blitzstrike 2.4.41 → 2.4.43

package/CHANGELOG.md

@@ -5,6 +5,32 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.43] — 2026-09-14
+
+### Added — Race Condition / TOCTOU Tester (concurrency oracle)
+
+- New `src/race-test.ts`: detect TOCTOU races + idempotency violations — fire
+  a CONCURRENT BURST of N identical requests and count how many succeed. If
+  more than `expected_max` (default 1) succeed, the operation is not atomic
+  under concurrency (double-spend, duplicate orders, discount abuse).
+- New `race_test` tool: success criterion is a caller-supplied regex (the
+  "marker" of a committed side effect). Pure `classifyRace` + `requestSignature`
+  for deterministic, testable logic.
+
+## [2.4.42] — 2026-09-14
+
+### Added — Duplicate Parameter Precedence Fuzzer (WAF-bypass oracle)
+
+- New `src/param-precedence.ts`: determine how the app resolves duplicate
+  parameters + alternate delimiters (`;` `,` `%26` `%3b` `|` `[]` `%00` `+`),
+  and classify first-wins / last-wins / mixed precedence.
+- New `param_precedence` tool: baseline A/B + differential per variant, with a
+  DERIVED waf_bypass_hint (inject via the WAF/app disagreement).
+- System prompt: added a "LIVE PENTEST + TARGETING" directive wiring the new
+  black-box tools (cache_gap / blind_oracle / param_precedence) and source
+  targeting tools (action_surface / security_state / framework_knowledge /
+  variant_scan / patch_analyze) into a coherent, evidence-first workflow.
+
 ## [2.4.41] — 2026-09-14
 
 ### Added — Blind Differential Oracle (calibration-based sink detection)

package/dist/index.js

@@ -57623,6 +57623,133 @@ async function blindOracle(baseUrl, param, value, opts = {}) {
   };
 }
 
+// src/param-precedence.ts
+function generatePrecedenceVariants(param, a, b) {
+  const enc = encodeURIComponent;
+  const variants = [
+    { name: "duplicate_amp", qs: `${enc(param)}=${enc(a)}&${enc(param)}=${enc(b)}` },
+    { name: "semicolon", qs: `${enc(param)}=${enc(a)};${enc(param)}=${enc(b)}` },
+    { name: "comma", qs: `${enc(param)}=${enc(a)},${enc(param)}=${enc(b)}` },
+    { name: "encoded_amp", qs: `${enc(param)}=${enc(a)}%26${enc(param)}=${enc(b)}` },
+    { name: "encoded_semicolon", qs: `${enc(param)}=${enc(a)}%3b${enc(param)}=${enc(b)}` },
+    { name: "pipe", qs: `${enc(param)}=${enc(a)}|${enc(param)}=${enc(b)}` },
+    { name: "array", qs: `${enc(param)}[]=${enc(a)}&${enc(param)}[]=${enc(b)}` },
+    { name: "null_byte", qs: `${enc(param)}=${enc(a)}%00${enc(b)}` },
+    { name: "space", qs: `${enc(param)}=${enc(a)}+${enc(b)}` }
+  ];
+  return variants;
+}
+function classifyPrecedence(input) {
+  const h = input.bodyHash;
+  if (h === input.hashA) {
+    return { winner: "A", split: true, detail: "value A won (the first/leftmost value) — first-wins precedence for this delimiter." };
+  }
+  if (h === input.hashB) {
+    return { winner: "B", split: true, detail: "value B won (the last/rightmost value) — last-wins precedence for this delimiter." };
+  }
+  return { winner: "neither", split: false, detail: "neither A nor B matched — the delimiter may be literal (not a parameter separator) or the values were joined." };
+}
+async function paramPrecedenceScan(baseUrl, param, valueA, valueB, opts = {}) {
+  const base = baseUrl.replace(/\/+$/, "");
+  const headers = { "User-Agent": "Mozilla/5.0 (blitzstrike precedence probe)" };
+  const timeoutMs = opts.timeoutMs ?? 8000;
+  const enc = encodeURIComponent;
+  const fetchHash = async (qs) => {
+    try {
+      const r = await fetch(`${base}?${qs}`, { headers, redirect: "manual", signal: AbortSignal.timeout(timeoutMs) });
+      const body = await r.text();
+      return { status: r.status, hash: sha256(body) };
+    } catch (e) {
+      return { status: 0, hash: "", error: String(e) };
+    }
+  };
+  const baseA = await fetchHash(`${enc(param)}=${enc(valueA)}`);
+  const baseB = await fetchHash(`${enc(param)}=${enc(valueB)}`);
+  if (baseA.error || baseB.error) {
+    return { error: "baseline fetch failed", base_url: base, param, detail: baseA.error ?? baseB.error };
+  }
+  if (baseA.hash === baseB.hash) {
+    return { error: "baseline A and B produce identical responses — pick two values with a distinguishable effect", base_url: base, param };
+  }
+  const variants = generatePrecedenceVariants(param, valueA, valueB);
+  const results = [];
+  let firstWins = 0;
+  let lastWins = 0;
+  for (const v of variants) {
+    const r = await fetchHash(v.qs);
+    if (r.error) {
+      results.push({ name: v.name, qs: v.qs, status: 0, body_hash: "", winner: "neither", split: false, detail: "fetch error/timeout" });
+      continue;
+    }
+    const cls = classifyPrecedence({ hashA: baseA.hash, hashB: baseB.hash, bodyHash: r.hash, name: v.name });
+    if (cls.winner === "A")
+      firstWins++;
+    else if (cls.winner === "B")
+      lastWins++;
+    results.push({ name: v.name, qs: v.qs, status: r.status, body_hash: r.hash.slice(0, 12), winner: cls.winner, split: cls.split, detail: cls.detail });
+  }
+  let precedence = "ambiguous";
+  if (firstWins > 0 && lastWins === 0)
+    precedence = "first_wins";
+  else if (lastWins > 0 && firstWins === 0)
+    precedence = "last_wins";
+  else if (firstWins > 0 && lastWins > 0)
+    precedence = "mixed_by_delimiter";
+  return {
+    base_url: base,
+    param,
+    value_a: valueA,
+    value_b: valueB,
+    precedence,
+    first_wins_count: firstWins,
+    last_wins_count: lastWins,
+    variants_tested: results.length,
+    results,
+    waf_bypass_hint: precedence === "first_wins" ? "the app uses the FIRST duplicate value — a WAF that inspects the LAST value is bypassed with ?param=benign&param=payload." : precedence === "last_wins" ? "the app uses the LAST duplicate value — a WAF that inspects the FIRST value is bypassed with ?param=payload&param=benign." : "precedence is mixed by delimiter — map which delimiter the WAF validates vs which the app binds, then inject via the disagreement."
+  };
+}
+
+// src/race-test.ts
+function classifyRace(input) {
+  const race = input.successes > input.expected_max;
+  return {
+    race,
+    verdict: race ? `race condition / idempotency violation — ${input.successes} of ${input.total} concurrent requests succeeded (expected ≤ ${input.expected_max}).` : `no race — ${input.successes} of ${input.total} succeeded (within expected ${input.expected_max}).`
+  };
+}
+async function raceTest(input) {
+  const method = input.method ?? "POST";
+  const N = input.concurrent ?? 10;
+  const expected = input.expected_max ?? 1;
+  const successRe = new RegExp(input.success_pattern, "i");
+  const timeoutMs = input.timeoutMs ?? 1e4;
+  const headers = { "User-Agent": "Mozilla/5.0 (blitzstrike race probe)", ...input.headers ?? {} };
+  const doFetch = async () => {
+    try {
+      const r = await fetch(input.url, { method, body: input.body, headers, redirect: "manual", signal: AbortSignal.timeout(timeoutMs) });
+      return { status: r.status, body: await r.text() };
+    } catch (e) {
+      return { status: 0, body: "", error: String(e) };
+    }
+  };
+  const results = await Promise.all(Array.from({ length: N }, () => doFetch()));
+  const successes = results.filter((r) => r.status > 0 && successRe.test(r.body)).length;
+  const errors = results.filter((r) => r.error).length;
+  const verdict = classifyRace({ successes, total: N, expected_max: expected });
+  return {
+    url: input.url,
+    method,
+    concurrent_requests: N,
+    expected_max: expected,
+    concurrent_successes: successes,
+    fetch_errors: errors,
+    success_rate: Number((successes / N).toFixed(3)),
+    race_detected: verdict.race,
+    verdict: verdict.verdict,
+    detail: verdict.race ? "multiple concurrent requests each passed the check before any committed the side effect (TOCTOU)." : "the operation appears atomic/idempotent under this concurrency (a tighter single-packet burst via HTTP/2 may still win; this is a parallel-request approximation)."
+  };
+}
+
 // src/enterprise-benchmark.ts
 import { existsSync as existsSync11, readFileSync as readFileSync20, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
 import { join as join18, resolve } from "node:path";
@@ -57862,8 +57989,7 @@ function createServer() {
 ` + `- Keep trying every lead AND every chain step until each is verified/executed or blocked, THEN generate_report. Never deliver a bare surface map, and never stop at 'found X' when X enables more.
 
 ` + "TWO PATHS:\\n" + "- Source path on disk -> blitz_scan / taint_file / eagle_eye2 (static).\\n" + "- Live URL -> live_recon / active_scan / strike_verify (web-hunting).\\n\\n" + `DEEPEN A FINDING: attack_plan(target, tech, params) to get the prioritized vector plan (decide what to test next with data); list_chains (escalation), chain_links (compose), technique_lookup(cls), payload_lookup, bypass_lookup (blocked). Phase doctrine: read_skill(bs-orchestrate-engagement | bs-web-hunting | bs-source-audit | bs-verify-finding). Campaign plan: read_playbook(target-type). On any failure call retry_guidance(signal) / model_fallback(signal) before giving up.
-` + `KNOWLEDGE BASE (discover, don't guess): skillLookup(topic) / listSkills for the 40 attack-path + hunting skills (ap-*, hp-*, bs-*); list_attack_vectors / attack_vectors(cat) for the 34-category vector taxonomy; taxonomy(kind) for OWASP/CWE/ASVS/API-top-10; read_playbook(type) for the 17 campaign playbooks; list_manuals / read_tool_manual for 317 tool references; list_tools / run_catalog_tool for the 141-tool catalog. Every tool, skill, and data layer is reachable from these. CROSS-TARGET INTELLIGENCE: strike_resolve auto-records confirmed/false_positive verdicts into the empirical ledger; query it with intelligence(action=hit_rates/top_vectors) so a new target on a known tech inherits historical hit-rates (attack_plan already blends them into success_probability).
-` + `PRECISION ANALYSIS — chrome-devtools MCP is MANDATORY, not optional:
+` + "KNOWLEDGE BASE (discover, don't guess): skillLookup(topic) / listSkills for the 40 attack-path + hunting skills (ap-*, hp-*, bs-*); list_attack_vectors / attack_vectors(cat) for the 34-category vector taxonomy; taxonomy(kind) for OWASP/CWE/ASVS/API-top-10; read_playbook(type) for the 17 campaign playbooks; list_manuals / read_tool_manual for 317 tool references; list_tools / run_catalog_tool for the 141-tool catalog. Every tool, skill, and data layer is reachable from these. CROSS-TARGET INTELLIGENCE: strike_resolve auto-records confirmed/false_positive verdicts into the empirical ledger; query it with intelligence(action=hit_rates/top_vectors) so a new target on a known tech inherits historical hit-rates (attack_plan already blends them into success_probability). LIVE PENTEST + TARGETING (black-box, WAF-safe): cache_gap(base_url, endpoint) fuzzes path-normalization + static-extension variants for cache deception/poisoning; blind_oracle(base_url, param, value) detects which SINK a param reaches (sql/ssti/xss) via benign arithmetic (id=1+0, test${7*7}) WITHOUT a malicious payload; param_precedence(base_url, param, A, B) maps duplicate-parameter precedence (first/last-wins) for WAF-bypass. SOURCE TARGETING: action_surface(code) maps every wp_ajax_* action to its vuln class + DERIVED priority (what to look for WHERE); security_state(sanitizers, sink) gives a wrong-context sanitization verdict; framework_knowledge(framework) returns auth/nonce primitives for 9 frameworks; variant_scan(root, signature) mass-sweeps an install base for ONE bug family; patch_analyze(old, new) REVERSES a security patch into the 0-day, and its mine_signature feeds variant_scan to sweep unpatched copies. All of these are DETECTION HINTS — verify each live (strike_verify / browser_validate) before it enters the report.\n" + `PRECISION ANALYSIS — chrome-devtools MCP is MANDATORY, not optional:
 ` + `- When a lead needs DOM/JS precision — DOM-XSS sink execution, AJAX endpoint + payload interception, JS runtime errors, redirect chains, SSO/token flow, or anything a static HTML glance cannot prove — call drive_devtools(target). It spawns chrome-devtools-mcp and drives a REAL headless browser (navigate -> list_network_requests -> list_console_messages -> evaluate_script), giving reproducible evidence instead of a guess.
 ` + `- Before calling it, check_mcp() to confirm the browser MCP is available; if not, blitzstrike install-tools or npm i -g chrome-devtools-mcp. Never substitute eyeballing minified JS or a static sink guess when a live browser can PROVE it. This is the precision + consistency layer.
 ` + "EXTERNAL MCP SERVERS (verified, connect them — NOT one-shot CLIs): chrome-devtools-mcp (29 tools: list_network_requests/get_network_request for raw HTTP interception, list_console_messages for JS errors + DOM-XSS, evaluate_script to run JS, take_screenshot) -> stdio chrome-devtools-mcp --headless --chromeArg=--no-sandbox --chromeArg=--disable-gpu (as root/container this is MANDATORY or the browser crashes; add --proxyServer http://127.0.0.1:8080 to route through Burp, --acceptInsecureCerts for bad TLS). burp-suite-mcp (proxy history + active scan + repeater) -> NOT npm: build the JAR (git clone https://github.com/PortSwigger/mcp-server.git && cd mcp-server && ./gradlew embedProxyJar), load it in Burp Extensions, then connect the client to http://127.0.0.1:9876 (SSE) or the stdio proxy java -jar mcp-proxy-all.jar --sse-url http://127.0.0.1:9876."
@@ -58640,6 +58766,32 @@ ${statusLine}` : statusLine },
     }
     return { content: [{ type: "text", text: JSON.stringify(await blindOracle(base_url, param, value, { sinks: s })) }] };
   });
+  server.registerTool("param_precedence", {
+    title: "Duplicate parameter precedence fuzzer (WAF-bypass oracle)",
+    description: "LIVE (black-box): determine how the app resolves duplicate parameters + alternate delimiters (; , %26 %3b | [] %00 + #). Reveals the WAF-bypass vector — if the WAF validates one value and the app binds another, inject via the disagreement. Deterministic: baseline A/B + differential per variant.",
+    inputSchema: {
+      base_url: string2().describe("Target base URL"),
+      param: string2().describe("Parameter name (e.g. id)"),
+      value_a: string2().describe("First value (e.g. 1)"),
+      value_b: string2().describe("Second value (e.g. 2)")
+    }
+  }, async ({ base_url, param, value_a, value_b }) => {
+    return { content: [{ type: "text", text: JSON.stringify(await paramPrecedenceScan(base_url, param, value_a, value_b)) }] };
+  });
+  server.registerTool("race_test", {
+    title: "Race condition / TOCTOU tester (concurrency oracle)",
+    description: "LIVE (black-box): detect TOCTOU race conditions + idempotency violations — fire a sanity request, then a CONCURRENT BURST of N identical requests, and count how many succeed. If more than expected_max succeed, the operation is not atomic under concurrency (double-spend, duplicate orders, discount abuse, mass action). Deterministic: success is a caller-supplied regex.",
+    inputSchema: {
+      url: string2().describe("Full request URL"),
+      method: string2().optional().describe("HTTP method (default POST)"),
+      body: string2().optional().describe("Request body"),
+      success_pattern: string2().describe("Regex that matches a 'success' response (the committed side effect)"),
+      concurrent: number2().optional().describe("Number of concurrent requests (default 10)"),
+      expected_max: number2().optional().describe("Max expected successes (default 1)")
+    }
+  }, async ({ url, method, body, success_pattern, concurrent, expected_max }) => {
+    return { content: [{ type: "text", text: JSON.stringify(await raceTest({ url, method, body, success_pattern, concurrent, expected_max })) }] };
+  });
   server.registerTool("payload_lookup", {
     title: "Look up exploit payloads",
     description: "INTEL: find a payload collection (66 categories from PayloadsAllTheThings).",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.41",
+  "version": "2.4.43",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {