosts. Pass base64/hex-encoded favicon bytes (or the response body to also get its SHA-256 for content dedup). Use to fingerprint a live target, dedup assets by body hash, and pivot to every host serving the same favicon.",
+    inputSchema: {
+      data: string2().describe("Favicon bytes as base64 (default) or hex"),
+      encoding: _enum(["base64", "hex"]).optional().describe("How `data` is encoded (default base64)"),
+      body: string2().optional().describe("Optional response body — returns its SHA-256 for content-based asset dedup")
+    }
+  }, async ({ data, encoding, body }) => {
+    const bytes = decodeFavicon(data, encoding ?? "base64");
+    if (!bytes)
+      return { content: [{ type: "text", text: JSON.stringify({ error: "invalid favicon data" }) }] };
+    const bundle = fingerprintBundle(bytes, body ?? "");
+    return { content: [{ type: "text", text: JSON.stringify(bundle) }] };
+  });
   server.registerTool("framework_intel", {
     title: "Framework security knowledge",
     description: "PHASE 5: return a framework's security knowledge (sources, sinks, sanitizers, auth gates, routing, ORM, middleware, and — for WordPress — the P1-P6 vulnerability pattern taxonomy: RCE / upload / ATO / reset / priv-esc / AJAX-REST-authz, each with signals, detect, fixed, and anchor WPVDB ids) and optionally scan code with those patterns.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.181",
+  "version": "2.4.182",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {