blitzstrike 2.4.42 → 2.4.44

package/CHANGELOG.md

@@ -5,6 +5,29 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.44] — 2026-09-14
+
+### Added — JWT Forgeability Analyzer (identity token oracle)
+
+- New `src/jwt-analyze.ts`: parse a JWT and enumerate forge vectors
+  DETERMINISTICALLY — alg:none, missing signature, RS256→HS256 key confusion,
+  kid/jku header injection, weak HS secret (brute-forced against a wordlist),
+  missing expiry, sensitive claims.
+- New `jwt_analyze` tool + pure `decodeJwt` / `analyzeJwt` / `forgeAlgNone`
+  helpers. Confirmation is a forge-and-replay against the live verifier.
+
+## [2.4.43] — 2026-09-14
+
+### Added — Race Condition / TOCTOU Tester (concurrency oracle)
+
+- New `src/race-test.ts`: detect TOCTOU races + idempotency violations — fire
+  a CONCURRENT BURST of N identical requests and count how many succeed. If
+  more than `expected_max` (default 1) succeed, the operation is not atomic
+  under concurrency (double-spend, duplicate orders, discount abuse).
+- New `race_test` tool: success criterion is a caller-supplied regex (the
+  "marker" of a committed side effect). Pure `classifyRace` + `requestSignature`
+  for deterministic, testable logic.
+
 ## [2.4.42] — 2026-09-14
 
 ### Added — Duplicate Parameter Precedence Fuzzer (WAF-bypass oracle)

package/dist/index.js

@@ -57709,6 +57709,150 @@ async function paramPrecedenceScan(baseUrl, param, valueA, valueB, opts = {}) {
   };
 }
 
+// src/race-test.ts
+function classifyRace(input) {
+  const race = input.successes > input.expected_max;
+  return {
+    race,
+    verdict: race ? `race condition / idempotency violation — ${input.successes} of ${input.total} concurrent requests succeeded (expected ≤ ${input.expected_max}).` : `no race — ${input.successes} of ${input.total} succeeded (within expected ${input.expected_max}).`
+  };
+}
+async function raceTest(input) {
+  const method = input.method ?? "POST";
+  const N = input.concurrent ?? 10;
+  const expected = input.expected_max ?? 1;
+  const successRe = new RegExp(input.success_pattern, "i");
+  const timeoutMs = input.timeoutMs ?? 1e4;
+  const headers = { "User-Agent": "Mozilla/5.0 (blitzstrike race probe)", ...input.headers ?? {} };
+  const doFetch = async () => {
+    try {
+      const r = await fetch(input.url, { method, body: input.body, headers, redirect: "manual", signal: AbortSignal.timeout(timeoutMs) });
+      return { status: r.status, body: await r.text() };
+    } catch (e) {
+      return { status: 0, body: "", error: String(e) };
+    }
+  };
+  const results = await Promise.all(Array.from({ length: N }, () => doFetch()));
+  const successes = results.filter((r) => r.status > 0 && successRe.test(r.body)).length;
+  const errors = results.filter((r) => r.error).length;
+  const verdict = classifyRace({ successes, total: N, expected_max: expected });
+  return {
+    url: input.url,
+    method,
+    concurrent_requests: N,
+    expected_max: expected,
+    concurrent_successes: successes,
+    fetch_errors: errors,
+    success_rate: Number((successes / N).toFixed(3)),
+    race_detected: verdict.race,
+    verdict: verdict.verdict,
+    detail: verdict.race ? "multiple concurrent requests each passed the check before any committed the side effect (TOCTOU)." : "the operation appears atomic/idempotent under this concurrency (a tighter single-packet burst via HTTP/2 may still win; this is a parallel-request approximation)."
+  };
+}
+
+// src/jwt-analyze.ts
+import { createHmac } from "node:crypto";
+function b64urlDecode(seg) {
+  return Buffer.from(seg.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf8");
+}
+function decodeJwt(token) {
+  const parts = String(token).trim().split(".");
+  if (parts.length < 2)
+    return null;
+  try {
+    const header = JSON.parse(b64urlDecode(parts[0]));
+    const payload = JSON.parse(b64urlDecode(parts[1]));
+    return { header, payload, signature: parts[2] ?? "", segments: parts.length };
+  } catch {
+    return null;
+  }
+}
+function analyzeJwt(token, opts = {}) {
+  const decoded = decodeJwt(token);
+  if (!decoded)
+    return { error: "not a parseable JWT", token_preview: String(token).slice(0, 24) };
+  const { header, payload, signature, segments } = decoded;
+  const alg = String(header.alg ?? "");
+  const findings = [];
+  if (/^none$/i.test(alg)) {
+    findings.push({
+      type: "alg_none",
+      severity: "critical",
+      detail: `the token declares alg="${alg}" — a verifier that trusts the alg header skips signature verification entirely.`,
+      forge: "set header alg:none, edit payload (role:admin / another sub), drop the signature, keep the trailing dot."
+    });
+  }
+  if (segments === 2) {
+    findings.push({
+      type: "no_signature",
+      severity: "high",
+      detail: "the token has no signature segment — if the server accepts it, the payload is directly editable.",
+      forge: "edit the payload segment and replay without a signature."
+    });
+  }
+  if (/^(RS|ES|PS)\d+$/i.test(alg)) {
+    findings.push({
+      type: "key_confusion",
+      severity: "high",
+      detail: `asymmetric alg ${alg} — if the verifier accepts HS256, the PUBLIC key can be reused as the HMAC secret (key confusion).`,
+      forge: "re-sign an edited payload with HS256 using the RSA public key (from /jwks.json or /.well-known/jwks.json) as the HMAC secret."
+    });
+  }
+  if (header.kid !== undefined) {
+    findings.push({
+      type: "kid_header",
+      severity: "medium",
+      detail: `kid header present ("${String(header.kid).slice(0, 40)}") — if the verifier loads the key from a file/DB/URL named by kid, this is a path-traversal / SQLi / SSRF vector.`,
+      forge: 'try kid="../../../../dev/null" (empty key) or a URL you control.'
+    });
+  }
+  if (header.jku !== undefined || header.x5u !== undefined) {
+    findings.push({
+      type: "remote_key_header",
+      severity: "medium",
+      detail: "jku/x5u header present — the verifier may fetch the verification key from a URL the token controls (SSRF / key substitution).",
+      forge: "host a JWKS at a URL you control and point jku at it."
+    });
+  }
+  if (/^HS\d+$/i.test(alg) && signature && opts.wordlist && opts.wordlist.length > 0) {
+    const data = `${token.split(".")[0]}.${token.split(".")[1]}`;
+    for (const w of opts.wordlist.slice(0, 1e4)) {
+      const sig = createHmac("sha256", w).update(data).digest("base64url");
+      if (sig === signature) {
+        findings.push({
+          type: "weak_secret",
+          severity: "critical",
+          detail: `the HS256 secret is a guessable value: "${w}" — the token is directly forgeable.`,
+          forge: `sign any payload with HS256 using secret "${w}".`
+        });
+        break;
+      }
+    }
+  }
+  if (payload.exp === undefined && payload.iat === undefined) {
+    findings.push({
+      type: "no_expiry",
+      severity: "low",
+      detail: "no exp/iat claim — the token never expires (unbounded replay window)."
+    });
+  }
+  const sensitiveKeys = Object.keys(payload).filter((k) => /role|admin|is_admin|permission|scope|privilege|sub|user_id|email|is_staff/i.test(k));
+  const sensitiveClaims = {};
+  for (const k of sensitiveKeys)
+    sensitiveClaims[k] = payload[k];
+  const forgeable = findings.some((f) => f.severity === "critical" || f.severity === "high");
+  return {
+    alg,
+    segments,
+    forgeable,
+    findings,
+    sensitive_claims: sensitiveClaims,
+    header,
+    payload,
+    interpretation: "a finding is a forge VECTOR, not proof — confirm by forging + replaying against the live verifier before reporting."
+  };
+}
+
 // src/enterprise-benchmark.ts
 import { existsSync as existsSync11, readFileSync as readFileSync20, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
 import { join as join18, resolve } from "node:path";
@@ -58737,6 +58881,36 @@ ${statusLine}` : statusLine },
   }, async ({ base_url, param, value_a, value_b }) => {
     return { content: [{ type: "text", text: JSON.stringify(await paramPrecedenceScan(base_url, param, value_a, value_b)) }] };
   });
+  server.registerTool("race_test", {
+    title: "Race condition / TOCTOU tester (concurrency oracle)",
+    description: "LIVE (black-box): detect TOCTOU race conditions + idempotency violations — fire a sanity request, then a CONCURRENT BURST of N identical requests, and count how many succeed. If more than expected_max succeed, the operation is not atomic under concurrency (double-spend, duplicate orders, discount abuse, mass action). Deterministic: success is a caller-supplied regex.",
+    inputSchema: {
+      url: string2().describe("Full request URL"),
+      method: string2().optional().describe("HTTP method (default POST)"),
+      body: string2().optional().describe("Request body"),
+      success_pattern: string2().describe("Regex that matches a 'success' response (the committed side effect)"),
+      concurrent: number2().optional().describe("Number of concurrent requests (default 10)"),
+      expected_max: number2().optional().describe("Max expected successes (default 1)")
+    }
+  }, async ({ url, method, body, success_pattern, concurrent, expected_max }) => {
+    return { content: [{ type: "text", text: JSON.stringify(await raceTest({ url, method, body, success_pattern, concurrent, expected_max })) }] };
+  });
+  server.registerTool("jwt_analyze", {
+    title: "JWT forgeability analyzer (identity token oracle)",
+    description: "Parse a JWT and enumerate its forge vectors DETERMINISTICALLY — alg:none, missing signature, RS256→HS256 key confusion, kid/jku header injection, weak HS secret (brute-forced against a wordlist), missing expiry, sensitive claims. Returns a forgeable verdict + PoC hints. Confirmation is a forge-and-replay against the live verifier, not this hint.",
+    inputSchema: {
+      token: string2().describe("The JWT (eyJ...) to analyze"),
+      wordlist: string2().optional().describe("JSON array of candidate HS secrets to brute-force")
+    }
+  }, async ({ token, wordlist }) => {
+    let wl;
+    try {
+      wl = wordlist ? JSON.parse(wordlist) : undefined;
+    } catch {
+      return { content: [{ type: "text", text: JSON.stringify({ error: "invalid wordlist JSON" }) }] };
+    }
+    return { content: [{ type: "text", text: JSON.stringify(analyzeJwt(token, { wordlist: wl })) }] };
+  });
   server.registerTool("payload_lookup", {
     title: "Look up exploit payloads",
     description: "INTEL: find a payload collection (66 categories from PayloadsAllTheThings).",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.42",
+  "version": "2.4.44",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {