blitzstrike 2.4.55 → 2.4.57

package/CHANGELOG.md

@@ -5,6 +5,35 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.57] — 2026-09-14
+
+### Added — Secret detection v2 (single taxonomy + format + entropy tiers)
+
+- New `src/secrets.ts` — the single source of truth for secret field names,
+  known-format signatures, and redaction patterns. `sinks.scanSinks`,
+  `complex-bugs.detectHardcodedSecret`, and the evidence redactor all import
+  from it (previously three divergent copies).
+- `hardcoded_secret` now detects in THREE tiers: (1) a known secret FIELD
+  assigned a literal (HIGH), (2) a known secret FORMAT — JWT/AWS/GitHub/Slack/
+  Google/Twilio/SendGrid/Mailgun/PEM — regardless of variable name (HIGH), and
+  (3) a high-entropy token (Shannon ≥ 4.5 bits/char, ≥32 chars, mixed case+digit)
+  under a non-obvious name (MEDIUM, suspect). Entropy skips minified/bundled files.
+- CWE map completed: added `type_juggling` (CWE-697), `path_confusion` (CWE-22),
+  `wrong_sanitizer` (CWE-20) — the compliance tool now maps all 16 detector types.
+- Added a detector-inventory self-test: every ComplexBugType must have a CWE
+  mapping (fails at build time if a new detector forgets its mapping).
+
+## [2.4.56] — 2026-09-14
+
+### Added — Hardcoded-secret detector (CWE-798)
+
+- New `detectHardcodedSecret`: flags a secret field (api_key, db_password,
+  access_token, aws_*_key, client_secret, jwt_secret, …) assigned a hardcoded
+  literal value in source — CWE-798 Use of Hard-coded Credentials. Skips
+  placeholders, environment lookups (`getenv`/`process.env`), variable references,
+  and comment mentions. CWE mapping added; the LLM system prompt now directs
+  live verification of frontend/JS secrets via chrome-devtools (drive_devtools).
+
 ## [2.4.55] — 2026-09-14
 
 ### Changed — universal framing (no vendor-specific references)

package/dist/index.js

@@ -31000,6 +31000,36 @@ function recordAudit(event, opts = {}) {
 // src/evidence.ts
 init_version();
 import { createHash as createHash2 } from "node:crypto";
+
+// src/secrets.ts
+var SECRET_FIELDS = "api[_-]?key|apikey|api[_-]?secret|access[_-]?key|access[_-]?token|secret[_-]?key|secret[_-]?access[_-]?key|auth[_-]?token|client[_-]?secret|consumer[_-]?secret|consumer[_-]?key|private[_-]?key|db[_-]?password|database[_-]?password|db[_-]?pass|passwd|password|jwt[_-]?secret|encryption[_-]?key|encryption[_-]?password|github[_-]?token|gitlab[_-]?token|stripe[_-]?key|sendgrid[_-]?api[_-]?key|datadog[_-]?api[_-]?key|cloudflare[_-]?api[_-]?key|slack[_-]?token|aws[_-]?access[_-]?key[_-]?id|aws[_-]?secret[_-]?access[_-]?key|aws[_-]?session[_-]?token|bot[_-]?token";
+var SECRET_FORMATS = [
+  { name: "JWT", re: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{4,}/g },
+  { name: "AWS access key", re: /\bAKIA[0-9A-Z]{16}\b/g },
+  { name: "GitHub PAT (classic)", re: /\bghp_[A-Za-z0-9]{20,}\b/g },
+  { name: "GitHub PAT (fine-grained)", re: /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g },
+  { name: "OpenAI/Stripe key", re: /\bsk-[A-Za-z0-9]{20,}\b/g },
+  { name: "Stripe live/test key", re: /\b(?:sk|pk|rk)_(?:live|test)_[0-9a-zA-Z]{10,}\b/g },
+  { name: "Slack token", re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g },
+  { name: "Google API key", re: /\bAIza[0-9A-Za-z_-]{35}\b/g },
+  { name: "Twilio account SID", re: /\bAC[0-9a-f]{32}\b/g },
+  { name: "SendGrid API key", re: /\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}\b/g },
+  { name: "Mailgun API key", re: /\bkey-[0-9a-zA-Z]{32}\b/g },
+  { name: "PEM private key", re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/g }
+];
+function shannonEntropy(s) {
+  if (!s)
+    return 0;
+  const freq = new Map;
+  for (const c of s)
+    freq.set(c, (freq.get(c) ?? 0) + 1);
+  let e = 0;
+  for (const n of freq.values()) {
+    const p = n / s.length;
+    e -= p * Math.log2(p);
+  }
+  return e;
+}
 var REDACTION_PATTERNS = [
   [/(authorization\s*[:=]\s*)(bearer\s+)?[A-Za-z0-9._~+/=-]{8,}/gi, "$1$2[REDACTED]"],
   [/(api[_-]?key\s*[:=]\s*)["']?[A-Za-z0-9._-]{16,}["']?/gi, "$1[REDACTED]"],
@@ -31011,10 +31041,17 @@ var REDACTION_PATTERNS = [
   [/(session\s*[:=]\s*)["']?[A-Za-z0-9._-]{12,}["']?/gi, "$1[REDACTED]"],
   [/(cookie\s*[:=]\s*)["']?[A-Za-z0-9._-]{12,}["']?/gi, "$1[REDACTED]"],
   [/(set-cookie\s*:\s*)[^\r\n]+/gi, "$1[REDACTED]"],
+  [/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{4,}/g, "[REDACTED]"],
   [/AKIA[0-9A-Z]{16}/g, "[REDACTED]"],
   [/ghp_[A-Za-z0-9]{20,}/g, "[REDACTED]"],
   [/github_pat_[A-Za-z0-9_]{20,}/g, "[REDACTED]"],
   [/sk-[A-Za-z0-9]{20,}/g, "[REDACTED]"],
+  [/\b(?:sk|pk|rk)_(?:live|test)_[0-9a-zA-Z]{10,}\b/g, "[REDACTED]"],
+  [/\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, "[REDACTED]"],
+  [/\bAIza[0-9A-Za-z_-]{35}\b/g, "[REDACTED]"],
+  [/\bAC[0-9a-f]{32}\b/g, "[REDACTED]"],
+  [/\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}\b/g, "[REDACTED]"],
+  [/\bkey-[0-9a-zA-Z]{32}\b/g, "[REDACTED]"],
   [/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g, "[REDACTED]"]
 ];
 function redactSecrets(text) {
@@ -31024,6 +31061,8 @@ function redactSecrets(text) {
   }
   return out;
 }
+
+// src/evidence.ts
 function hasSecrets(text) {
   return redactSecrets(text) !== text;
 }
@@ -31321,7 +31360,8 @@ var PATTERNS = [
   { type: "credential", label: "password assignment", regex: /(?:password|passwd|pass|pwd)\s*[:=]\s*["'][^"']{3,}["']/i },
   { type: "credential", label: "hardcoded cred", regex: /\b(?:admin|root|user(?:name)?)\s*[:=]\s*["'][^"']{3,}["']/i },
   { type: "deserialization", label: "pickle/unserialize/yaml", regex: /\b(?:pickle\.loads|unserialize\s*\(|yaml\.load\s*\(|marshal\.loads|jsonpickle)/i },
-  { type: "xxe", label: "XML parse", regex: /\b(?:etree\.(?:parse|fromstring)|lxml\.etree|xml\.(?:dom|sax)|DocumentBuilder|simplexml_load)/i }
+  { type: "xxe", label: "XML parse", regex: /\b(?:etree\.(?:parse|fromstring)|lxml\.etree|xml\.(?:dom|sax)|DocumentBuilder|simplexml_load)/i },
+  ...SECRET_FORMATS.map((f) => ({ type: "secret", label: f.name, regex: f.re }))
 ];
 function scanSinks(text) {
   if (!text || text.length < 3)
@@ -56776,6 +56816,7 @@ function detectComplexBugs(code, file) {
   detectFileUploadRce(code, file, out);
   detectUnrestrictedUpload(code, file, out);
   detectSqlInjection(code, file, out);
+  detectHardcodedSecret(code, file, out);
   out.push(...detectWrongSanitizer(code, file));
   out.push(...detectMissingAuthz(code, file));
   const seen = new Set;
@@ -57011,6 +57052,93 @@ function detectSqlInjection(code, file, out) {
     });
   }
 }
+var SECRET_FIELD_RE = new RegExp(`\\b(${SECRET_FIELDS})\\s*(?:::|=>|=|:)\\s*`, "gi");
+var SECRET_PLACEHOLDER_RE = /^(null|true|false|undefined|your_|xxx+|changeme|example|placeholder|test|secret|password|token|key|api|smtp|localhost|root|admin|pass|change|me|none|na|foo|bar|dummy)$/i;
+var ENTROPY_EXCLUDE_VAR = /\b(data|payload|content|body|base64|encoded|encode|image|binary|blob|hash|digest|checksum|nonce|uuid|etag|signature|sig|cipher|iv|ciphertext|plaintext|thumb|thumbnail)\b/i;
+function detectHardcodedSecret(code, file, out) {
+  const ls = lines2(code);
+  const clean = stripCommentsOnly(code);
+  const flaggedLines = new Set;
+  SECRET_FIELD_RE.lastIndex = 0;
+  let m;
+  while ((m = SECRET_FIELD_RE.exec(clean)) !== null) {
+    const field = m[1];
+    const rest = clean.slice(m.index + m[0].length);
+    const lineEnd = rest.search(/\r?\n/);
+    const valueRaw = (lineEnd === -1 ? rest : rest.slice(0, lineEnd)).trim();
+    let value = "";
+    const qm = valueRaw.match(/^["']([^"']{4,})["']/);
+    if (qm)
+      value = qm[1];
+    else
+      value = (valueRaw.match(/^([A-Za-z0-9._/+=@-]{8,})/) ?? [])[1] ?? "";
+    if (!value)
+      continue;
+    if (SECRET_PLACEHOLDER_RE.test(value))
+      continue;
+    if (/\$[A-Za-z_]|[{}\[\]]|process\.env|getenv|os\.environ|config\s*\(|env\s*\(/.test(valueRaw))
+      continue;
+    const ln = lineNo2(code, m.index);
+    flaggedLines.add(ln);
+    out.push({
+      file,
+      line: ln,
+      type: "hardcoded_secret",
+      category: "Hardcoded secret (credential in source)",
+      severity: "high",
+      evidence: (ls[ln - 1] ?? "").trim(),
+      detail: `Secret field '${field}' is assigned a hardcoded value in source — the credential is exposed to anyone with code access (CWE-798 Hard-coded Credentials). Rotate it and load from the environment instead.`
+    });
+  }
+  for (const fmt of SECRET_FORMATS) {
+    fmt.re.lastIndex = 0;
+    let fm;
+    while ((fm = fmt.re.exec(clean)) !== null) {
+      const ln = lineNo2(code, fm.index);
+      if (flaggedLines.has(ln))
+        continue;
+      flaggedLines.add(ln);
+      out.push({
+        file,
+        line: ln,
+        type: "hardcoded_secret",
+        category: "Hardcoded secret (known format)",
+        severity: "high",
+        evidence: (ls[ln - 1] ?? "").trim(),
+        detail: `A ${fmt.name} was found hardcoded in source — the credential is exposed to anyone with code access (CWE-798). Rotate it and load from the environment instead.`
+      });
+    }
+  }
+  const isMinified = /\.min\.(js|css)$/i.test(file) || /[\\/](bundle|vendor|dist|build)[\\/]/i.test(file);
+  if (!isMinified) {
+    const entropyRe = /(\b[A-Za-z_]\w*)\s*(?:::|=>|=|:)\s*["']([A-Za-z0-9_-]{32,})["']/g;
+    entropyRe.lastIndex = 0;
+    let em;
+    while ((em = entropyRe.exec(clean)) !== null) {
+      const varName = em[1];
+      const value = em[2];
+      const ln = lineNo2(code, em.index);
+      if (flaggedLines.has(ln))
+        continue;
+      if (ENTROPY_EXCLUDE_VAR.test(varName))
+        continue;
+      if (!/[A-Z]/.test(value) || !/[a-z]/.test(value) || !/[0-9]/.test(value))
+        continue;
+      if (shannonEntropy(value) < 4.5)
+        continue;
+      flaggedLines.add(ln);
+      out.push({
+        file,
+        line: ln,
+        type: "hardcoded_secret",
+        category: "Suspected secret (high-entropy token)",
+        severity: "medium",
+        evidence: (ls[ln - 1] ?? "").trim(),
+        detail: `'${varName}' is assigned a high-entropy token (Shannon ${shannonEntropy(value).toFixed(2)} bits/char) that looks like a generated credential — verify it is not a secret key/token (CWE-798).`
+      });
+    }
+  }
+}
 
 // src/guidance.ts
 var SINK_DIRECTIVES = {
@@ -58502,7 +58630,7 @@ function createServer() {
 ` + `- Keep trying every lead AND every chain step until each is verified/executed or blocked, THEN generate_report. Never deliver a bare surface map, and never stop at 'found X' when X enables more.
 
 ` + "TWO PATHS:\\n" + "- Source path on disk -> blitz_scan / taint_file / eagle_eye2 (static).\\n" + "- Live URL -> live_recon / active_scan / strike_verify (web-hunting).\\n\\n" + `DEEPEN A FINDING: attack_plan(target, tech, params) to get the prioritized vector plan (decide what to test next with data); list_chains (escalation), chain_links (compose), technique_lookup(cls), payload_lookup, bypass_lookup (blocked). Phase doctrine: read_skill(bs-orchestrate-engagement | bs-web-hunting | bs-source-audit | bs-verify-finding). Campaign plan: read_playbook(target-type). On any failure call retry_guidance(signal) / model_fallback(signal) before giving up.
-` + "KNOWLEDGE BASE (discover, don't guess): skillLookup(topic) / listSkills for the 40 attack-path + hunting skills (ap-*, hp-*, bs-*); list_attack_vectors / attack_vectors(cat) for the 34-category vector taxonomy; taxonomy(kind) for OWASP/CWE/ASVS/API-top-10; read_playbook(type) for the 17 campaign playbooks; list_manuals / read_tool_manual for 317 tool references; list_tools / run_catalog_tool for the 141-tool catalog. Every tool, skill, and data layer is reachable from these. CROSS-TARGET INTELLIGENCE: strike_resolve auto-records confirmed/false_positive verdicts into the empirical ledger; query it with intelligence(action=hit_rates/top_vectors) so a new target on a known tech inherits historical hit-rates (attack_plan already blends them into success_probability). LIVE PENTEST + TARGETING (black-box, WAF-safe): cache_gap(base_url, endpoint) fuzzes path-normalization + static-extension variants for cache deception/poisoning; blind_oracle(base_url, param, value) detects which SINK a param reaches (sql/ssti/xss) via benign arithmetic (id=1+0, test${7*7}) WITHOUT a malicious payload; param_precedence(base_url, param, A, B) maps duplicate-parameter precedence (first/last-wins) for WAF-bypass. SOURCE TARGETING: action_surface(code) maps every wp_ajax_* action to its vuln class + DERIVED priority (what to look for WHERE); security_state(sanitizers, sink) gives a wrong-context sanitization verdict; framework_knowledge(framework) returns auth/nonce primitives for 9 frameworks; variant_scan(root, signature) mass-sweeps an install base for ONE bug family; patch_analyze(old, new) REVERSES a security patch into the 0-day, and its mine_signature feeds variant_scan to sweep unpatched copies. All of these are DETECTION HINTS — verify each live (strike_verify / browser_validate) before it enters the report. NEWEST DETECTORS — understand AND try them: variant_scan also emits priv_esc (privilege escalation — a role/capability/user change fed by request input, traced cross-file via reverse call-graph, e.g. set_role($id, sanitize_key($_POST['um-role'])) or update_user_meta(...,'wp_capabilities', $_POST[...])) and flags uploadAllow=>array('all') unrestricted-upload configs as file_upload (the file-manager/connector shape). TO TRY a priv_esc hit: submit the role field with 'administrator' (or send wp_capabilities meta) and confirm the account actually gains admin. TO TRY an unrestricted-upload hit: POST a .php/.phtml and confirm it lands web-reachable + executes. A static hit is a HYPOTHESIS until verified live — never report unverified.\n" + `PRECISION ANALYSIS — chrome-devtools MCP is MANDATORY, not optional:
+` + "KNOWLEDGE BASE (discover, don't guess): skillLookup(topic) / listSkills for the 40 attack-path + hunting skills (ap-*, hp-*, bs-*); list_attack_vectors / attack_vectors(cat) for the 34-category vector taxonomy; taxonomy(kind) for OWASP/CWE/ASVS/API-top-10; read_playbook(type) for the 17 campaign playbooks; list_manuals / read_tool_manual for 317 tool references; list_tools / run_catalog_tool for the 141-tool catalog. Every tool, skill, and data layer is reachable from these. CROSS-TARGET INTELLIGENCE: strike_resolve auto-records confirmed/false_positive verdicts into the empirical ledger; query it with intelligence(action=hit_rates/top_vectors) so a new target on a known tech inherits historical hit-rates (attack_plan already blends them into success_probability). LIVE PENTEST + TARGETING (black-box, WAF-safe): cache_gap(base_url, endpoint) fuzzes path-normalization + static-extension variants for cache deception/poisoning; blind_oracle(base_url, param, value) detects which SINK a param reaches (sql/ssti/xss) via benign arithmetic (id=1+0, test${7*7}) WITHOUT a malicious payload; param_precedence(base_url, param, A, B) maps duplicate-parameter precedence (first/last-wins) for WAF-bypass. SOURCE TARGETING: action_surface(code) maps every wp_ajax_* action to its vuln class + DERIVED priority (what to look for WHERE); security_state(sanitizers, sink) gives a wrong-context sanitization verdict; framework_knowledge(framework) returns auth/nonce primitives for 9 frameworks; variant_scan(root, signature) mass-sweeps an install base for ONE bug family; patch_analyze(old, new) REVERSES a security patch into the 0-day, and its mine_signature feeds variant_scan to sweep unpatched copies. All of these are DETECTION HINTS — verify each live (strike_verify / browser_validate) before it enters the report. NEWEST DETECTORS — understand AND try them: variant_scan also emits priv_esc (privilege escalation — a role/capability/user change fed by request input, traced cross-file via reverse call-graph, e.g. set_role($id, sanitize_key($_POST['um-role'])) or update_user_meta(...,'wp_capabilities', $_POST[...])) and flags uploadAllow=>array('all') unrestricted-upload configs as file_upload (the file-manager/connector shape). TO TRY a priv_esc hit: submit the role field with 'administrator' (or send wp_capabilities meta) and confirm the account actually gains admin. TO TRY an unrestricted-upload hit: POST a .php/.phtml and confirm it lands web-reachable + executes. variant_scan also emits hardcoded_secret (CWE-798) in three tiers: a secret field (api_key/db_password/access_token/aws_*) assigned a literal (HIGH), a known secret FORMAT (JWT eyJ…/AWS AKIA…/GitHub ghp_…/Slack xoxb-…/…) regardless of name (HIGH), or a high-entropy suspect token (MEDIUM — verify before reporting). Verify a frontend/JS secret live via drive_devtools (inspect the JS bundle / network response and confirm the key is actually exposed), and for a backend secret confirm it is reachable/valid. A static hit is a HYPOTHESIS until verified live — never report unverified.\n" + `PRECISION ANALYSIS — chrome-devtools MCP is MANDATORY, not optional:
 ` + `- When a lead needs DOM/JS precision — DOM-XSS sink execution, AJAX endpoint + payload interception, JS runtime errors, redirect chains, SSO/token flow, or anything a static HTML glance cannot prove — call drive_devtools(target). It spawns chrome-devtools-mcp and drives a REAL headless browser (navigate -> list_network_requests -> list_console_messages -> evaluate_script), giving reproducible evidence instead of a guess.
 ` + `- Before calling it, check_mcp() to confirm the browser MCP is available; if not, blitzstrike install-tools or npm i -g chrome-devtools-mcp. Never substitute eyeballing minified JS or a static sink guess when a live browser can PROVE it. This is the precision + consistency layer.
 ` + "EXTERNAL MCP SERVERS (verified, connect them — NOT one-shot CLIs): chrome-devtools-mcp (29 tools: list_network_requests/get_network_request for raw HTTP interception, list_console_messages for JS errors + DOM-XSS, evaluate_script to run JS, take_screenshot) -> stdio chrome-devtools-mcp --headless --chromeArg=--no-sandbox --chromeArg=--disable-gpu (as root/container this is MANDATORY or the browser crashes; add --proxyServer http://127.0.0.1:8080 to route through Burp, --acceptInsecureCerts for bad TLS). burp-suite-mcp (proxy history + active scan + repeater) -> NOT npm: build the JAR (git clone https://github.com/PortSwigger/mcp-server.git && cd mcp-server && ./gradlew embedProxyJar), load it in Burp Extensions, then connect the client to http://127.0.0.1:9876 (SSE) or the stdio proxy java -jar mcp-proxy-all.jar --sse-url http://127.0.0.1:9876."

package/intelligence/cwe_map.json

@@ -54,6 +54,10 @@
     {"id": "web_vulnerabilities_methodology", "cwe": "CWE-1057", "name": "Improper Inventory / Methodology"},
     {"id": "missing_authz", "cwe": "CWE-862", "name": "Missing Authorization"},
     {"id": "missing_nonce", "cwe": "CWE-352", "name": "Cross-Site Request Forgery (Missing Nonce)"},
-    {"id": "priv_esc", "cwe": "CWE-269", "name": "Improper Privilege Management"}
+    {"id": "priv_esc", "cwe": "CWE-269", "name": "Improper Privilege Management"},
+    {"id": "hardcoded_secret", "cwe": "CWE-798", "name": "Use of Hard-coded Credentials"},
+    {"id": "type_juggling", "cwe": "CWE-697", "name": "Incorrect Comparison"},
+    {"id": "path_confusion", "cwe": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)"},
+    {"id": "wrong_sanitizer", "cwe": "CWE-20", "name": "Improper Input Validation"}
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.55",
+  "version": "2.4.57",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {