blitzstrike 2.4.63 → 2.4.65

package/CHANGELOG.md

@@ -5,6 +5,37 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.65] — 2026-09-14
+
+### Added — Synonym resolution + LLM-injection validation SOP
+
+- New `src/synonyms.ts` — a data-driven alias map resolving free-form vuln
+  terminology (IDOR/BOLA/broken-object → missing_authz, CSRF/XSRF → missing_nonce,
+  SQLi, path-traversal/LFI, prompt-injection/LLM01 → llm_injection, …) to the
+  canonical detector id. `pattern_lookup` now accepts free-form terms, and a new
+  `synonym_lookup` MCP tool lists every alias that resolves to a class.
+- `llm_injection` now carries a validation SOP (a `validation` field in its
+  pattern): the RUN-TWICE RULE (reproduce token-for-token across two fresh
+  sessions), NON-GUESSABLE ANCHOR (must leak a real key/URL, not a plausible
+  guess), and OOB PROOF (verifiable callback log) — so an LLM finding is verified
+  the same way as any other, not just flagged.
+
+## [2.4.64] — 2026-09-14
+
+### Added — 47-pattern secret format taxonomy (severity + category)
+
+- Expanded `SECRET_FORMATS` from ~12 to 47 known secret formats, each now carrying
+  a severity (critical/high/medium/low) + category (aws, gcp, github, stripe, slack,
+  email_svc, twilio, paas, firebase, jwt, bearer, basic_auth, private_key, generic,
+  ai_api, infra_api, package_registry, saas_api, observability, tunneling, bot_token).
+- New formats: AWS session tokens, GCP service accounts, GitHub OAuth/server-to-server,
+  Stripe live/test/publishable, Slack webhooks, Heroku, Firebase, bearer/basic-auth,
+  RSA/EC/OpenSSH private keys, Anthropic/OpenAI/HuggingFace, Cloudflare/DigitalOcean,
+  npm/PyPI/Docker, Atlassian/Linear, NewRelic/Datadog/Sentry, ngrok, Discord/Telegram.
+- `detectHardcodedSecret` Tier 2 now reports the format's own severity + category,
+  so a hardcoded secret hit is classified (e.g. Stripe live = critical, Stripe test
+  = low) instead of uniformly "high". Redaction patterns expanded to match.
+
 ## [2.4.63] — 2026-09-14
 
 ### Added — Variant corpus + detector coverage sweep (data-driven scaling)

package/dist/index.js

@@ -7409,18 +7409,53 @@ function redactSecrets(text) {
 var SECRET_FIELDS = "api[_-]?key|apikey|api[_-]?secret|access[_-]?key|access[_-]?token|secret[_-]?key|secret[_-]?access[_-]?key|auth[_-]?token|client[_-]?secret|consumer[_-]?secret|consumer[_-]?key|private[_-]?key|db[_-]?password|database[_-]?password|db[_-]?pass|passwd|password|jwt[_-]?secret|encryption[_-]?key|encryption[_-]?password|github[_-]?token|gitlab[_-]?token|stripe[_-]?key|sendgrid[_-]?api[_-]?key|datadog[_-]?api[_-]?key|cloudflare[_-]?api[_-]?key|slack[_-]?token|aws[_-]?access[_-]?key[_-]?id|aws[_-]?secret[_-]?access[_-]?key|aws[_-]?session[_-]?token|bot[_-]?token", SECRET_FORMATS, REDACTION_PATTERNS;
 var init_secrets = __esm(() => {
   SECRET_FORMATS = [
-    { name: "JWT", re: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{4,}/g },
-    { name: "AWS access key", re: /\bAKIA[0-9A-Z]{16}\b/g },
-    { name: "GitHub PAT (classic)", re: /\bghp_[A-Za-z0-9]{20,}\b/g },
-    { name: "GitHub PAT (fine-grained)", re: /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g },
-    { name: "OpenAI/Stripe key", re: /\bsk-[A-Za-z0-9]{20,}\b/g },
-    { name: "Stripe live/test key", re: /\b(?:sk|pk|rk)_(?:live|test)_[0-9a-zA-Z]{10,}\b/g },
-    { name: "Slack token", re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g },
-    { name: "Google API key", re: /\bAIza[0-9A-Za-z_-]{35}\b/g },
-    { name: "Twilio account SID", re: /\bAC[0-9a-f]{32}\b/g },
-    { name: "SendGrid API key", re: /\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}\b/g },
-    { name: "Mailgun API key", re: /\bkey-[0-9a-zA-Z]{32}\b/g },
-    { name: "PEM private key", re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/g }
+    { name: "AWS access key ID", re: /\bAKIA[0-9A-Z]{16}\b/g, severity: "critical", category: "aws" },
+    { name: "AWS session token (temporary)", re: /\bASIA[0-9A-Z]{16}\b/g, severity: "critical", category: "aws" },
+    { name: "AWS secret access key", re: /aws[_-]?secret[_-]?access[_-]?key['"\s:=]+([A-Za-z0-9/+=]{40})/gi, severity: "critical", category: "aws" },
+    { name: "GCP service account key", re: /"type"\s*:\s*"service_account"/g, severity: "critical", category: "gcp" },
+    { name: "Google API key", re: /\bAIza[0-9A-Za-z_-]{35}\b/g, severity: "high", category: "gcp" },
+    { name: "GitHub PAT (classic)", re: /\bghp_[A-Za-z0-9]{20,}\b/g, severity: "critical", category: "github" },
+    { name: "GitHub PAT (fine-grained)", re: /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g, severity: "critical", category: "github" },
+    { name: "GitHub OAuth token", re: /\bgho_[A-Za-z0-9]{20,}\b/g, severity: "high", category: "github" },
+    { name: "GitHub server-to-server token", re: /\bgh[usr]_[A-Za-z0-9]{20,}\b/g, severity: "high", category: "github" },
+    { name: "Stripe live key", re: /\bsk_live_[0-9A-Za-z]{16,}\b/g, severity: "critical", category: "stripe" },
+    { name: "Stripe test key", re: /\bsk_test_[0-9A-Za-z]{16,}\b/g, severity: "low", category: "stripe" },
+    { name: "Stripe publishable key", re: /\bpk_(?:live|test)_[0-9A-Za-z]{16,}\b/g, severity: "low", category: "stripe" },
+    { name: "Slack token", re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, severity: "high", category: "slack" },
+    { name: "Slack webhook URL", re: /https:\/\/hooks\.slack\.com\/services\/T[A-Z0-9]+\/B[A-Z0-9]+\/[A-Za-z0-9]+/g, severity: "medium", category: "slack" },
+    { name: "SendGrid API key", re: /\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}\b/g, severity: "high", category: "email_svc" },
+    { name: "Mailgun API key", re: /\bkey-[0-9a-zA-Z]{32}\b/g, severity: "high", category: "email_svc" },
+    { name: "Twilio API key", re: /\bSK[0-9a-fA-F]{32}\b/g, severity: "high", category: "twilio" },
+    { name: "Twilio account SID", re: /\bAC[0-9a-f]{32}\b/g, severity: "medium", category: "twilio" },
+    { name: "Twilio auth token", re: /twilio(.{0,20})?(auth|token)['"=: ]+([a-f0-9]{32})/gi, severity: "high", category: "twilio" },
+    { name: "Heroku API key", re: /heroku(.{0,20})?api['"=: ]+([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})/gi, severity: "medium", category: "paas" },
+    { name: "Firebase URL", re: /\bhttps?:\/\/[a-z0-9-]+\.firebaseio\.com\b/g, severity: "low", category: "firebase" },
+    { name: "JWT", re: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{4,}/g, severity: "medium", category: "jwt" },
+    { name: "Bearer token", re: /authorization['"=: ]+bearer\s+[A-Za-z0-9._-]{20,}/gi, severity: "medium", category: "bearer" },
+    { name: "Basic auth URL", re: /https?:\/\/[^/\s:@]+:[^/\s:@]+@[^/\s]+/g, severity: "medium", category: "basic_auth" },
+    { name: "RSA private key", re: /-----BEGIN RSA PRIVATE KEY-----/g, severity: "critical", category: "private_key" },
+    { name: "EC private key", re: /-----BEGIN EC PRIVATE KEY-----/g, severity: "critical", category: "private_key" },
+    { name: "OpenSSH private key", re: /-----BEGIN OPENSSH PRIVATE KEY-----/g, severity: "critical", category: "private_key" },
+    { name: "Generic private key", re: /-----BEGIN (DSA |PGP |)PRIVATE KEY-----/g, severity: "critical", category: "private_key" },
+    { name: "Generic API key / token", re: /(?:api[_-]?key|apikey|api_secret|access_token|secret[_-]?token)['"\s:=]+["']([A-Za-z0-9+/=_-]{24,})["']/gi, severity: "medium", category: "generic" },
+    { name: "Anthropic API key", re: /\bsk-ant-(?:api03|admin01)-[A-Za-z0-9_-]{20,}\b/g, severity: "critical", category: "ai_api" },
+    { name: "OpenAI API key (legacy)", re: /\bsk-[A-Za-z0-9]{20}T3BlbkFJ[A-Za-z0-9]{20}\b/g, severity: "critical", category: "ai_api" },
+    { name: "OpenAI project key", re: /\bsk-proj-[A-Za-z0-9_-]{20,}T3BlbkFJ[A-Za-z0-9_-]{20,}\b/g, severity: "critical", category: "ai_api" },
+    { name: "OpenAI session token", re: /\bsess-[A-Za-z0-9]{40}\b/g, severity: "high", category: "ai_api" },
+    { name: "Hugging Face token", re: /\bhf_[A-Za-z0-9]{30,}\b/g, severity: "high", category: "ai_api" },
+    { name: "Cloudflare API key", re: /cf[_-]?api[_-]?key['"\s:=]+([a-f0-9]{37})/gi, severity: "critical", category: "infra_api" },
+    { name: "DigitalOcean token", re: /\bdop_v1_[a-f0-9]{64}\b/g, severity: "high", category: "infra_api" },
+    { name: "npm token", re: /\bnpm_[A-Za-z0-9]{36}\b/g, severity: "high", category: "package_registry" },
+    { name: "PyPI token", re: /\bpypi-AgENdGV[A-Za-z0-9_-]+\b/g, severity: "high", category: "package_registry" },
+    { name: "Docker Hub PAT", re: /\bdckr_pat_[A-Za-z0-9_-]{27,}\b/g, severity: "high", category: "package_registry" },
+    { name: "Atlassian API token", re: /\bATATT3xFfGF0[A-Za-z0-9_-]{20,}\b/g, severity: "high", category: "saas_api" },
+    { name: "Linear API key", re: /\blin_api_[A-Za-z0-9]{40}\b/g, severity: "medium", category: "saas_api" },
+    { name: "New Relic license key", re: /\b(?:NRAA|NRAK|NRBR)-[A-F0-9]{27}\b/g, severity: "medium", category: "observability" },
+    { name: "Datadog API key", re: /dd[_-]?api[_-]?key['"\s:=]+([a-f0-9]{32})/gi, severity: "high", category: "observability" },
+    { name: "Sentry DSN", re: /https:\/\/[a-f0-9]+@o[0-9]+\.ingest\.sentry\.io\/[0-9]+/g, severity: "low", category: "observability" },
+    { name: "ngrok auth token", re: /\b[12][A-Za-z0-9]{26}_[A-Za-z0-9]{32,}\b/g, severity: "medium", category: "tunneling" },
+    { name: "Discord bot token", re: /\b[MN][A-Za-z\d]{23}\.[\w-]{6}\.[\w-]{27}\b/g, severity: "high", category: "bot_token" },
+    { name: "Telegram bot token", re: /\b\d{8,10}:[A-Za-z0-9_-]{35}\b/g, severity: "high", category: "bot_token" }
   ];
   REDACTION_PATTERNS = [
     [/(authorization\s*[:=]\s*)(bearer\s+)?[A-Za-z0-9._~+/=-]{8,}/gi, "$1$2[REDACTED]"],
@@ -7433,17 +7468,34 @@ var init_secrets = __esm(() => {
     [/(session\s*[:=]\s*)["']?[A-Za-z0-9._-]{12,}["']?/gi, "$1[REDACTED]"],
     [/(cookie\s*[:=]\s*)["']?[A-Za-z0-9._-]{12,}["']?/gi, "$1[REDACTED]"],
     [/(set-cookie\s*:\s*)[^\r\n]+/gi, "$1[REDACTED]"],
-    [/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{4,}/g, "[REDACTED]"],
-    [/AKIA[0-9A-Z]{16}/g, "[REDACTED]"],
-    [/ghp_[A-Za-z0-9]{20,}/g, "[REDACTED]"],
-    [/github_pat_[A-Za-z0-9_]{20,}/g, "[REDACTED]"],
-    [/sk-[A-Za-z0-9]{20,}/g, "[REDACTED]"],
-    [/\b(?:sk|pk|rk)_(?:live|test)_[0-9a-zA-Z]{10,}\b/g, "[REDACTED]"],
+    [/\bAKIA[0-9A-Z]{16}\b/g, "[REDACTED]"],
+    [/\bASIA[0-9A-Z]{16}\b/g, "[REDACTED]"],
+    [/\bghp_[A-Za-z0-9]{20,}\b/g, "[REDACTED]"],
+    [/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g, "[REDACTED]"],
+    [/\bgho_[A-Za-z0-9]{20,}\b/g, "[REDACTED]"],
+    [/\bgh[usr]_[A-Za-z0-9]{20,}\b/g, "[REDACTED]"],
+    [/\bsk_live_[0-9A-Za-z]{16,}\b/g, "[REDACTED]"],
+    [/\bsk_test_[0-9A-Za-z]{16,}\b/g, "[REDACTED]"],
+    [/\bpk_(?:live|test)_[0-9A-Za-z]{16,}\b/g, "[REDACTED]"],
     [/\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, "[REDACTED]"],
     [/\bAIza[0-9A-Za-z_-]{35}\b/g, "[REDACTED]"],
     [/\bAC[0-9a-f]{32}\b/g, "[REDACTED]"],
+    [/\bSK[0-9a-fA-F]{32}\b/g, "[REDACTED]"],
     [/\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}\b/g, "[REDACTED]"],
     [/\bkey-[0-9a-zA-Z]{32}\b/g, "[REDACTED]"],
+    [/\bsk-ant-(?:api03|admin01)-[A-Za-z0-9_-]{20,}\b/g, "[REDACTED]"],
+    [/\bsk-proj-[A-Za-z0-9_-]{20,}T3BlbkFJ[A-Za-z0-9_-]{20,}\b/g, "[REDACTED]"],
+    [/\bsess-[A-Za-z0-9]{40}\b/g, "[REDACTED]"],
+    [/\bhf_[A-Za-z0-9]{30,}\b/g, "[REDACTED]"],
+    [/\bdop_v1_[a-f0-9]{64}\b/g, "[REDACTED]"],
+    [/\bnpm_[A-Za-z0-9]{36}\b/g, "[REDACTED]"],
+    [/\bpypi-AgENdGV[A-Za-z0-9_-]+\b/g, "[REDACTED]"],
+    [/\bdckr_pat_[A-Za-z0-9_-]{27,}\b/g, "[REDACTED]"],
+    [/\bATATT3xFfGF0[A-Za-z0-9_-]{20,}\b/g, "[REDACTED]"],
+    [/\blin_api_[A-Za-z0-9]{40}\b/g, "[REDACTED]"],
+    [/\b(?:NRAA|NRAK|NRBR)-[A-F0-9]{27}\b/g, "[REDACTED]"],
+    [/\b\d{8,10}:[A-Za-z0-9_-]{35}\b/g, "[REDACTED]"],
+    [/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{4,}/g, "[REDACTED]"],
     [/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g, "[REDACTED]"]
   ];
 });
@@ -16487,10 +16539,10 @@ function detectHardcodedSecret(code, file, out) {
         file,
         line: ln,
         type: "hardcoded_secret",
-        category: "Hardcoded secret (known format)",
-        severity: "high",
+        category: `Hardcoded secret (${fmt.category}: ${fmt.name})`,
+        severity: fmt.severity,
         evidence: (ls[ln - 1] ?? "").trim(),
-        detail: `A ${fmt.name} was found hardcoded in source — the credential is exposed to anyone with code access (CWE-798). Rotate it and load from the environment instead.`
+        detail: `${fmt.name} was found hardcoded in source — the credential is exposed to anyone with code access (CWE-798, severity ${fmt.severity}). Rotate it and load from the environment instead.`
       });
     }
   }
@@ -57625,6 +57677,89 @@ function nextSteps(ctx) {
 import { readFileSync as readFileSync17 } from "node:fs";
 import { join as join16, dirname as dirname2 } from "node:path";
 import { fileURLToPath as fileURLToPath8 } from "node:url";
+
+// src/synonyms.ts
+var ALIASES = {
+  idor: "missing_authz",
+  bola: "missing_authz",
+  "broken object level authorization": "missing_authz",
+  "insecure direct object reference": "missing_authz",
+  "broken access control": "missing_authz",
+  authorization: "missing_authz",
+  csrf: "missing_nonce",
+  xsrf: "missing_nonce",
+  "cross site request forgery": "missing_nonce",
+  "cross-site request forgery": "missing_nonce",
+  sqli: "sql_injection",
+  "sql injection": "sql_injection",
+  "sql-injection": "sql_injection",
+  ssti: "ssti",
+  "template injection": "ssti",
+  "server side template injection": "ssti",
+  xxe: "xxe",
+  "xml external entity": "xxe",
+  "xxe injection": "xxe",
+  bpla: "mass_assignment",
+  "broken property level authorization": "mass_assignment",
+  "mass assignment": "mass_assignment",
+  lfi: "path_confusion",
+  rfi: "path_confusion",
+  "path traversal": "path_confusion",
+  "directory traversal": "path_confusion",
+  "local file inclusion": "path_confusion",
+  "remote file inclusion": "path_confusion",
+  ssrf: "ssrf",
+  "server side request forgery": "ssrf",
+  "server-side request forgery": "ssrf",
+  "prompt injection": "llm_injection",
+  llm: "llm_injection",
+  llm01: "llm_injection",
+  "llm prompt injection": "llm_injection",
+  graphql: "graphql_exposure",
+  oauth: "oauth_misconfig",
+  "open redirect": "oauth_misconfig",
+  grpc: "grpc_reflection",
+  "hardcoded credential": "hardcoded_secret",
+  "hardcoded secret": "hardcoded_secret",
+  "credential leak": "hardcoded_secret",
+  "hard coded credentials": "hardcoded_secret",
+  "priv esc": "priv_esc",
+  privesc: "priv_esc",
+  "privilege escalation": "priv_esc",
+  "file upload": "file_upload",
+  "unrestricted upload": "file_upload",
+  "unrestricted file upload": "file_upload",
+  deserialization: "deserialization",
+  "insecure deserialization": "deserialization",
+  unserialize: "deserialization",
+  "type juggling": "type_juggling",
+  "php type juggling": "type_juggling",
+  "prototype pollution": "prototype_pollution",
+  crlf: "crlf_injection",
+  "header injection": "crlf_injection",
+  "http response splitting": "crlf_injection",
+  "wrong sanitizer": "wrong_sanitizer",
+  "wrong context sanitization": "wrong_sanitizer"
+};
+function normalize(term) {
+  return term.trim().toLowerCase().replace(/[_-]+/g, " ").replace(/\s+/g, " ").trim();
+}
+function canonicalId(term) {
+  const key = normalize(term);
+  if (ALIASES[key])
+    return ALIASES[key];
+  return key.replace(/ /g, "_");
+}
+function synonymsFor(term) {
+  const canonical = canonicalId(term);
+  const aliases = Object.entries(ALIASES).filter(([, v]) => v === canonical).map(([k]) => k);
+  return { canonical, aliases };
+}
+function listAliases() {
+  return Object.entries(ALIASES).map(([alias, canonical]) => ({ alias, canonical }));
+}
+
+// src/patterns.ts
 var __dirname2 = dirname2(fileURLToPath8(import.meta.url));
 var _doc = null;
 function load3() {
@@ -57638,7 +57773,8 @@ function load3() {
   return _doc;
 }
 function patternLookup(id) {
-  const p = load3().patterns.find((x) => x.id === id.toLowerCase());
+  const canonical = canonicalId(id);
+  const p = load3().patterns.find((x) => x.id === canonical);
   return p ?? null;
 }
 function listPatterns() {
@@ -59229,7 +59365,7 @@ function createServer() {
 ` + `- A hard block (Cloudflare/WAF/IP-block/captcha) is NOT the end: mark the finding blocked + note the required vantage (residential / authorized / correct-SNI / --resolve direct-to-origin), then CONTINUE to the next lead (origin bypass, non-prod cluster, mobile APK, subdomain).
 ` + `- Keep trying every lead AND every chain step until each is verified/executed or blocked, THEN generate_report. Never deliver a bare surface map, and never stop at 'found X' when X enables more.
 
-` + "TWO PATHS:\\n" + "- Source path on disk -> blitz_scan / taint_file / eagle_eye2 (static).\\n" + "- Live URL -> live_recon / active_scan / strike_verify (web-hunting).\\n\\n" + "DEEPEN A FINDING: attack_plan(target, tech, params) to get the prioritized vector plan (decide what to test next with data); list_chains (escalation), chain_links (compose), technique_lookup(cls), payload_lookup, bypass_lookup (blocked). Ground any detector hit empirically with pattern_lookup(id) — it returns the class's CWE, real-world signature, escalation chains, citable references, per-class bypass techniques, and the high-value assets (crown jewels) that class hits, so a raw hit becomes a class-aware finding. BEFORE generating a report, run submission_gate(...) and only ship a finding that passes all 7 questions (reproducible, in-scope, real-impact, no-privileged-assumption, verified-live, evidence-redacted, severity-derived); one false = kill it. Calibrate severity with severity_calibrate(type, cvss) to get a P1–P5 tier + VRT-style category. Start each engagement with engagement_scaffold(target, scope) for the folder + scope.md structure, and check data_refresh() to confirm the data layers are consistent. Phase doctrine: read_skill(bs-orchestrate-engagement | bs-web-hunting | bs-source-audit | bs-verify-finding). Campaign plan: read_playbook(target-type). On any failure call retry_guidance(signal) / model_fallback(signal) before giving up.\n" + "KNOWLEDGE BASE (discover, don't guess): skillLookup(topic) / listSkills for the 40 attack-path + hunting skills (ap-*, hp-*, bs-*); list_attack_vectors / attack_vectors(cat) for the 34-category vector taxonomy; taxonomy(kind) for OWASP/CWE/ASVS/API-top-10; read_playbook(type) for the 17 campaign playbooks; list_manuals / read_tool_manual for 317 tool references; list_tools / run_catalog_tool for the 141-tool catalog. Every tool, skill, and data layer is reachable from these. CROSS-TARGET INTELLIGENCE: strike_resolve auto-records confirmed/false_positive verdicts into the empirical ledger; query it with intelligence(action=hit_rates/top_vectors) so a new target on a known tech inherits historical hit-rates (attack_plan already blends them into success_probability). LIVE PENTEST + TARGETING (black-box, WAF-safe): cache_gap(base_url, endpoint) fuzzes path-normalization + static-extension variants for cache deception/poisoning; blind_oracle(base_url, param, value) detects which SINK a param reaches (sql/ssti/xss) via benign arithmetic (id=1+0, test${7*7}) WITHOUT a malicious payload; param_precedence(base_url, param, A, B) maps duplicate-parameter precedence (first/last-wins) for WAF-bypass. SOURCE TARGETING: action_surface(code) maps every wp_ajax_* action to its vuln class + DERIVED priority (what to look for WHERE); security_state(sanitizers, sink) gives a wrong-context sanitization verdict; framework_knowledge(framework) returns auth/nonce primitives for 9 frameworks; variant_scan(root, signature) mass-sweeps an install base for ONE bug family; patch_analyze(old, new) REVERSES a security patch into the 0-day, and its mine_signature feeds variant_scan to sweep unpatched copies. All of these are DETECTION HINTS — verify each live (strike_verify / browser_validate) before it enters the report. NEWEST DETECTORS — understand AND try them: variant_scan also emits priv_esc (privilege escalation — a role/capability/user change fed by request input, traced cross-file via reverse call-graph, e.g. set_role($id, sanitize_key($_POST['um-role'])) or update_user_meta(...,'wp_capabilities', $_POST[...])) and flags uploadAllow=>array('all') unrestricted-upload configs as file_upload (the file-manager/connector shape). TO TRY a priv_esc hit: submit the role field with 'administrator' (or send wp_capabilities meta) and confirm the account actually gains admin. TO TRY an unrestricted-upload hit: POST a .php/.phtml and confirm it lands web-reachable + executes. variant_scan also emits hardcoded_secret (CWE-798) in three tiers: a secret field (api_key/db_password/access_token/aws_*) assigned a literal (HIGH), a known secret FORMAT (JWT eyJ…/AWS AKIA…/GitHub ghp_…/Slack xoxb-…/…) regardless of name (HIGH), or a high-entropy suspect token (MEDIUM — verify before reporting). Verify a frontend/JS secret live via drive_devtools (inspect the JS bundle / network response and confirm the key is actually exposed), and for a backend secret confirm it is reachable/valid. A static hit is a HYPOTHESIS until verified live — never report unverified.\n" + `PRECISION ANALYSIS — chrome-devtools MCP is MANDATORY, not optional:
+` + "TWO PATHS:\\n" + "- Source path on disk -> blitz_scan / taint_file / eagle_eye2 (static).\\n" + "- Live URL -> live_recon / active_scan / strike_verify (web-hunting).\\n\\n" + "DEEPEN A FINDING: attack_plan(target, tech, params) to get the prioritized vector plan (decide what to test next with data); list_chains (escalation), chain_links (compose), technique_lookup(cls), payload_lookup, bypass_lookup (blocked). Ground any detector hit empirically with pattern_lookup(id) — it returns the class's CWE, real-world signature, escalation chains, citable references, per-class bypass techniques, and the high-value assets (crown jewels) that class hits, so a raw hit becomes a class-aware finding. Resolve free-form terminology first with synonym_lookup(term) (IDOR/BOLA/SQLi/prompt-injection → canonical id). For an llm_injection hit, its pattern carries a validation discipline — the RUN-TWICE RULE (reproduce token-for-token across two fresh sessions), NON-GUESSABLE ANCHOR (must leak a real key/URL, not a plausible guess), and OOB PROOF (a verifiable callback log) — apply all three before reporting. BEFORE generating a report, run submission_gate(...) and only ship a finding that passes all 7 questions (reproducible, in-scope, real-impact, no-privileged-assumption, verified-live, evidence-redacted, severity-derived); one false = kill it. Calibrate severity with severity_calibrate(type, cvss) to get a P1–P5 tier + VRT-style category. Start each engagement with engagement_scaffold(target, scope) for the folder + scope.md structure, and check data_refresh() to confirm the data layers are consistent. Phase doctrine: read_skill(bs-orchestrate-engagement | bs-web-hunting | bs-source-audit | bs-verify-finding). Campaign plan: read_playbook(target-type). On any failure call retry_guidance(signal) / model_fallback(signal) before giving up.\n" + "KNOWLEDGE BASE (discover, don't guess): skillLookup(topic) / listSkills for the 40 attack-path + hunting skills (ap-*, hp-*, bs-*); list_attack_vectors / attack_vectors(cat) for the 34-category vector taxonomy; taxonomy(kind) for OWASP/CWE/ASVS/API-top-10; read_playbook(type) for the 17 campaign playbooks; list_manuals / read_tool_manual for 317 tool references; list_tools / run_catalog_tool for the 141-tool catalog. Every tool, skill, and data layer is reachable from these. CROSS-TARGET INTELLIGENCE: strike_resolve auto-records confirmed/false_positive verdicts into the empirical ledger; query it with intelligence(action=hit_rates/top_vectors) so a new target on a known tech inherits historical hit-rates (attack_plan already blends them into success_probability). LIVE PENTEST + TARGETING (black-box, WAF-safe): cache_gap(base_url, endpoint) fuzzes path-normalization + static-extension variants for cache deception/poisoning; blind_oracle(base_url, param, value) detects which SINK a param reaches (sql/ssti/xss) via benign arithmetic (id=1+0, test${7*7}) WITHOUT a malicious payload; param_precedence(base_url, param, A, B) maps duplicate-parameter precedence (first/last-wins) for WAF-bypass. SOURCE TARGETING: action_surface(code) maps every wp_ajax_* action to its vuln class + DERIVED priority (what to look for WHERE); security_state(sanitizers, sink) gives a wrong-context sanitization verdict; framework_knowledge(framework) returns auth/nonce primitives for 9 frameworks; variant_scan(root, signature) mass-sweeps an install base for ONE bug family; patch_analyze(old, new) REVERSES a security patch into the 0-day, and its mine_signature feeds variant_scan to sweep unpatched copies. All of these are DETECTION HINTS — verify each live (strike_verify / browser_validate) before it enters the report. NEWEST DETECTORS — understand AND try them: variant_scan also emits priv_esc (privilege escalation — a role/capability/user change fed by request input, traced cross-file via reverse call-graph, e.g. set_role($id, sanitize_key($_POST['um-role'])) or update_user_meta(...,'wp_capabilities', $_POST[...])) and flags uploadAllow=>array('all') unrestricted-upload configs as file_upload (the file-manager/connector shape). TO TRY a priv_esc hit: submit the role field with 'administrator' (or send wp_capabilities meta) and confirm the account actually gains admin. TO TRY an unrestricted-upload hit: POST a .php/.phtml and confirm it lands web-reachable + executes. variant_scan also emits hardcoded_secret (CWE-798) in three tiers: a secret field (api_key/db_password/access_token/aws_*) assigned a literal (HIGH), a known secret FORMAT (JWT eyJ…/AWS AKIA…/GitHub ghp_…/Slack xoxb-…/…) regardless of name (HIGH), or a high-entropy suspect token (MEDIUM — verify before reporting). Verify a frontend/JS secret live via drive_devtools (inspect the JS bundle / network response and confirm the key is actually exposed), and for a backend secret confirm it is reachable/valid. A static hit is a HYPOTHESIS until verified live — never report unverified.\n" + `PRECISION ANALYSIS — chrome-devtools MCP is MANDATORY, not optional:
 ` + `- When a lead needs DOM/JS precision — DOM-XSS sink execution, AJAX endpoint + payload interception, JS runtime errors, redirect chains, SSO/token flow, or anything a static HTML glance cannot prove — call drive_devtools(target). It spawns chrome-devtools-mcp and drives a REAL headless browser (navigate -> list_network_requests -> list_console_messages -> evaluate_script), giving reproducible evidence instead of a guess.
 ` + `- Before calling it, check_mcp() to confirm the browser MCP is available; if not, blitzstrike install-tools or npm i -g chrome-devtools-mcp. Never substitute eyeballing minified JS or a static sink guess when a live browser can PROVE it. This is the precision + consistency layer.
 ` + "EXTERNAL MCP SERVERS (verified, connect them — NOT one-shot CLIs): chrome-devtools-mcp (29 tools: list_network_requests/get_network_request for raw HTTP interception, list_console_messages for JS errors + DOM-XSS, evaluate_script to run JS, take_screenshot) -> stdio chrome-devtools-mcp --headless --chromeArg=--no-sandbox --chromeArg=--disable-gpu (as root/container this is MANDATORY or the browser crashes; add --proxyServer http://127.0.0.1:8080 to route through Burp, --acceptInsecureCerts for bad TLS). burp-suite-mcp (proxy history + active scan + repeater) -> NOT npm: build the JAR (git clone https://github.com/PortSwigger/mcp-server.git && cd mcp-server && ./gradlew embedProxyJar), load it in Burp Extensions, then connect the client to http://127.0.0.1:9876 (SSE) or the stdio proxy java -jar mcp-proxy-all.jar --sse-url http://127.0.0.1:9876."
@@ -59661,6 +59797,18 @@ ${statusLine}` : statusLine },
   }, async () => {
     return { content: [{ type: "text", text: JSON.stringify(scanVariants()) }] };
   });
+  server.registerTool("synonym_lookup", {
+    title: "Vuln-class synonym / alias resolution",
+    description: "INTEL: resolve free-form vuln terminology (IDOR/BOLA/SQLi/path-traversal/prompt-injection/…) to the canonical detector id, and list every alias that maps to it. Pass the result to pattern_lookup to ground the class empirically regardless of the wording used.",
+    inputSchema: {
+      term: string2().describe("Free-form vulnerability class term (e.g. 'IDOR', 'BOLA', 'SQL injection', 'prompt injection').")
+    }
+  }, async ({ term }) => {
+    if (!term?.trim())
+      return { content: [{ type: "text", text: JSON.stringify({ error: "term required", aliases: listAliases() }) }] };
+    const r = synonymsFor(term);
+    return { content: [{ type: "text", text: JSON.stringify({ ...r, pattern: patternLookup(r.canonical) }) }] };
+  });
   server.registerTool("fofa_search", {
     title: "FOFA asset search",
     description: "STRIKE: search the FOFA asset index (needs FOFA_EMAIL + FOFA_KEY).",

package/intelligence/patterns.json

@@ -188,7 +188,8 @@
       "chain_templates": [],
       "references": ["CWE-77", "OWASP LLM01:2025 Prompt Injection"],
       "bypass_techniques": ["delimiter/role confusion to escape the system prompt", "translation/encoding attacks to hide instructions", "context overflow to displace earlier constraints", "indirect injection via fetched documents (RAG)"],
-      "crown_jewels": ["the system prompt itself", "tool/function-calling surfaces", "RAG-retrieved data", "privileged actions (email/send/pay) gated on model output"]
+      "crown_jewels": ["the system prompt itself", "tool/function-calling surfaces", "RAG-retrieved data", "privileged actions (email/send/pay) gated on model output"],
+      "validation": ["RUN-TWICE RULE — the extraction/injection must reproduce token-for-token across two fresh sessions (filter out model confabulation)", "NON-GUESSABLE ANCHOR — it must leak an actual verifiable internal key, endpoint URL, or cross-tenant data, not a plausible guess", "OOB PROOF — tool-use or markdown exfiltration must produce a verifiable callback log on your listener"]
     },
     {
       "id": "graphql_exposure",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.63",
+  "version": "2.4.65",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {