blitzstrike 2.4.40 → 2.4.41

package/CHANGELOG.md

@@ -5,6 +5,17 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.41] — 2026-09-14
+
+### Added — Blind Differential Oracle (calibration-based sink detection)
+
+- New `src/blind-oracle.ts`: detect which sink a request parameter reaches
+  WITHOUT a malicious payload — calibration + differential. Arithmetic
+  identities (`id=1` vs `id=1+0`/`id=2-1`) reveal SQL/expression context; SSTI
+  arithmetic (`test${7*7}`) reveals template engines; a unique marker reveals
+  XSS reflection. Benign probes (numbers + operators), deterministic inference.
+- New `blind_oracle` tool: WAF-safe blind detection for sql/ssti/xss.
+
 ## [2.4.40] — 2026-09-14
 
 ### Added — Web Cache Key Normalization Gap Fuzzer (live, black-box)

package/dist/index.js

@@ -57506,6 +57506,123 @@ async function cacheGapScan(baseUrl, endpoint, opts = {}) {
   };
 }
 
+// src/blind-oracle.ts
+function arithmeticProbes(value) {
+  const n = Number(value);
+  if (Number.isNaN(n) || value.trim() === "")
+    return [];
+  return [
+    { sink: "sql_arithmetic", name: "plus_zero", payload: `${n}+0` },
+    { sink: "sql_arithmetic", name: "minus_zero", payload: `${n}-0` },
+    { sink: "sql_arithmetic", name: "times_one", payload: `${n}*1` },
+    { sink: "sql_coercion", name: "leading_zero", payload: `0${value}` },
+    { sink: "sql_coercion", name: "float_form", payload: `${n}.0` }
+  ];
+}
+function sstiProbes(value) {
+  return [
+    { sink: "ssti", name: "dollar_math", payload: `${value}\${7*7}` },
+    { sink: "ssti", name: "hash_math", payload: `${value}#{7*7}` },
+    { sink: "ssti", name: "mustache_math", payload: `${value}{{7*7}}` }
+  ];
+}
+function xssProbe(value, marker) {
+  return { sink: "xss", name: "marker", payload: `${value}${marker}` };
+}
+function classifyBlindProbe(input) {
+  const same = input.bodyHash === input.baselineHash;
+  let signal = false;
+  let reason = "";
+  if (input.sink === "sql_arithmetic" && same) {
+    signal = true;
+    reason = "arithmetic identity returned the SAME result as the bare value — the parameter is evaluated arithmetically (SQL/expression context).";
+  } else if (input.sink === "sql_coercion" && same) {
+    signal = true;
+    reason = "type-coerced variant returned the SAME result — the parameter is normalized numerically (SQL typed column).";
+  } else if (input.sink === "ssti" && !same && /49/.test(input.body)) {
+    signal = true;
+    reason = "the SSTI arithmetic (7*7) rendered as 49 in the response — the parameter reaches a template engine (SSTI).";
+  } else if (input.sink === "xss" && input.marker && input.body.includes(input.marker)) {
+    signal = true;
+    reason = "the unique marker was reflected in the response — the parameter reaches HTML output (reflected).";
+  }
+  return { same_as_baseline: same, signal, reason };
+}
+async function blindOracle(baseUrl, param, value, opts = {}) {
+  const base = baseUrl.replace(/\/+$/, "");
+  const sinks = opts.sinks ?? ["sql", "ssti", "xss"];
+  const marker = `zz${Math.random().toString(36).slice(2, 10)}zz`;
+  const headers = { "User-Agent": "Mozilla/5.0 (blitzstrike oracle probe)" };
+  const timeoutMs = opts.timeoutMs ?? 8000;
+  const build = (payload) => `${base}?${encodeURIComponent(param)}=${encodeURIComponent(payload)}`;
+  let baselineHash = "";
+  let baselineSize = 0;
+  let baselineStatus = 0;
+  try {
+    const r = await fetch(build(value), { headers, redirect: "manual", signal: AbortSignal.timeout(timeoutMs) });
+    baselineStatus = r.status;
+    const body = await r.text();
+    baselineHash = sha256(body);
+    baselineSize = body.length;
+  } catch (e) {
+    return { error: "baseline fetch failed", base_url: base, param, detail: String(e) };
+  }
+  const probes = [];
+  if (sinks.includes("sql"))
+    probes.push(...arithmeticProbes(value));
+  if (sinks.includes("ssti"))
+    probes.push(...sstiProbes(value));
+  if (sinks.includes("xss"))
+    probes.push(xssProbe(value, marker));
+  const results = [];
+  for (const p of probes) {
+    const t0 = Date.now();
+    try {
+      const r = await fetch(build(p.payload), { headers, redirect: "manual", signal: AbortSignal.timeout(timeoutMs) });
+      const timing = Date.now() - t0;
+      const status = r.status;
+      const body = await r.text();
+      const bodyHash = sha256(body);
+      const cls = classifyBlindProbe({
+        baselineHash,
+        baselineSize,
+        bodyHash,
+        size: body.length,
+        sink: p.sink,
+        name: p.name,
+        body,
+        marker
+      });
+      results.push({
+        sink: p.sink,
+        name: p.name,
+        payload: p.payload,
+        status,
+        size: body.length,
+        timing_ms: timing,
+        body_hash: bodyHash.slice(0, 12),
+        same_as_baseline: cls.same_as_baseline,
+        signal: cls.signal,
+        reason: cls.reason
+      });
+    } catch {
+      results.push({ sink: p.sink, name: p.name, payload: p.payload, status: 0, size: 0, timing_ms: 0, body_hash: "", same_as_baseline: false, signal: false, reason: "fetch error/timeout" });
+    }
+  }
+  const signals = results.filter((r) => r.signal === true);
+  return {
+    base_url: base,
+    param,
+    value,
+    baseline: { status: baselineStatus, size: baselineSize, body_hash: baselineHash.slice(0, 16) },
+    probes_tested: results.length,
+    signals_found: signals.length,
+    signals,
+    all: results,
+    interpretation: "A signal means the parameter reaches that sink (evidence: the differential). Verify live before reporting — the oracle is a detection hint, not proof."
+  };
+}
+
 // src/enterprise-benchmark.ts
 import { existsSync as existsSync11, readFileSync as readFileSync20, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
 import { join as join18, resolve } from "node:path";
@@ -58505,6 +58622,24 @@ ${statusLine}` : statusLine },
   }, async ({ base_url, endpoint, max_variants }) => {
     return { content: [{ type: "text", text: JSON.stringify(await cacheGapScan(base_url, endpoint, { maxVariants: max_variants })) }] };
   });
+  server.registerTool("blind_oracle", {
+    title: "Blind differential oracle (calibration-based sink detection)",
+    description: "LIVE (black-box, WAF-safe): detect which sink a request parameter reaches WITHOUT a malicious payload — calibration + differential. Arithmetic identities (id=1 vs id=1+0 / id=2-1) reveal SQL/expression context; SSTI arithmetic (test${7*7}) reveals template engines; a unique marker reveals XSS reflection. Benign probes (numbers + operators, no quotes/commands), deterministic byte-level inference.",
+    inputSchema: {
+      base_url: string2().describe("Target base URL"),
+      param: string2().describe("Parameter name to probe (e.g. id)"),
+      value: string2().describe("Baseline value for the parameter (e.g. 1)"),
+      sinks: string2().optional().describe("JSON array of sinks to probe (default ['sql','ssti','xss'])")
+    }
+  }, async ({ base_url, param, value, sinks }) => {
+    let s;
+    try {
+      s = sinks ? JSON.parse(sinks) : undefined;
+    } catch {
+      return { content: [{ type: "text", text: JSON.stringify({ error: "invalid sinks JSON" }) }] };
+    }
+    return { content: [{ type: "text", text: JSON.stringify(await blindOracle(base_url, param, value, { sinks: s })) }] };
+  });
   server.registerTool("payload_lookup", {
     title: "Look up exploit payloads",
     description: "INTEL: find a payload collection (66 categories from PayloadsAllTheThings).",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.40",
+  "version": "2.4.41",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {