blitzstrike 2.4.65 → 2.4.67

package/CHANGELOG.md

@@ -5,6 +5,33 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.67] — 2026-09-14
+
+### Fixed — Whole-code interconnection audit (2 bugs)
+
+- `submission_gate` is now FAIL-CLOSED: a question passes only when EXPLICITLY
+  asserted true (`=== true`, not `!== false`), so an empty/unset finding fails the
+  gate instead of passing 7/7 by default. One false = kill, and a missing field is
+  a false.
+- Redaction now covers detection end-to-end: 6 secret formats the detector found
+  but the redactor did not strip (Slack webhook URL, Firebase URL, basic-auth URL,
+  Sentry DSN, ngrok auth token, Discord bot token) now redact — the invariant
+  "every secret the detector finds is stripped from reports/logs" is restored.
+- Added a whole-code interconnection audit (detectors ↔ CWE ↔ patterns ↔ chains ↔
+  variants ↔ synonyms ↔ severity ↔ secrets + edge cases) + regression tests for
+  both fixes.
+
+## [2.4.66] — 2026-09-14
+
+### Added — Per-engagement pattern recall (intelligence ledger)
+
+- New `recall(tech, target)` in the empirical intelligence ledger + an
+  `intelligence(action=recall)` path: given a tech (and/or a specific target),
+  returns which patterns historically CONFIRMED on it (prioritize these on a new
+  target) versus which only ever produced false positives (avoid those). A new
+  engagement now inherits the empirical playbook of past ones — the "pattern
+  recall across targets" layer that compounds with every verified verdict.
+
 ## [2.4.65] — 2026-09-14
 
 ### Added — Synonym resolution + LLM-injection validation SOP

package/dist/index.js

@@ -7495,6 +7495,12 @@ var init_secrets = __esm(() => {
     [/\blin_api_[A-Za-z0-9]{40}\b/g, "[REDACTED]"],
     [/\b(?:NRAA|NRAK|NRBR)-[A-F0-9]{27}\b/g, "[REDACTED]"],
     [/\b\d{8,10}:[A-Za-z0-9_-]{35}\b/g, "[REDACTED]"],
+    [/\b[12][A-Za-z0-9]{26}_[A-Za-z0-9]{32,}\b/g, "[REDACTED]"],
+    [/\b[MN][A-Za-z\d]{23}\.[\w-]{6}\.[\w-]{27}\b/g, "[REDACTED]"],
+    [/https:\/\/hooks\.slack\.com\/services\/[A-Za-z0-9\/]+/g, "[REDACTED]"],
+    [/\bhttps?:\/\/[a-z0-9-]+\.firebaseio\.com\b/g, "[REDACTED]"],
+    [/https:\/\/[a-f0-9]+@o[0-9]+\.ingest\.sentry\.io\/[0-9]+/g, "[REDACTED]"],
+    [/https?:\/\/[^/\s:@]+:[^/\s:@]+@[^/\s]+/g, "[REDACTED]"],
     [/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{4,}/g, "[REDACTED]"],
     [/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g, "[REDACTED]"]
   ];
@@ -33813,6 +33819,40 @@ function topVectors(tech, limit = 10) {
   const entries = rates.entries.filter((e) => e.hit_rate > 0);
   return { tech, top: entries.slice(0, limit) };
 }
+function recall(tech, target) {
+  let entries = loadIntel();
+  const t = tech?.trim().toLowerCase();
+  const tg = target?.trim();
+  if (t)
+    entries = entries.filter((e) => e.tech === t);
+  if (tg)
+    entries = entries.filter((e) => (e.target ?? "").toLowerCase() === tg.toLowerCase());
+  const byVector = new Map;
+  for (const e of entries) {
+    const v = byVector.get(e.vector) ?? { confirmed: 0, fp: 0, targets: new Set, latest: "" };
+    if (e.outcome === "confirmed") {
+      v.confirmed++;
+      if (e.severity && !v.severity)
+        v.severity = e.severity;
+    } else
+      v.fp++;
+    if (e.target)
+      v.targets.add(e.target);
+    if (e.ts > v.latest)
+      v.latest = e.ts;
+    byVector.set(e.vector, v);
+  }
+  const confirmed = [...byVector.entries()].filter(([, v]) => v.confirmed > 0).sort((a, b) => b[1].confirmed - a[1].confirmed).map(([vector, v]) => ({ vector, confirmed: v.confirmed, severity: v.severity, seen_on: [...v.targets], latest: v.latest }));
+  const avoid = [...byVector.entries()].filter(([, v]) => v.confirmed === 0 && v.fp > 0).sort((a, b) => b[1].fp - a[1].fp).map(([vector, v]) => ({ vector, false_positives: v.fp, seen_on: [...v.targets] }));
+  return {
+    tech: t ?? null,
+    target: tg ?? null,
+    total_verdicts: entries.length,
+    confirmed_patterns: confirmed,
+    avoid_patterns: avoid,
+    hint: "On a new target with this tech, prioritize confirmed_patterns (they verified before) and deprioritize avoid_patterns (they only ever produced false positives)."
+  };
+}
 function queryIntel(filter = {}) {
   let entries = loadIntel();
   if (filter.vector)
@@ -57784,37 +57824,37 @@ function submissionGate(input) {
   const questions = [
     {
       q: "Reproducible — a copy-paste-ready request or step list triggers it?",
-      pass: input.reproducible !== false,
+      pass: input.reproducible === true,
       reason: "Without an exact reproduction the finding is a hypothesis, not a result."
     },
     {
       q: "In scope — the vulnerable asset is in the engagement scope?",
-      pass: input.in_scope !== false,
+      pass: input.in_scope === true,
       reason: "Out-of-scope assets must not be submitted."
     },
     {
       q: "Real impact — maps to an accepted-impact class, not informational?",
-      pass: input.real_impact !== false,
+      pass: input.real_impact === true,
       reason: "Informational-only findings dilute the validity ratio."
     },
     {
       q: "No privileged assumption — works without unrealistic attacker prerequisites?",
-      pass: input.no_privileged_assumption !== false,
+      pass: input.no_privileged_assumption === true,
       reason: "'Admin can do X' is a centralization risk, not a vulnerability."
     },
     {
       q: "Verified live — confirmed with a marker + negative control, not just a static hint?",
-      pass: input.verified_live !== false,
+      pass: input.verified_live === true,
       reason: "A static hit is a hypothesis until verified live (strike_verify / browser_validate)."
     },
     {
       q: "Evidence attached AND redacted — secrets/PII stripped, integrity-tagged?",
-      pass: input.evidence_redacted !== false,
+      pass: input.evidence_redacted === true,
       reason: "Evidence must carry SHA-256-tagged, redacted records — no leaked secrets or victim PII."
     },
     {
       q: "Severity derived — CVSS/confidence computed, not guessed?",
-      pass: input.severity_derived !== false,
+      pass: input.severity_derived === true,
       reason: "Severity is not confidence; derive it, don't assert it."
     }
   ];
@@ -59365,7 +59405,7 @@ function createServer() {
 ` + `- A hard block (Cloudflare/WAF/IP-block/captcha) is NOT the end: mark the finding blocked + note the required vantage (residential / authorized / correct-SNI / --resolve direct-to-origin), then CONTINUE to the next lead (origin bypass, non-prod cluster, mobile APK, subdomain).
 ` + `- Keep trying every lead AND every chain step until each is verified/executed or blocked, THEN generate_report. Never deliver a bare surface map, and never stop at 'found X' when X enables more.
 
-` + "TWO PATHS:\\n" + "- Source path on disk -> blitz_scan / taint_file / eagle_eye2 (static).\\n" + "- Live URL -> live_recon / active_scan / strike_verify (web-hunting).\\n\\n" + "DEEPEN A FINDING: attack_plan(target, tech, params) to get the prioritized vector plan (decide what to test next with data); list_chains (escalation), chain_links (compose), technique_lookup(cls), payload_lookup, bypass_lookup (blocked). Ground any detector hit empirically with pattern_lookup(id) — it returns the class's CWE, real-world signature, escalation chains, citable references, per-class bypass techniques, and the high-value assets (crown jewels) that class hits, so a raw hit becomes a class-aware finding. Resolve free-form terminology first with synonym_lookup(term) (IDOR/BOLA/SQLi/prompt-injection → canonical id). For an llm_injection hit, its pattern carries a validation discipline — the RUN-TWICE RULE (reproduce token-for-token across two fresh sessions), NON-GUESSABLE ANCHOR (must leak a real key/URL, not a plausible guess), and OOB PROOF (a verifiable callback log) — apply all three before reporting. BEFORE generating a report, run submission_gate(...) and only ship a finding that passes all 7 questions (reproducible, in-scope, real-impact, no-privileged-assumption, verified-live, evidence-redacted, severity-derived); one false = kill it. Calibrate severity with severity_calibrate(type, cvss) to get a P1–P5 tier + VRT-style category. Start each engagement with engagement_scaffold(target, scope) for the folder + scope.md structure, and check data_refresh() to confirm the data layers are consistent. Phase doctrine: read_skill(bs-orchestrate-engagement | bs-web-hunting | bs-source-audit | bs-verify-finding). Campaign plan: read_playbook(target-type). On any failure call retry_guidance(signal) / model_fallback(signal) before giving up.\n" + "KNOWLEDGE BASE (discover, don't guess): skillLookup(topic) / listSkills for the 40 attack-path + hunting skills (ap-*, hp-*, bs-*); list_attack_vectors / attack_vectors(cat) for the 34-category vector taxonomy; taxonomy(kind) for OWASP/CWE/ASVS/API-top-10; read_playbook(type) for the 17 campaign playbooks; list_manuals / read_tool_manual for 317 tool references; list_tools / run_catalog_tool for the 141-tool catalog. Every tool, skill, and data layer is reachable from these. CROSS-TARGET INTELLIGENCE: strike_resolve auto-records confirmed/false_positive verdicts into the empirical ledger; query it with intelligence(action=hit_rates/top_vectors) so a new target on a known tech inherits historical hit-rates (attack_plan already blends them into success_probability). LIVE PENTEST + TARGETING (black-box, WAF-safe): cache_gap(base_url, endpoint) fuzzes path-normalization + static-extension variants for cache deception/poisoning; blind_oracle(base_url, param, value) detects which SINK a param reaches (sql/ssti/xss) via benign arithmetic (id=1+0, test${7*7}) WITHOUT a malicious payload; param_precedence(base_url, param, A, B) maps duplicate-parameter precedence (first/last-wins) for WAF-bypass. SOURCE TARGETING: action_surface(code) maps every wp_ajax_* action to its vuln class + DERIVED priority (what to look for WHERE); security_state(sanitizers, sink) gives a wrong-context sanitization verdict; framework_knowledge(framework) returns auth/nonce primitives for 9 frameworks; variant_scan(root, signature) mass-sweeps an install base for ONE bug family; patch_analyze(old, new) REVERSES a security patch into the 0-day, and its mine_signature feeds variant_scan to sweep unpatched copies. All of these are DETECTION HINTS — verify each live (strike_verify / browser_validate) before it enters the report. NEWEST DETECTORS — understand AND try them: variant_scan also emits priv_esc (privilege escalation — a role/capability/user change fed by request input, traced cross-file via reverse call-graph, e.g. set_role($id, sanitize_key($_POST['um-role'])) or update_user_meta(...,'wp_capabilities', $_POST[...])) and flags uploadAllow=>array('all') unrestricted-upload configs as file_upload (the file-manager/connector shape). TO TRY a priv_esc hit: submit the role field with 'administrator' (or send wp_capabilities meta) and confirm the account actually gains admin. TO TRY an unrestricted-upload hit: POST a .php/.phtml and confirm it lands web-reachable + executes. variant_scan also emits hardcoded_secret (CWE-798) in three tiers: a secret field (api_key/db_password/access_token/aws_*) assigned a literal (HIGH), a known secret FORMAT (JWT eyJ…/AWS AKIA…/GitHub ghp_…/Slack xoxb-…/…) regardless of name (HIGH), or a high-entropy suspect token (MEDIUM — verify before reporting). Verify a frontend/JS secret live via drive_devtools (inspect the JS bundle / network response and confirm the key is actually exposed), and for a backend secret confirm it is reachable/valid. A static hit is a HYPOTHESIS until verified live — never report unverified.\n" + `PRECISION ANALYSIS — chrome-devtools MCP is MANDATORY, not optional:
+` + "TWO PATHS:\\n" + "- Source path on disk -> blitz_scan / taint_file / eagle_eye2 (static).\\n" + "- Live URL -> live_recon / active_scan / strike_verify (web-hunting).\\n\\n" + "DEEPEN A FINDING: attack_plan(target, tech, params) to get the prioritized vector plan (decide what to test next with data); list_chains (escalation), chain_links (compose), technique_lookup(cls), payload_lookup, bypass_lookup (blocked). Ground any detector hit empirically with pattern_lookup(id) — it returns the class's CWE, real-world signature, escalation chains, citable references, per-class bypass techniques, and the high-value assets (crown jewels) that class hits, so a raw hit becomes a class-aware finding. Resolve free-form terminology first with synonym_lookup(term) (IDOR/BOLA/SQLi/prompt-injection → canonical id). For an llm_injection hit, its pattern carries a validation discipline — the RUN-TWICE RULE (reproduce token-for-token across two fresh sessions), NON-GUESSABLE ANCHOR (must leak a real key/URL, not a plausible guess), and OOB PROOF (a verifiable callback log) — apply all three before reporting. BEFORE generating a report, run submission_gate(...) and only ship a finding that passes all 7 questions (reproducible, in-scope, real-impact, no-privileged-assumption, verified-live, evidence-redacted, severity-derived); one false = kill it. Calibrate severity with severity_calibrate(type, cvss) to get a P1–P5 tier + VRT-style category. Start each engagement with engagement_scaffold(target, scope) for the folder + scope.md structure, and check data_refresh() to confirm the data layers are consistent. Phase doctrine: read_skill(bs-orchestrate-engagement | bs-web-hunting | bs-source-audit | bs-verify-finding). Campaign plan: read_playbook(target-type). On any failure call retry_guidance(signal) / model_fallback(signal) before giving up.\n" + "KNOWLEDGE BASE (discover, don't guess): skillLookup(topic) / listSkills for the 40 attack-path + hunting skills (ap-*, hp-*, bs-*); list_attack_vectors / attack_vectors(cat) for the 34-category vector taxonomy; taxonomy(kind) for OWASP/CWE/ASVS/API-top-10; read_playbook(type) for the 17 campaign playbooks; list_manuals / read_tool_manual for 317 tool references; list_tools / run_catalog_tool for the 141-tool catalog. Every tool, skill, and data layer is reachable from these. CROSS-TARGET INTELLIGENCE: strike_resolve auto-records confirmed/false_positive verdicts into the empirical ledger; query it with intelligence(action=hit_rates/top_vectors/recall) so a new target on a known tech inherits historical hit-rates (attack_plan already blends them into success_probability). intelligence(action=recall, tech, target) is the per-engagement pattern recall — it returns which patterns historically CONFIRMED on that tech (prioritize them) versus which only ever produced false positives (avoid them), so a new engagement starts from the empirical playbook of past ones. LIVE PENTEST + TARGETING (black-box, WAF-safe): cache_gap(base_url, endpoint) fuzzes path-normalization + static-extension variants for cache deception/poisoning; blind_oracle(base_url, param, value) detects which SINK a param reaches (sql/ssti/xss) via benign arithmetic (id=1+0, test${7*7}) WITHOUT a malicious payload; param_precedence(base_url, param, A, B) maps duplicate-parameter precedence (first/last-wins) for WAF-bypass. SOURCE TARGETING: action_surface(code) maps every wp_ajax_* action to its vuln class + DERIVED priority (what to look for WHERE); security_state(sanitizers, sink) gives a wrong-context sanitization verdict; framework_knowledge(framework) returns auth/nonce primitives for 9 frameworks; variant_scan(root, signature) mass-sweeps an install base for ONE bug family; patch_analyze(old, new) REVERSES a security patch into the 0-day, and its mine_signature feeds variant_scan to sweep unpatched copies. All of these are DETECTION HINTS — verify each live (strike_verify / browser_validate) before it enters the report. NEWEST DETECTORS — understand AND try them: variant_scan also emits priv_esc (privilege escalation — a role/capability/user change fed by request input, traced cross-file via reverse call-graph, e.g. set_role($id, sanitize_key($_POST['um-role'])) or update_user_meta(...,'wp_capabilities', $_POST[...])) and flags uploadAllow=>array('all') unrestricted-upload configs as file_upload (the file-manager/connector shape). TO TRY a priv_esc hit: submit the role field with 'administrator' (or send wp_capabilities meta) and confirm the account actually gains admin. TO TRY an unrestricted-upload hit: POST a .php/.phtml and confirm it lands web-reachable + executes. variant_scan also emits hardcoded_secret (CWE-798) in three tiers: a secret field (api_key/db_password/access_token/aws_*) assigned a literal (HIGH), a known secret FORMAT (JWT eyJ…/AWS AKIA…/GitHub ghp_…/Slack xoxb-…/…) regardless of name (HIGH), or a high-entropy suspect token (MEDIUM — verify before reporting). Verify a frontend/JS secret live via drive_devtools (inspect the JS bundle / network response and confirm the key is actually exposed), and for a backend secret confirm it is reachable/valid. A static hit is a HYPOTHESIS until verified live — never report unverified.\n" + `PRECISION ANALYSIS — chrome-devtools MCP is MANDATORY, not optional:
 ` + `- When a lead needs DOM/JS precision — DOM-XSS sink execution, AJAX endpoint + payload interception, JS runtime errors, redirect chains, SSO/token flow, or anything a static HTML glance cannot prove — call drive_devtools(target). It spawns chrome-devtools-mcp and drives a REAL headless browser (navigate -> list_network_requests -> list_console_messages -> evaluate_script), giving reproducible evidence instead of a guess.
 ` + `- Before calling it, check_mcp() to confirm the browser MCP is available; if not, blitzstrike install-tools or npm i -g chrome-devtools-mcp. Never substitute eyeballing minified JS or a static sink guess when a live browser can PROVE it. This is the precision + consistency layer.
 ` + "EXTERNAL MCP SERVERS (verified, connect them — NOT one-shot CLIs): chrome-devtools-mcp (29 tools: list_network_requests/get_network_request for raw HTTP interception, list_console_messages for JS errors + DOM-XSS, evaluate_script to run JS, take_screenshot) -> stdio chrome-devtools-mcp --headless --chromeArg=--no-sandbox --chromeArg=--disable-gpu (as root/container this is MANDATORY or the browser crashes; add --proxyServer http://127.0.0.1:8080 to route through Burp, --acceptInsecureCerts for bad TLS). burp-suite-mcp (proxy history + active scan + repeater) -> NOT npm: build the JAR (git clone https://github.com/PortSwigger/mcp-server.git && cd mcp-server && ./gradlew embedProxyJar), load it in Burp Extensions, then connect the client to http://127.0.0.1:9876 (SSE) or the stdio proxy java -jar mcp-proxy-all.jar --sse-url http://127.0.0.1:9876."
@@ -60110,13 +60150,14 @@ ${statusLine}` : statusLine },
     title: "Query the empirical intelligence ledger",
     description: "INTELLIGENCE: query the cross-engagement empirical ledger — hit-rates per (vector, tech), top vectors for a tech, or raw query. Verdicts are recorded AUTOMATICALLY by strike_resolve (confirmed/false_positive). Use this to learn what historically worked on a tech BEFORE planning, so a new Laravel target inherits the hit-rates of past Laravel engagements.",
     inputSchema: {
-      action: _enum(["hit_rates", "top_vectors", "query"]).describe("hit_rates (aggregate) / top_vectors (ranked for a tech) / query (raw filter)"),
+      action: _enum(["hit_rates", "top_vectors", "query", "recall"]).describe("hit_rates (aggregate) / top_vectors (ranked for a tech) / query (raw filter) / recall (pattern recall: what confirmed vs only-FP on a tech/target)"),
       tech: string2().optional().describe("Tech/framework filter (e.g. flask, laravel, wordpress)"),
       vector: string2().optional().describe("Vector filter (e.g. sql_injection)"),
-      outcome: string2().optional().describe("Outcome filter (confirmed/false_positive)")
+      outcome: string2().optional().describe("Outcome filter (confirmed/false_positive)"),
+      target: string2().optional().describe("Specific target slug for per-engagement recall (action=recall)")
     }
-  }, async ({ action, tech, vector, outcome }) => {
-    const out = action === "hit_rates" ? hitRates(tech) : action === "top_vectors" ? topVectors(tech ?? "unknown", 10) : queryIntel({ vector, tech, outcome });
+  }, async ({ action, tech, vector, outcome, target }) => {
+    const out = action === "hit_rates" ? hitRates(tech) : action === "top_vectors" ? topVectors(tech ?? "unknown", 10) : action === "recall" ? recall(tech, target) : queryIntel({ vector, tech, outcome });
     return { content: [{ type: "text", text: JSON.stringify(out) }] };
   });
   server.registerTool("compliance", {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.65",
+  "version": "2.4.67",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {