blitzstrike 2.4.54 → 2.4.56

package/CHANGELOG.md

@@ -5,15 +5,35 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.56] — 2026-09-14
+
+### Added — Hardcoded-secret detector (CWE-798)
+
+- New `detectHardcodedSecret`: flags a secret field (api_key, db_password,
+  access_token, aws_*_key, client_secret, jwt_secret, …) assigned a hardcoded
+  literal value in source — CWE-798 Use of Hard-coded Credentials. Skips
+  placeholders, environment lookups (`getenv`/`process.env`), variable references,
+  and comment mentions. CWE mapping added; the LLM system prompt now directs
+  live verification of frontend/JS secrets via chrome-devtools (drive_devtools).
+
+## [2.4.55] — 2026-09-14
+
+### Changed — universal framing (no vendor-specific references)
+
+- Removed every vendor/plugin-specific name from source comments, test fixtures,
+  action-heuristic example data, and the changelog — the tool is framework-agnostic
+  and must not embed third-party product names. Detection logic is unchanged; only
+  identifiers/examples/comments were generalized.
+
 ## [2.4.54] — 2026-09-14
 
 ### Changed — file-upload scope widened + antiscript-not-a-defense regression
 
 - Widened the file-upload defense scope from 6 to 30 lines so a nearby
   extension whitelist / wp_check_filetype is still seen.
-- Regression test: `wpcf7_antiscript_file_name` (extension-strip) is NOT a
-  defense signal — CF7 CVE-2020-35489 was a filename special-char issue and the
-  vulnerable 5.3.1 also calls it; treating antiscript as a defense caused a
+- Regression test: an antiscript filename helper (extension-strip) is NOT a
+  defense signal — a filename special-char vuln is not extension-based and the
+  vulnerable version also calls it; treating antiscript as a defense caused a
   false negative. Remaining file-upload FPs (2/19 clean plugins) are cross-file
   validation or admin-only context — inherent to per-file detection.
 
@@ -31,12 +51,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [2.4.52] — 2026-09-14
 
-### Added — Unrestricted-upload config detection (elFinder RCE)
+### Added — Unrestricted-upload config detection (file-manager RCE)
 
 - New `detectUnrestrictedUpload`: flags a file-manager/connector config that sets
   `uploadAllow => array('all')` (especially with `uploadOrder => deny,allow`),
-  i.e. ANY mimetype — including `.php` — is uploadable. This is the elFinder
-  connector shape (wp-file-manager CVE-2020-25213); now surfaces
+  i.e. ANY mimetype — including `.php` — is uploadable. This is the classic
+  file-manager connector misconfiguration (CVE-2020-25213); now surfaces
   `file_upload @ connector.minimal.php:157`.
 - System prompt updated so the LLM agent understands AND can try the newest
   detectors: `priv_esc` (role/capability change from request input, cross-file)
@@ -51,8 +71,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
   privileged sink (role/capability/user change) reachable from a public entry
   point with no capability check on the chain. Plus a DIRECT pass that flags a
   role/capability sink whose ARGUMENTS are themselves request input — the
-  precise `set_role($id, sanitize_key($_POST['um-role']))` shape (ultimate-member
-  CVE-2023-3460). Now surfaces 6 priv_esc findings in ultimate-member (was 0).
+  precise `set_role($id, sanitize_key($_POST['role']))` shape (CVE-2023-3460).
+  Now surfaces the privilege-escalation sink (was 0).
 
 ### Changed — precision fixes for role/escalation bugs
 
@@ -71,10 +91,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 - `iterSourceFiles` previously skipped `lib`/`libraries`/`libs` dirs, which
   silently MISSED entire plugins that keep their own code under `lib/`
-  (all-in-one-wp-migration: 7→150 files scanned; wp-file-manager/elFinder: 17→329
-  files, now surfacing elFinder SQLi + SSRF + path-confusion). Only genuinely
-  third-party dirs (`third-party`, `third_party`, `vendor`, `node_modules`) are
-  skipped now — a false-negative is worse than any false positive.
+  (a migration plugin: 7→150 files scanned; a file-manager plugin's bundled
+  library: 17→329 files, now surfacing SQLi + SSRF + path-confusion). Only
+  genuinely third-party dirs (`third-party`, `third_party`, `vendor`,
+  `node_modules`) are skipped now — a false-negative is worse than any false
+  positive.
 
 ## [2.4.49] — 2026-09-14
 
@@ -101,8 +122,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
   the handler actually performs a WRITE (option/meta/user/post/comment writes,
   file upload/write, `$wpdb->query/insert/update/delete`, `wp_mail`, `wp_redirect`).
   Read-only handlers (list/search/get) are no longer flagged — removes the CSRF/
-  authz false-positive storm (forminator 90→16, elementor 11→4, wp-fastest-cache
-  15→1).
+  authz false-positive storm (a forms plugin 90→16, a page builder 11→4, a cache
+  plugin 15→1).
 - Removed `is_admin()` / `wp_doing_ajax()` from the auth surface — they are
   request-context checks, not authorization (treating them as auth caused false
   negatives).
@@ -119,8 +140,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
   'wp_loaded'|'template_redirect', ...)` that reads request input directly —
   flagged for missing nonce (CSRF) and missing capability (privileged ops).
 - Auth surface widened (`is_admin`, `is_super_admin`, `current_user_can_edit_post`,
-  `wp_doing_ajax`). Benchmark: elementor 0→11, forminator ~3→90, learnpress 1→11
-  authz/nonce findings (class-method handlers now visible).
+  `wp_doing_ajax`). Benchmark: a page builder 0→11, a forms plugin ~3→90, an LMS
+  plugin 1→11 authz/nonce findings (class-method handlers now visible).
 
 ## [2.4.46] — 2026-09-14
 
@@ -144,8 +165,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
   written file's name/extension is attacker-controlled and no filetype/extension
   validation is present nearby — the classic upload-a-.php-shell → RCE.
 - Benchmark-driven: a blind scan of 10 real vulnerable plugins found this was
-  the biggest detection gap (missed in 3 plugins). Now caught in forminator +
-  contact-form-7; the bundled-library (elFinder) case remains gated by the
+  the biggest detection gap (missed in 3 plugins). Now caught in a forms plugin
+  + a contact-form plugin; the bundled-library case remains gated by the
   lib/vendor skip policy.
 
 ## [2.4.44] — 2026-09-14
@@ -229,7 +250,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
   their likely vulnerability class (upload/import→AFU/RCE, delete/write→
   file-write, load/download→LFI, login/reset→auth-bypass, exec/run→command
   injection, settings/update→unauth options change, …) — as DATA, with real
-  examples (ai1wm_import, revslider_upload, duplicator_download, …).
+  examples (backup_import, slider_upload, backup_download, …).
 - New `action_surface` tool: extract every `wp_ajax_*` action, cross-reference
   the hook (nopriv?) + authz gap (nonce/capability), and return a DERIVED
   priority so the scanner targets the most dangerous action first.

package/dist/index.js

@@ -56776,6 +56776,7 @@ function detectComplexBugs(code, file) {
   detectFileUploadRce(code, file, out);
   detectUnrestrictedUpload(code, file, out);
   detectSqlInjection(code, file, out);
+  detectHardcodedSecret(code, file, out);
   out.push(...detectWrongSanitizer(code, file));
   out.push(...detectMissingAuthz(code, file));
   const seen = new Set;
@@ -56979,7 +56980,7 @@ function detectUnrestrictedUpload(code, file, out) {
       category: "Unrestricted upload config (uploadAllow=all)",
       severity: denyFirst ? "high" : "medium",
       evidence: l.trim(),
-      detail: denyFirst ? "File-manager/connector config sets uploadAllow='all' with uploadOrder deny→allow — every mimetype (including .php) is uploadable → RCE (elFinder connector shape, CVE-2020-25213)." : "File-manager/connector config sets uploadAllow='all' — any file type can be uploaded; verify the upload path is not web-reachable or that a server-side extension whitelist exists."
+      detail: denyFirst ? "File-manager/connector config sets uploadAllow='all' with uploadOrder deny→allow — every mimetype (including .php) is uploadable → RCE." : "File-manager/connector config sets uploadAllow='all' — any file type can be uploaded; verify the upload path is not web-reachable or that a server-side extension whitelist exists."
     });
   }
 }
@@ -57011,6 +57012,43 @@ function detectSqlInjection(code, file, out) {
     });
   }
 }
+var SECRET_FIELDS = "api[_-]?key|apikey|api[_-]?secret|access[_-]?key|access[_-]?token|secret[_-]?key|secret[_-]?access[_-]?key|auth[_-]?token|client[_-]?secret|consumer[_-]?secret|consumer[_-]?key|private[_-]?key|db[_-]?password|database[_-]?password|db[_-]?pass|passwd|password|jwt[_-]?secret|encryption[_-]?key|encryption[_-]?password|github[_-]?token|gitlab[_-]?token|stripe[_-]?key|sendgrid[_-]?api[_-]?key|datadog[_-]?api[_-]?key|cloudflare[_-]?api[_-]?key|slack[_-]?token|aws[_-]?access[_-]?key[_-]?id|aws[_-]?secret[_-]?access[_-]?key|aws[_-]?session[_-]?token|bot[_-]?token";
+var SECRET_FIELD_RE = new RegExp(`\\b(${SECRET_FIELDS})\\s*(?:::|=>|=|:)\\s*`, "gi");
+var SECRET_PLACEHOLDER_RE = /^(null|true|false|undefined|your_|xxx+|changeme|example|placeholder|test|secret|password|token|key|api|smtp|localhost|root|admin|pass|change|me|none|na|foo|bar|dummy)$/i;
+function detectHardcodedSecret(code, file, out) {
+  const ls = lines2(code);
+  const clean = stripCommentsOnly(code);
+  SECRET_FIELD_RE.lastIndex = 0;
+  let m;
+  while ((m = SECRET_FIELD_RE.exec(clean)) !== null) {
+    const field = m[1];
+    const rest = clean.slice(m.index + m[0].length);
+    const lineEnd = rest.search(/\r?\n/);
+    const valueRaw = (lineEnd === -1 ? rest : rest.slice(0, lineEnd)).trim();
+    let value = "";
+    const qm = valueRaw.match(/^["']([^"']{4,})["']/);
+    if (qm)
+      value = qm[1];
+    else
+      value = (valueRaw.match(/^([A-Za-z0-9._/+=@-]{8,})/) ?? [])[1] ?? "";
+    if (!value)
+      continue;
+    if (SECRET_PLACEHOLDER_RE.test(value))
+      continue;
+    if (/\$[A-Za-z_]|[{}\[\]]|process\.env|getenv|os\.environ|config\s*\(|env\s*\(/.test(valueRaw))
+      continue;
+    const ln = lineNo2(code, m.index);
+    out.push({
+      file,
+      line: ln,
+      type: "hardcoded_secret",
+      category: "Hardcoded secret (credential in source)",
+      severity: "high",
+      evidence: (ls[ln - 1] ?? "").trim(),
+      detail: `Secret field '${field}' is assigned a hardcoded value in source — the credential is exposed to anyone with code access (CWE-798 Hard-coded Credentials). Rotate it and load from the environment instead.`
+    });
+  }
+}
 
 // src/guidance.ts
 var SINK_DIRECTIVES = {
@@ -57684,14 +57722,14 @@ function variantScan(root, opts = {}) {
 
 // src/action-heuristics.ts
 var ACTION_HEURISTICS = [
-  { pattern: /upload|import|install|activate|plugin|theme/, vuln_class: "Arbitrary File Upload / Plugin Install → RCE", detector: "file_upload + missing_authz", weight: 0.9, examples: ["ai1wm_import", "ocdi_upload_manual_import_files", "alone_import_pack_install_plugin", "revslider_upload"] },
-  { pattern: /write|save|delete|remove|move|rename/, vuln_class: "Arbitrary File Write / Delete / Move", detector: "file_operations", weight: 0.8, examples: ["ai1wm_backup_delete"] },
-  { pattern: /load|include|template|file|download|read/, vuln_class: "LFI / Path Traversal / RFI", detector: "path_traversal + file_inclusion", weight: 0.8, examples: ["duplicator_download", "get_file", "preview"] },
+  { pattern: /upload|import|install|activate|plugin|theme/, vuln_class: "Arbitrary File Upload / Plugin Install → RCE", detector: "file_upload + missing_authz", weight: 0.9, examples: ["backup_import", "demo_upload_import_files", "template_import_install_package", "slider_upload"] },
+  { pattern: /write|save|delete|remove|move|rename/, vuln_class: "Arbitrary File Write / Delete / Move", detector: "file_operations", weight: 0.8, examples: ["backup_delete"] },
+  { pattern: /load|include|template|file|download|read/, vuln_class: "LFI / Path Traversal / RFI", detector: "path_traversal + file_inclusion", weight: 0.8, examples: ["backup_download", "get_file", "preview"] },
   { pattern: /exec|run|cmd|shell|eval|code/, vuln_class: "OS Command / Code Injection / eval", detector: "command_execution + code_execution", weight: 0.85, examples: [] },
   { pattern: /import|unserialize|restore|data/, vuln_class: "Insecure Deserialization / Object Injection", detector: "deserialization", weight: 0.8, examples: [] },
   { pattern: /query|search|filter|export|list/, vuln_class: "SQLi → RCE / Create Admin", detector: "sql_execution", weight: 0.7, examples: [] },
   { pattern: /render|shortcode|block|preview/, vuln_class: "SSTI / Shortcode / Block Injection", detector: "ssti", weight: 0.6, examples: [] },
-  { pattern: /settings|option|update/, vuln_class: "Unauth Options Update / Settings Change / Missing Cap+Nonce", detector: "missing_authz + missing_nonce", weight: 0.85, examples: ["woocommerce_*", "elementor_*"] },
+  { pattern: /settings|option|update/, vuln_class: "Unauth Options Update / Settings Change / Missing Cap+Nonce", detector: "missing_authz + missing_nonce", weight: 0.85, examples: ["shop_settings_update", "builder_save"] },
   { pattern: /login|auth|token|reset|verify/, vuln_class: "Auth Bypass / Auto Login / Account Takeover", detector: "missing_authz + type_juggling", weight: 0.9, examples: ["auto-login", "magic link", "reset password"] },
   { pattern: /role|capability|promote|change_role/, vuln_class: "Privilege Escalation", detector: "missing_authz", weight: 0.9, examples: [] },
   { pattern: /register|signup|create_user/, vuln_class: "Register → RCE / AFU / PrivEsc", detector: "file_upload + missing_authz", weight: 0.8, examples: [] }
@@ -58502,7 +58540,7 @@ function createServer() {
 ` + `- Keep trying every lead AND every chain step until each is verified/executed or blocked, THEN generate_report. Never deliver a bare surface map, and never stop at 'found X' when X enables more.
 
 ` + "TWO PATHS:\\n" + "- Source path on disk -> blitz_scan / taint_file / eagle_eye2 (static).\\n" + "- Live URL -> live_recon / active_scan / strike_verify (web-hunting).\\n\\n" + `DEEPEN A FINDING: attack_plan(target, tech, params) to get the prioritized vector plan (decide what to test next with data); list_chains (escalation), chain_links (compose), technique_lookup(cls), payload_lookup, bypass_lookup (blocked). Phase doctrine: read_skill(bs-orchestrate-engagement | bs-web-hunting | bs-source-audit | bs-verify-finding). Campaign plan: read_playbook(target-type). On any failure call retry_guidance(signal) / model_fallback(signal) before giving up.
-` + "KNOWLEDGE BASE (discover, don't guess): skillLookup(topic) / listSkills for the 40 attack-path + hunting skills (ap-*, hp-*, bs-*); list_attack_vectors / attack_vectors(cat) for the 34-category vector taxonomy; taxonomy(kind) for OWASP/CWE/ASVS/API-top-10; read_playbook(type) for the 17 campaign playbooks; list_manuals / read_tool_manual for 317 tool references; list_tools / run_catalog_tool for the 141-tool catalog. Every tool, skill, and data layer is reachable from these. CROSS-TARGET INTELLIGENCE: strike_resolve auto-records confirmed/false_positive verdicts into the empirical ledger; query it with intelligence(action=hit_rates/top_vectors) so a new target on a known tech inherits historical hit-rates (attack_plan already blends them into success_probability). LIVE PENTEST + TARGETING (black-box, WAF-safe): cache_gap(base_url, endpoint) fuzzes path-normalization + static-extension variants for cache deception/poisoning; blind_oracle(base_url, param, value) detects which SINK a param reaches (sql/ssti/xss) via benign arithmetic (id=1+0, test${7*7}) WITHOUT a malicious payload; param_precedence(base_url, param, A, B) maps duplicate-parameter precedence (first/last-wins) for WAF-bypass. SOURCE TARGETING: action_surface(code) maps every wp_ajax_* action to its vuln class + DERIVED priority (what to look for WHERE); security_state(sanitizers, sink) gives a wrong-context sanitization verdict; framework_knowledge(framework) returns auth/nonce primitives for 9 frameworks; variant_scan(root, signature) mass-sweeps an install base for ONE bug family; patch_analyze(old, new) REVERSES a security patch into the 0-day, and its mine_signature feeds variant_scan to sweep unpatched copies. All of these are DETECTION HINTS — verify each live (strike_verify / browser_validate) before it enters the report. NEWEST DETECTORS — understand AND try them: variant_scan also emits priv_esc (privilege escalation — a role/capability/user change fed by request input, traced cross-file via reverse call-graph, e.g. set_role($id, sanitize_key($_POST['um-role'])) or update_user_meta(...,'wp_capabilities', $_POST[...])) and flags uploadAllow=>array('all') unrestricted-upload configs as file_upload (the elFinder/connector shape). TO TRY a priv_esc hit: submit the role field with 'administrator' (or send wp_capabilities meta) and confirm the account actually gains admin. TO TRY an unrestricted-upload hit: POST a .php/.phtml and confirm it lands web-reachable + executes. A static hit is a HYPOTHESIS until verified live — never report unverified.\n" + `PRECISION ANALYSIS — chrome-devtools MCP is MANDATORY, not optional:
+` + "KNOWLEDGE BASE (discover, don't guess): skillLookup(topic) / listSkills for the 40 attack-path + hunting skills (ap-*, hp-*, bs-*); list_attack_vectors / attack_vectors(cat) for the 34-category vector taxonomy; taxonomy(kind) for OWASP/CWE/ASVS/API-top-10; read_playbook(type) for the 17 campaign playbooks; list_manuals / read_tool_manual for 317 tool references; list_tools / run_catalog_tool for the 141-tool catalog. Every tool, skill, and data layer is reachable from these. CROSS-TARGET INTELLIGENCE: strike_resolve auto-records confirmed/false_positive verdicts into the empirical ledger; query it with intelligence(action=hit_rates/top_vectors) so a new target on a known tech inherits historical hit-rates (attack_plan already blends them into success_probability). LIVE PENTEST + TARGETING (black-box, WAF-safe): cache_gap(base_url, endpoint) fuzzes path-normalization + static-extension variants for cache deception/poisoning; blind_oracle(base_url, param, value) detects which SINK a param reaches (sql/ssti/xss) via benign arithmetic (id=1+0, test${7*7}) WITHOUT a malicious payload; param_precedence(base_url, param, A, B) maps duplicate-parameter precedence (first/last-wins) for WAF-bypass. SOURCE TARGETING: action_surface(code) maps every wp_ajax_* action to its vuln class + DERIVED priority (what to look for WHERE); security_state(sanitizers, sink) gives a wrong-context sanitization verdict; framework_knowledge(framework) returns auth/nonce primitives for 9 frameworks; variant_scan(root, signature) mass-sweeps an install base for ONE bug family; patch_analyze(old, new) REVERSES a security patch into the 0-day, and its mine_signature feeds variant_scan to sweep unpatched copies. All of these are DETECTION HINTS — verify each live (strike_verify / browser_validate) before it enters the report. NEWEST DETECTORS — understand AND try them: variant_scan also emits priv_esc (privilege escalation — a role/capability/user change fed by request input, traced cross-file via reverse call-graph, e.g. set_role($id, sanitize_key($_POST['um-role'])) or update_user_meta(...,'wp_capabilities', $_POST[...])) and flags uploadAllow=>array('all') unrestricted-upload configs as file_upload (the file-manager/connector shape). TO TRY a priv_esc hit: submit the role field with 'administrator' (or send wp_capabilities meta) and confirm the account actually gains admin. TO TRY an unrestricted-upload hit: POST a .php/.phtml and confirm it lands web-reachable + executes. variant_scan also emits hardcoded_secret (a secret field — api_key/db_password/access_token/aws_* — assigned a literal value in source, CWE-798); verify a frontend/JS secret live via drive_devtools (inspect the JS bundle / network response and confirm the key is actually exposed), and for a backend secret confirm it is reachable/valid. A static hit is a HYPOTHESIS until verified live — never report unverified.\n" + `PRECISION ANALYSIS — chrome-devtools MCP is MANDATORY, not optional:
 ` + `- When a lead needs DOM/JS precision — DOM-XSS sink execution, AJAX endpoint + payload interception, JS runtime errors, redirect chains, SSO/token flow, or anything a static HTML glance cannot prove — call drive_devtools(target). It spawns chrome-devtools-mcp and drives a REAL headless browser (navigate -> list_network_requests -> list_console_messages -> evaluate_script), giving reproducible evidence instead of a guess.
 ` + `- Before calling it, check_mcp() to confirm the browser MCP is available; if not, blitzstrike install-tools or npm i -g chrome-devtools-mcp. Never substitute eyeballing minified JS or a static sink guess when a live browser can PROVE it. This is the precision + consistency layer.
 ` + "EXTERNAL MCP SERVERS (verified, connect them — NOT one-shot CLIs): chrome-devtools-mcp (29 tools: list_network_requests/get_network_request for raw HTTP interception, list_console_messages for JS errors + DOM-XSS, evaluate_script to run JS, take_screenshot) -> stdio chrome-devtools-mcp --headless --chromeArg=--no-sandbox --chromeArg=--disable-gpu (as root/container this is MANDATORY or the browser crashes; add --proxyServer http://127.0.0.1:8080 to route through Burp, --acceptInsecureCerts for bad TLS). burp-suite-mcp (proxy history + active scan + repeater) -> NOT npm: build the JAR (git clone https://github.com/PortSwigger/mcp-server.git && cd mcp-server && ./gradlew embedProxyJar), load it in Burp Extensions, then connect the client to http://127.0.0.1:9876 (SSE) or the stdio proxy java -jar mcp-proxy-all.jar --sse-url http://127.0.0.1:9876."

package/intelligence/cwe_map.json

@@ -54,6 +54,7 @@
     {"id": "web_vulnerabilities_methodology", "cwe": "CWE-1057", "name": "Improper Inventory / Methodology"},
     {"id": "missing_authz", "cwe": "CWE-862", "name": "Missing Authorization"},
     {"id": "missing_nonce", "cwe": "CWE-352", "name": "Cross-Site Request Forgery (Missing Nonce)"},
-    {"id": "priv_esc", "cwe": "CWE-269", "name": "Improper Privilege Management"}
+    {"id": "priv_esc", "cwe": "CWE-269", "name": "Improper Privilege Management"},
+    {"id": "hardcoded_secret", "cwe": "CWE-798", "name": "Use of Hard-coded Credentials"}
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.54",
+  "version": "2.4.56",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {