blitzstrike 2.4.25 → 2.4.26

package/CHANGELOG.md

@@ -5,6 +5,21 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.26] — 2026-09-14
+
+### Added — derived success_probability + estimated_time + plan modes
+
+- `attack_plan` now returns, per vector, a DERIVED success_probability
+  (relevance prior: clamp(0.85 - 0.15*(priority-1), 0.25, 0.85) — priority 1 =
+  0.85 down to priority 4 = 0.40) and estimated_time_sec (from an
+  operation-class table: passive/config < injection < deep/manual), plus a
+  total_estimated_time_sec.
+- New `mode` param: full (all vectors) / quick (priority<=2) / stealth
+  (passive/config vectors only) — objective-based planning like HexStrike's
+  decision engine, but DERIVED (not hardcoded 0.8/0.9 guesses).
+- success_probability is a PLANNING prior, deliberately distinct from the
+  evidence-backed confidence (computeConfidence) — documented in the tool.
+
 ## [2.4.25] — 2026-09-14
 
 ### Doctrine — "if you can continue, why not? if possible, why not try?"

package/dist/index.js

@@ -32486,7 +32486,55 @@ var TECH_HINTS = {
   aspnet: ["deserialization", "viewstate"],
   nextjs: ["ssrf", "idor"]
 };
-function attackPlan(target, tech = [], params = []) {
+var STEALTH_VECTORS = new Set([
+  "cors_misconfiguration",
+  "jwt",
+  "open_redirect",
+  "idor",
+  "auth_bypass",
+  "rest_api_auth",
+  "debug_mode",
+  "actuator_exposure",
+  "viewstate",
+  "xmlrpc"
+]);
+var VECTOR_TIME = {
+  cors_misconfiguration: 90,
+  jwt: 90,
+  open_redirect: 120,
+  debug_mode: 90,
+  actuator_exposure: 90,
+  viewstate: 120,
+  xmlrpc: 120,
+  rest_api_auth: 120,
+  xss: 180,
+  sql_injection: 180,
+  ssti: 180,
+  ssrf: 180,
+  command_injection: 180,
+  path_traversal: 180,
+  lfi: 180,
+  nosql_injection: 180,
+  mass_assignment: 180,
+  prototype_pollution: 180,
+  xxe: 240,
+  file_upload: 240,
+  deserialization: 240,
+  pickle_deserialization: 240,
+  idor: 300,
+  auth_bypass: 300,
+  business_logic: 360,
+  upload_rce: 300,
+  wp_plugin_audit: 600
+};
+var DEFAULT_VECTOR_TIME = 180;
+function successProbability(priority) {
+  return Math.round(Math.min(0.85, Math.max(0.25, 0.85 - 0.15 * (priority - 1))) * 100) / 100;
+}
+function estimateTime(vector) {
+  return VECTOR_TIME[vector] ?? DEFAULT_VECTOR_TIME;
+}
+function attackPlan(target, tech = [], params = [], mode = "full") {
   const data = loadJson("attack_vectors");
   const totalCategories = data?.categories.length ?? 0;
   const plan = BASE_VECTORS.map((v) => ({ ...v, source: "base" }));
@@ -32510,18 +32558,27 @@ function attackPlan(target, tech = [], params = []) {
     for (const h of hints)
       add(h, 2, `tech '${t}' suggests ${h}`, "technique_lookup / read_skill", "tech");
   }
-  const sorted = plan.sort((a, b) => a.priority - b.priority || a.vector.localeCompare(b.vector));
+  let sorted = plan.sort((a, b) => a.priority - b.priority || a.vector.localeCompare(b.vector));
+  if (mode === "quick")
+    sorted = sorted.filter((p) => p.priority <= 2);
+  else if (mode === "stealth")
+    sorted = sorted.filter((p) => STEALTH_VECTORS.has(p.vector));
+  const totalTime = sorted.reduce((s, p) => s + estimateTime(p.vector), 0);
   return {
     target,
+    mode,
     taxonomy: { total_categories: totalCategories, total_vectors_here: sorted.length },
     plan: sorted.map((p, i) => ({
       order: i + 1,
       vector: p.vector,
       priority: p.priority,
+      success_probability: successProbability(p.priority),
+      estimated_time_sec: estimateTime(p.vector),
       reason: p.reason,
       tool: p.tool,
       source: p.source
-    }))
+    })),
+    total_estimated_time_sec: totalTime
   };
 }
 var PACKAGE_PAYLOADS = join8(ROOT3, "payloads");
@@ -57107,14 +57164,15 @@ ${statusLine}` : statusLine },
   });
   server.registerTool("attack_plan", {
     title: "Prioritized attack-vector plan for a target",
-    description: "DECISION: return the prioritized attack-vector plan for a target — the vectors to test (injection vectors always listed, then param/tech hints add + reprioritize), each with a reason and the specific tool. Call this AFTER run_engagement recon to decide what to test next with data instead of guessing.",
+    description: "DECISION: return the prioritized attack-vector plan for a target — the vectors to test (injection vectors always listed, then param/tech hints add + reprioritize), each with a reason, the specific tool, a DERIVED success_probability (relevance prior) and estimated_time_sec. Pass mode: full (all vectors) / quick (priority<=2 only) / stealth (passive/config vectors only). Call this AFTER run_engagement recon to decide what to test next with data instead of guessing.",
     inputSchema: {
       target: string2().describe("Target URL/host"),
       tech: array(string2()).optional().describe("Detected technologies (from recon)"),
-      params: array(string2()).optional().describe("Discovered input parameters (from recon)")
+      params: array(string2()).optional().describe("Discovered input parameters (from recon)"),
+      mode: _enum(["full", "quick", "stealth"]).optional().describe("Plan mode: full (default) / quick (top-priority only) / stealth (passive vectors only)")
     }
-  }, async ({ target, tech, params }) => {
-    return { content: [{ type: "text", text: JSON.stringify(attackPlan(target, tech ?? [], params ?? [])) }] };
+  }, async ({ target, tech, params, mode }) => {
+    return { content: [{ type: "text", text: JSON.stringify(attackPlan(target, tech ?? [], params ?? [], mode ?? "full")) }] };
   });
   server.registerTool("payload_lookup", {
     title: "Look up exploit payloads",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.25",
+  "version": "2.4.26",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {