blitzstrike 2.4.36 → 2.4.38

package/CHANGELOG.md

@@ -5,6 +5,27 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.38] — 2026-09-14
+
+### Added — Action-Name Heuristic Engine (what to look for WHERE)
+
+- New `src/action-heuristics.ts`: maps WordPress AJAX action-name patterns to
+  their likely vulnerability class (upload/import→AFU/RCE, delete/write→
+  file-write, load/download→LFI, login/reset→auth-bypass, exec/run→command
+  injection, settings/update→unauth options change, …) — as DATA, with real
+  examples (ai1wm_import, revslider_upload, duplicator_download, …).
+- New `action_surface` tool: extract every `wp_ajax_*` action, cross-reference
+  the hook (nopriv?) + authz gap (nonce/capability), and return a DERIVED
+  priority so the scanner targets the most dangerous action first.
+
+## [2.4.37] — 2026-09-14
+
+### Fixed — benchmark top-level recall/f1 (self-audit)
+
+- `run_benchmark` now returns top-level `recall` and `f1` (previously only
+  `detection_rate` held the recall value, and no top-level f1). Matches the
+  per-detector shape for consistency. No functional change.
+
 ## [2.4.36] — 2026-09-14
 
 ### Changed — Framework Knowledge Graph is now MULTI-framework (not WordPress-only)

package/dist/index.js

@@ -56936,6 +56936,8 @@ function runBenchmark() {
   const detectionRate = tp + fn > 0 ? tp / (tp + fn) : 0;
   const falsePositiveRate = fp + tn > 0 ? fp / (fp + tn) : 0;
   const precision = tp + fp > 0 ? tp / (tp + fp) : 0;
+  const recall = detectionRate;
+  const f1 = precision + recall > 0 ? 2 * precision * recall / (precision + recall) : 0;
   const byDetector = {};
   for (const r of results) {
     const d = r.entry.detector ?? "taint";
@@ -56960,6 +56962,8 @@ function runBenchmark() {
     detection_rate: Number(detectionRate.toFixed(3)),
     false_positive_rate: Number(falsePositiveRate.toFixed(3)),
     precision: Number(precision.toFixed(3)),
+    recall: Number(recall.toFixed(3)),
+    f1: Number(f1.toFixed(3)),
     by_detector: detectorMetrics,
     captured_false_positives: {
       total: captured.length,
@@ -57164,6 +57168,101 @@ function variantScan(root, opts = {}) {
   };
 }
 
+// src/action-heuristics.ts
+var ACTION_HEURISTICS = [
+  { pattern: /upload|import|install|activate|plugin|theme/, vuln_class: "Arbitrary File Upload / Plugin Install → RCE", detector: "file_upload + missing_authz", weight: 0.9, examples: ["ai1wm_import", "ocdi_upload_manual_import_files", "alone_import_pack_install_plugin", "revslider_upload"] },
+  { pattern: /write|save|delete|remove|move|rename/, vuln_class: "Arbitrary File Write / Delete / Move", detector: "file_operations", weight: 0.8, examples: ["ai1wm_backup_delete"] },
+  { pattern: /load|include|template|file|download|read/, vuln_class: "LFI / Path Traversal / RFI", detector: "path_traversal + file_inclusion", weight: 0.8, examples: ["duplicator_download", "get_file", "preview"] },
+  { pattern: /exec|run|cmd|shell|eval|code/, vuln_class: "OS Command / Code Injection / eval", detector: "command_execution + code_execution", weight: 0.85, examples: [] },
+  { pattern: /import|unserialize|restore|data/, vuln_class: "Insecure Deserialization / Object Injection", detector: "deserialization", weight: 0.8, examples: [] },
+  { pattern: /query|search|filter|export|list/, vuln_class: "SQLi → RCE / Create Admin", detector: "sql_execution", weight: 0.7, examples: [] },
+  { pattern: /render|shortcode|block|preview/, vuln_class: "SSTI / Shortcode / Block Injection", detector: "ssti", weight: 0.6, examples: [] },
+  { pattern: /settings|option|update/, vuln_class: "Unauth Options Update / Settings Change / Missing Cap+Nonce", detector: "missing_authz + missing_nonce", weight: 0.85, examples: ["woocommerce_*", "elementor_*"] },
+  { pattern: /login|auth|token|reset|verify/, vuln_class: "Auth Bypass / Auto Login / Account Takeover", detector: "missing_authz + type_juggling", weight: 0.9, examples: ["auto-login", "magic link", "reset password"] },
+  { pattern: /role|capability|promote|change_role/, vuln_class: "Privilege Escalation", detector: "missing_authz", weight: 0.9, examples: [] },
+  { pattern: /register|signup|create_user/, vuln_class: "Register → RCE / AFU / PrivEsc", detector: "file_upload + missing_authz", weight: 0.8, examples: [] }
+];
+function mapActionToVuln(action) {
+  const a = action.toLowerCase();
+  for (const h of ACTION_HEURISTICS) {
+    if (h.pattern.test(a)) {
+      return { vuln_class: h.vuln_class, detector: h.detector, weight: h.weight, examples: h.examples };
+    }
+  }
+  return null;
+}
+function actionSurface(code) {
+  const entries = [];
+  const ajaxRe = /add_action\s*\(\s*['"](wp_ajax(?:_nopriv)?_\w+)['"]\s*,\s*['"](\w+)['"]/g;
+  let m;
+  while ((m = ajaxRe.exec(code)) !== null) {
+    const hook = m[1];
+    const handler = m[2];
+    const nopriv = hook.startsWith("wp_ajax_nopriv_");
+    const action = hook.replace(/^wp_ajax(?:_nopriv)?_/, "");
+    const mapped = mapActionToVuln(action);
+    if (!mapped)
+      continue;
+    const body = functionBody2(code, handler);
+    const hasCapability = body ? /current_user_can|is_user_logged_in|authorize/.test(body) : false;
+    const hasNonce = body ? /wp_verify_nonce|check_ajax_referer|check_admin_referer|verify_nonce/.test(body) : false;
+    let priority = mapped.weight;
+    if (nopriv)
+      priority += 0.05;
+    if (!hasCapability)
+      priority += 0.05;
+    if (!hasNonce)
+      priority += 0.05;
+    priority = Math.min(1, Number(priority.toFixed(2)));
+    entries.push({
+      hook,
+      action,
+      nopriv,
+      vuln_class: mapped.vuln_class,
+      detector: mapped.detector,
+      examples: mapped.examples,
+      has_capability: hasCapability,
+      has_nonce: hasNonce,
+      priority
+    });
+  }
+  entries.sort((a, b) => b.priority - a.priority);
+  return {
+    actions: entries.length,
+    prioritized: entries.map((e) => ({
+      action: e.action,
+      hook: e.hook,
+      vuln_class: e.vuln_class,
+      detector: e.detector,
+      priority: e.priority,
+      nopriv: e.nopriv,
+      has_capability: e.has_capability,
+      has_nonce: e.has_nonce,
+      examples: e.examples
+    })),
+    top_priority: entries[0] ?? null
+  };
+}
+function functionBody2(code, name) {
+  const idx = code.search(new RegExp(`function\\s+${name}\\s*\\(`));
+  if (idx === -1)
+    return null;
+  const open = code.indexOf("{", idx);
+  if (open === -1)
+    return null;
+  let depth = 0;
+  for (let i = open;i < code.length; i++) {
+    if (code[i] === "{")
+      depth++;
+    else if (code[i] === "}") {
+      depth--;
+      if (depth === 0)
+        return code.slice(open, i + 1);
+    }
+  }
+  return code.slice(open);
+}
+
 // src/enterprise-benchmark.ts
 import { existsSync as existsSync11, readFileSync as readFileSync20, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
 import { join as join18, resolve } from "node:path";
@@ -58132,6 +58231,26 @@ ${statusLine}` : statusLine },
   }, async ({ root, max_files, signature }) => {
     return { content: [{ type: "text", text: JSON.stringify(variantScan(root, { maxFiles: max_files, signature })) }] };
   });
+  server.registerTool("action_surface", {
+    title: "Action-name attack surface (what to look for WHERE)",
+    description: "TARGETING: extract every wp_ajax_* action name, map it to its likely vuln class (upload/import→AFU/RCE, delete/write→file-write, load/download→LFI, login/reset→auth-bypass, exec/run→command injection, settings/update→unauth options change, etc.), cross-reference the hook (nopriv?) + authz gap (nonce/capability present?), and return a DERIVED priority — so the scanner targets the most dangerous action first, instead of scanning blindly.",
+    inputSchema: {
+      code: string2().optional().describe("Source code (PHP) to analyze"),
+      path: string2().optional().describe("OR a source file path")
+    }
+  }, async ({ code, path }) => {
+    let src = code;
+    if (!src && path) {
+      try {
+        src = readFileSync22(path, "utf8");
+      } catch {
+        return { content: [{ type: "text", text: JSON.stringify({ error: "unreadable path" }) }] };
+      }
+    }
+    if (!src)
+      return { content: [{ type: "text", text: JSON.stringify({ error: "provide code or path" }) }] };
+    return { content: [{ type: "text", text: JSON.stringify(actionSurface(src)) }] };
+  });
   server.registerTool("payload_lookup", {
     title: "Look up exploit payloads",
     description: "INTEL: find a payload collection (66 categories from PayloadsAllTheThings).",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.36",
+  "version": "2.4.38",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {