blitzstrike 2.4.42 → 2.4.43

package/CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.43] — 2026-09-14
+
+### Added — Race Condition / TOCTOU Tester (concurrency oracle)
+
+- New `src/race-test.ts`: detect TOCTOU races + idempotency violations — fire
+  a CONCURRENT BURST of N identical requests and count how many succeed. If
+  more than `expected_max` (default 1) succeed, the operation is not atomic
+  under concurrency (double-spend, duplicate orders, discount abuse).
+- New `race_test` tool: success criterion is a caller-supplied regex (the
+  "marker" of a committed side effect). Pure `classifyRace` + `requestSignature`
+  for deterministic, testable logic.
+
 ## [2.4.42] — 2026-09-14
 
 ### Added — Duplicate Parameter Precedence Fuzzer (WAF-bypass oracle)

package/dist/index.js

@@ -57709,6 +57709,47 @@ async function paramPrecedenceScan(baseUrl, param, valueA, valueB, opts = {}) {
   };
 }
 
+// src/race-test.ts
+function classifyRace(input) {
+  const race = input.successes > input.expected_max;
+  return {
+    race,
+    verdict: race ? `race condition / idempotency violation — ${input.successes} of ${input.total} concurrent requests succeeded (expected ≤ ${input.expected_max}).` : `no race — ${input.successes} of ${input.total} succeeded (within expected ${input.expected_max}).`
+  };
+}
+async function raceTest(input) {
+  const method = input.method ?? "POST";
+  const N = input.concurrent ?? 10;
+  const expected = input.expected_max ?? 1;
+  const successRe = new RegExp(input.success_pattern, "i");
+  const timeoutMs = input.timeoutMs ?? 1e4;
+  const headers = { "User-Agent": "Mozilla/5.0 (blitzstrike race probe)", ...input.headers ?? {} };
+  const doFetch = async () => {
+    try {
+      const r = await fetch(input.url, { method, body: input.body, headers, redirect: "manual", signal: AbortSignal.timeout(timeoutMs) });
+      return { status: r.status, body: await r.text() };
+    } catch (e) {
+      return { status: 0, body: "", error: String(e) };
+    }
+  };
+  const results = await Promise.all(Array.from({ length: N }, () => doFetch()));
+  const successes = results.filter((r) => r.status > 0 && successRe.test(r.body)).length;
+  const errors = results.filter((r) => r.error).length;
+  const verdict = classifyRace({ successes, total: N, expected_max: expected });
+  return {
+    url: input.url,
+    method,
+    concurrent_requests: N,
+    expected_max: expected,
+    concurrent_successes: successes,
+    fetch_errors: errors,
+    success_rate: Number((successes / N).toFixed(3)),
+    race_detected: verdict.race,
+    verdict: verdict.verdict,
+    detail: verdict.race ? "multiple concurrent requests each passed the check before any committed the side effect (TOCTOU)." : "the operation appears atomic/idempotent under this concurrency (a tighter single-packet burst via HTTP/2 may still win; this is a parallel-request approximation)."
+  };
+}
+
 // src/enterprise-benchmark.ts
 import { existsSync as existsSync11, readFileSync as readFileSync20, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
 import { join as join18, resolve } from "node:path";
@@ -58737,6 +58778,20 @@ ${statusLine}` : statusLine },
   }, async ({ base_url, param, value_a, value_b }) => {
     return { content: [{ type: "text", text: JSON.stringify(await paramPrecedenceScan(base_url, param, value_a, value_b)) }] };
   });
+  server.registerTool("race_test", {
+    title: "Race condition / TOCTOU tester (concurrency oracle)",
+    description: "LIVE (black-box): detect TOCTOU race conditions + idempotency violations — fire a sanity request, then a CONCURRENT BURST of N identical requests, and count how many succeed. If more than expected_max succeed, the operation is not atomic under concurrency (double-spend, duplicate orders, discount abuse, mass action). Deterministic: success is a caller-supplied regex.",
+    inputSchema: {
+      url: string2().describe("Full request URL"),
+      method: string2().optional().describe("HTTP method (default POST)"),
+      body: string2().optional().describe("Request body"),
+      success_pattern: string2().describe("Regex that matches a 'success' response (the committed side effect)"),
+      concurrent: number2().optional().describe("Number of concurrent requests (default 10)"),
+      expected_max: number2().optional().describe("Max expected successes (default 1)")
+    }
+  }, async ({ url, method, body, success_pattern, concurrent, expected_max }) => {
+    return { content: [{ type: "text", text: JSON.stringify(await raceTest({ url, method, body, success_pattern, concurrent, expected_max })) }] };
+  });
   server.registerTool("payload_lookup", {
     title: "Look up exploit payloads",
     description: "INTEL: find a payload collection (66 categories from PayloadsAllTheThings).",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.42",
+  "version": "2.4.43",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {