blitzstrike 2.4.38 → 2.4.40

package/CHANGELOG.md

@@ -5,6 +5,31 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.40] — 2026-09-14
+
+### Added — Web Cache Key Normalization Gap Fuzzer (live, black-box)
+
+- New `src/cache-gap.ts`: fuzz an endpoint's path-normalization + static-
+  extension variants (`.css`, `..;/`, `%2f`, `%00`, `;`, case, …) to detect
+  web-cache deception / poisoning — where a cache keys on a static-looking path
+  but the origin serves private content.
+- New `cache_gap` tool: fetch a baseline, compare body hash + cache headers per
+  variant, and flag only evidence-backed gaps (cache_deception / normalization_gap).
+- Pure helpers `generateCacheVariants` + `classifyCacheResponse` for deterministic,
+  testable detection logic.
+
+## [2.4.39] — 2026-09-14
+
+### Added — Patch Reversal (1-day weaponization engine)
+
+- `analyzePatch` (in differential.ts): read a security patch (old vs new code)
+  and REVERSE it — detect what the patch ADDED (sanitizer, auth/nonce gate,
+  parameterized query, input validation) or REMOVED (a dangerous sink fed by
+  attacker input), and reconstruct the vulnerability in the OLD version.
+- New `patch_analyze` tool: each reversal carries a DERIVED `mine_signature` to
+  sweep unpatched installs via `variant_scan(root, { signature })`.
+- A cosmetic-only change (no security delta) correctly yields no reversal.
+
 ## [2.4.38] — 2026-09-14
 
 ### Added — Action-Name Heuristic Engine (what to look for WHERE)

package/dist/index.js

@@ -55613,6 +55613,110 @@ function analyzeGitDiff(repo, base = "HEAD~1", head = "HEAD") {
   const security_sensitive = files.reduce((n, f) => n + f.result.changes.filter((c) => c.severity === "high").length, 0);
   return { repo, base, head, files, total_changes, security_sensitive };
 }
+var PATCH_RANK = { high: 0, medium: 1 };
+function analyzePatch(oldCode, newCode, language = "php") {
+  const { added, removed } = diffLines(oldCode, newCode);
+  const findings = [];
+  for (const l of added) {
+    const sans = findSanitizers(l.text);
+    if (sans.length > 0) {
+      findings.push({
+        kind: "sanitizer_added",
+        old_vuln: "raw attacker input reached a sink without escaping",
+        new_fix: l.text.trim(),
+        severity: "high",
+        line: l.line,
+        detail: `sanitizer ADDED: ${sans.map((s) => s.label).join(", ")} — the OLD version passed raw input to a sink (sanitization gap).`,
+        signature: "patch:sanitizer_added",
+        mine_signature: "complex_bugs:wrong_sanitizer"
+      });
+    }
+    const gates = AUTH_GATES.filter((g) => l.text.includes(g));
+    if (gates.length > 0) {
+      findings.push({
+        kind: "authorization_added",
+        old_vuln: "missing authorization / nonce check",
+        new_fix: l.text.trim(),
+        severity: "high",
+        line: l.line,
+        detail: `authorization gate ADDED: ${gates.join(", ")} — the OLD version performed no auth/nonce check (auth bypass / CSRF).`,
+        signature: "patch:authorization_added",
+        mine_signature: "complex_bugs:missing_authz"
+      });
+    }
+    if (/->prepare\s*\(|\bprepare\s*\(\s*["']/.test(l.text)) {
+      findings.push({
+        kind: "prepared_statement_added",
+        old_vuln: "raw SQL string interpolation",
+        new_fix: l.text.trim(),
+        severity: "high",
+        line: l.line,
+        detail: "parameterized query ADDED — the OLD version concatenated user input into SQL (SQLi).",
+        signature: "patch:prepared_statement_added",
+        mine_signature: "complex_bugs:wrong_sanitizer"
+      });
+    }
+    if (/preg_match\s*\(\s*["']\/\^|in_array\s*\(\s*\$|ctype_[a-z]+|is_numeric\s*\(|filter_var\s*\(/.test(l.text)) {
+      findings.push({
+        kind: "validation_added",
+        old_vuln: "unvalidated / arbitrary input accepted",
+        new_fix: l.text.trim(),
+        severity: "medium",
+        line: l.line,
+        detail: "input validation ADDED — the OLD version accepted arbitrary input (type/format gap).",
+        signature: "patch:validation_added",
+        mine_signature: "complex_bugs:wrong_sanitizer"
+      });
+    }
+  }
+  for (const l of removed) {
+    const sink = classifySink2(l.text);
+    const source = classifySource(l.text);
+    if (sink && source && source.attacker_controlled) {
+      findings.push({
+        kind: "sink_removed",
+        old_vuln: `dangerous sink fed by attacker input: ${sink.category}`,
+        new_fix: "(removed)",
+        cwe: sink.cwe,
+        severity: "high",
+        line: l.line,
+        detail: `sink REMOVED: ${l.text.trim()} (${sink.category}) — the OLD version executed this dangerous operation on attacker input.`,
+        signature: `patch:sink_removed:${sink.category}`,
+        mine_signature: `taint:${sink.category}`
+      });
+    }
+  }
+  findings.sort((a, b) => PATCH_RANK[a.severity] - PATCH_RANK[b.severity] || a.line - b.line);
+  const count = (k) => findings.filter((f) => f.kind === k).length;
+  return {
+    language,
+    reversal_findings: findings.map((f) => ({
+      kind: f.kind,
+      old_vuln: f.old_vuln,
+      new_fix: f.new_fix,
+      cwe: f.cwe,
+      line: f.line,
+      severity: f.severity,
+      detail: f.detail,
+      signature: f.signature,
+      mine_signature: f.mine_signature
+    })),
+    summary: {
+      sanitizer_added: count("sanitizer_added"),
+      authorization_added: count("authorization_added"),
+      prepared_statement_added: count("prepared_statement_added"),
+      validation_added: count("validation_added"),
+      sink_removed: count("sink_removed")
+    },
+    interpretation: "Each reversal is the vulnerability REVERSED from the patch: the OLD version had this bug, the NEW version fixed it. Sweep unpatched installs with variant_scan(root, { signature: mine_signature })."
+  };
+}
+function analyzePatchFiles(oldPath, newPath, language) {
+  const oldCode = readFileSync15(oldPath, "utf8");
+  const newCode = readFileSync15(newPath, "utf8");
+  const lang = language ?? languageOf(newPath);
+  return analyzePatch(oldCode, newCode, lang);
+}
 
 // src/frameworks.ts
 import { readFileSync as readFileSync16, existsSync as existsSync8 } from "node:fs";
@@ -57263,6 +57367,145 @@ function functionBody2(code, name) {
   return code.slice(open);
 }
 
+// src/cache-gap.ts
+function generateCacheVariants(endpoint) {
+  const e = endpoint.startsWith("/") ? endpoint : "/" + endpoint;
+  const variants = new Set;
+  const add = (s) => variants.add(s);
+  const exts = [".css", ".js", ".png", ".jpg", ".jpeg", ".json", ".txt", ".ico", ".html", ".svg", ".woff", ".xml", ".gif"];
+  for (const ext of exts) {
+    add(`${e}${ext}`);
+    add(`${e}/${ext.slice(1)}`);
+    add(`${e}${ext}?x=1`);
+    add(`${e}${ext};`);
+    add(`${e}${ext}%3b`);
+  }
+  const suffix = [
+    "/style.css",
+    "/..;/style.css",
+    "/.;/style.css",
+    "/../style.css",
+    "/%2e%2e/style.css",
+    "/%2fstyle.css",
+    "/;style.css",
+    "/%3bstyle.css",
+    "/./style.css",
+    "//style.css",
+    "/%00.style.css",
+    "/style.css/.",
+    "/style.css%2f",
+    "/style.css%00",
+    "/style.css%2e%2e"
+  ];
+  for (const s of suffix)
+    add(`${e}${s}`);
+  add(e.replace(/^\//, "/%2f"));
+  add(e.replace(/^\//, "//"));
+  add(e.replace(/^\//, "/./"));
+  add(e.replace(/^\//, "/%2e/"));
+  add(e.replace(/^\//, "/..;/"));
+  add(`${e}%00`);
+  add(`${e};`);
+  add(`${e}%3b`);
+  add(`${e}?`);
+  add(`${e}?x=1`);
+  add(`${e}#`);
+  add(e.toUpperCase());
+  return [...variants].filter((v) => v !== e);
+}
+function classifyCacheResponse(input) {
+  const same = input.bodyHash === input.baselineHash;
+  const lower = Object.fromEntries(Object.entries(input.headers).map(([k, v]) => [k.toLowerCase(), v]));
+  const cacheStatus = lower["x-cache"] ?? lower["cf-cache-status"] ?? lower["x-served-by"] ?? lower["x-cache-status"] ?? null;
+  const cacheControl = lower["cache-control"] ?? "";
+  const age = lower["age"];
+  const cacheable = /public|max-age|s-maxage/.test(cacheControl) || age !== undefined || cacheStatus !== null && /hit/i.test(cacheStatus) || input.staticExtension;
+  if (same && input.staticExtension && cacheable) {
+    return {
+      same_body: true,
+      cacheable,
+      cache_status: cacheStatus,
+      gap: "cache_deception",
+      detail: "the endpoint's content is returned for a static-extension path that is cacheable — a cache may store PRIVATE content under a PUBLIC static key (cache deception)."
+    };
+  }
+  if (same && cacheStatus !== null && /hit/i.test(cacheStatus)) {
+    return {
+      same_body: true,
+      cacheable,
+      cache_status: cacheStatus,
+      gap: "cache_deception",
+      detail: `the endpoint's content is served from cache (${cacheStatus}) — the response is being cached and shared.`
+    };
+  }
+  if (!same && input.staticExtension && input.status !== 200) {
+    return {
+      same_body: false,
+      cacheable,
+      cache_status: cacheStatus,
+      gap: "normalization_gap",
+      detail: "the static-extension variant resolves differently than the baseline (origin normalized the path) — cache key may diverge from the origin resource (normalization gap)."
+    };
+  }
+  return { same_body: same, cacheable, cache_status: cacheStatus, gap: null, detail: "" };
+}
+function headersToRecord(h) {
+  const out = {};
+  h.forEach((v, k) => {
+    out[k.toLowerCase()] = v;
+  });
+  return out;
+}
+function pickCacheHeaders(h) {
+  const keys = ["cache-control", "age", "expires", "x-cache", "cf-cache-status", "x-served-by", "x-cache-status", "via", "etag", "last-modified", "vary"];
+  const out = {};
+  for (const k of keys)
+    if (h[k] !== undefined)
+      out[k] = h[k];
+  return out;
+}
+async function cacheGapScan(baseUrl, endpoint, opts = {}) {
+  const base = baseUrl.replace(/\/+$/, "");
+  const endpointPath = endpoint.startsWith("/") ? endpoint : "/" + endpoint;
+  const variants = generateCacheVariants(endpointPath).slice(0, opts.maxVariants ?? 60);
+  const headers = { "User-Agent": "Mozilla/5.0 (blitzstrike cache probe)", Accept: "*/*" };
+  let baselineHash = "";
+  let baselineStatus = 0;
+  let baselineHeaders = {};
+  try {
+    const resp = await fetch(base + endpointPath, { headers, redirect: "manual", signal: AbortSignal.timeout(opts.timeoutMs ?? 8000) });
+    baselineStatus = resp.status;
+    baselineHeaders = headersToRecord(resp.headers);
+    baselineHash = sha256(await resp.text());
+  } catch (e) {
+    return { error: "baseline fetch failed", base_url: base, endpoint: endpointPath, detail: String(e) };
+  }
+  const results = [];
+  for (const v of variants) {
+    try {
+      const resp = await fetch(base + v, { headers, redirect: "manual", signal: AbortSignal.timeout(opts.timeoutMs ?? 8000) });
+      const status = resp.status;
+      const hdrs = headersToRecord(resp.headers);
+      const bodyHash = sha256(await resp.text());
+      const staticExtension = /\.(css|js|png|jpe?g|json|txt|ico|html|svg|woff|xml|gif)([;?].*)?$/i.test(v);
+      const cls = classifyCacheResponse({ baselineHash, bodyHash, status, headers: hdrs, staticExtension });
+      results.push({ path: v, status, same_body: cls.same_body, cacheable: cls.cacheable, cache_status: cls.cache_status, gap: cls.gap, detail: cls.detail });
+    } catch {
+      results.push({ path: v, status: 0, same_body: false, cacheable: false, cache_status: null, gap: null, detail: "fetch error/timeout" });
+    }
+  }
+  const gaps = results.filter((r) => r.gap !== null);
+  return {
+    base_url: base,
+    endpoint: endpointPath,
+    baseline: { status: baselineStatus, body_hash: baselineHash.slice(0, 16), cache_headers: pickCacheHeaders(baselineHeaders) },
+    variants_tested: results.length,
+    gaps_found: gaps.length,
+    gaps,
+    all: results
+  };
+}
+
 // src/enterprise-benchmark.ts
 import { existsSync as existsSync11, readFileSync as readFileSync20, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
 import { join as join18, resolve } from "node:path";
@@ -58251,6 +58494,17 @@ ${statusLine}` : statusLine },
       return { content: [{ type: "text", text: JSON.stringify({ error: "provide code or path" }) }] };
     return { content: [{ type: "text", text: JSON.stringify(actionSurface(src)) }] };
   });
+  server.registerTool("cache_gap", {
+    title: "Web cache key normalization gap fuzzer",
+    description: "LIVE (black-box, no source code): fuzz an endpoint's path-normalization + static-extension variants to detect web-cache deception / poisoning — where a cache keys on a static-looking path but the origin serves private content. Deterministic + evidence-first: fetch a baseline, then compare body hash + cache headers per variant. High-impact class (cached private data, mass takeover) that is still under-hunted.",
+    inputSchema: {
+      base_url: string2().describe("Target base URL (e.g. https://target.com)"),
+      endpoint: string2().describe("Endpoint path to probe (e.g. /account or /profile)"),
+      max_variants: number2().optional().describe("Max variants to test (default 60)")
+    }
+  }, async ({ base_url, endpoint, max_variants }) => {
+    return { content: [{ type: "text", text: JSON.stringify(await cacheGapScan(base_url, endpoint, { maxVariants: max_variants })) }] };
+  });
   server.registerTool("payload_lookup", {
     title: "Look up exploit payloads",
     description: "INTEL: find a payload collection (66 categories from PayloadsAllTheThings).",
@@ -58840,6 +59094,25 @@ ${statusLine}` : statusLine },
     }
     return { content: [{ type: "text", text: JSON.stringify(result) }] };
   });
+  server.registerTool("patch_analyze", {
+    title: "Patch reversal (1-day weaponization)",
+    description: "1-DAY: read a security patch (old vs new code) and REVERSE it — find what the patch ADDED to make the code safer (sanitizer, auth/nonce gate, parameterized query, validation) or REMOVED (a dangerous sink), and reconstruct the vulnerability in the OLD version. Each reversal carries a DERIVED mine_signature to sweep unpatched installs via variant_scan(root, { signature: mine_signature }).",
+    inputSchema: {
+      old_path: string2().optional().describe("Old file path"),
+      new_path: string2().optional().describe("New file path"),
+      old_code: string2().optional().describe("Old source code (when not using paths)"),
+      new_code: string2().optional().describe("New source code (when not using paths)"),
+      language: string2().optional().describe("Language (default php)")
+    }
+  }, async ({ old_path, new_path, old_code, new_code, language }) => {
+    if (old_path && new_path) {
+      return { content: [{ type: "text", text: JSON.stringify(analyzePatchFiles(old_path, new_path, language)) }] };
+    }
+    if (old_code !== undefined && new_code !== undefined) {
+      return { content: [{ type: "text", text: JSON.stringify(analyzePatch(old_code, new_code, language ?? "php")) }] };
+    }
+    return { content: [{ type: "text", text: JSON.stringify({ error: "provide (old_path+new_path) or (old_code+new_code)" }) }] };
+  });
   server.registerTool("incremental_scan", {
     title: "Incremental scan (CI)",
     description: "EAGLE-EYE: analyze only the files changed between two git refs (default HEAD~1..HEAD) — the fast CI pass. Runs the taint + data-flow engine on just the changed source files and skips unchanged ones; the full-scan path (run_engagement / enrich_scan) remains authoritative.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.38",
+  "version": "2.4.40",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {