blitzstrike 2.4.68 → 2.4.69

package/CHANGELOG.md

@@ -5,6 +5,27 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.69] — 2026-09-14
+
+### Added — Supply-chain detectors (dependency confusion + ML model loading)
+
+- New `dependency_confusion` detector (CWE-427): flags a manifest/build file that
+  resolves a package from a PUBLIC registry (--index-url/--extra-index-url to
+  pypi.org/npmjs.org/rubygems.org), or references a scoped internal package
+  (@company/pkg) with no private registry pinned — the squattable-name confusion
+  vector. Manifest-gated by file name.
+- New `ml_supply_chain` detector (CWE-502): flags untrusted AI/ML model loading —
+  `torch.load` without `weights_only=True`, `joblib.load`, `keras.models.load_model`,
+  and `np.load(allow_pickle=True)` (source-agnostic, the flag IS the signal) —
+  pickle RCE on load. Complementary to the deserialization detector.
+- Wired into the full pipeline: CWE map (now 64), patterns (22), variants (74, all
+  fired), synonyms (69 aliases), severity VRT map, verification harness (now 21/21
+  detectors TP+TN).
+- FIXED a severity gap the interconnection audit exposed: the VRT map was missing
+  the 4 modern detectors added earlier (llm_injection, graphql_exposure,
+  oauth_misconfig, grpc_reflection) — they now carry proper VRT tiers, and a new
+  regression test asserts every detector type has a non-"unclassified" severity.
+
 ## [2.4.68] — 2026-09-14
 
 ### Added — Git-history secret mining + leaked-key validation

package/dist/index.js

@@ -16263,6 +16263,8 @@ function detectComplexBugs(code, file) {
   detectGraphqlExposure(code, file, out);
   detectOauthMisconfig(code, file, out);
   detectGrpcReflection(code, file, out);
+  detectDependencyConfusion(code, file, out);
+  detectMlSupplyChain(code, file, out);
   out.push(...detectWrongSanitizer(code, file));
   out.push(...detectMissingAuthz(code, file));
   const seen = new Set;
@@ -16679,6 +16681,78 @@ function detectGrpcReflection(code, file, out) {
     });
   }
 }
+function detectDependencyConfusion(code, file, out) {
+  const isManifest = /package\.json|requirements|pipfile|gemfile|go\.mod|pom\.xml|setup\.py|pyproject|\.npmrc|pip\.conf|dockerfile|\.ya?ml$/i.test(file);
+  if (!isManifest)
+    return;
+  const ls = lines2(code);
+  const idxRe = /--(?:extra-)?index-url\s+["']?(https?:\/\/[^"'<\s]+)["']?/gi;
+  let m;
+  while ((m = idxRe.exec(code)) !== null) {
+    if (/pypi\.org|pythonhosted|npmjs\.org|rubygems\.org|golang\.org|crates\.io|maven\.apache\.org/i.test(m[1])) {
+      const ln = lineNo2(code, m.index);
+      out.push({
+        file,
+        line: ln,
+        type: "dependency_confusion",
+        category: "Dependency confusion — public registry in resolution path",
+        severity: "high",
+        evidence: (ls[ln - 1] ?? "").trim(),
+        detail: `A public registry (${m[1]}) is the resolution source — an internal package name that exists or can be squatted on the public registry resolves there instead of the private one, pulling attacker-controlled code (CWE-427). Pin a private registry and namespace internal packages uniquely.`
+      });
+    }
+  }
+  const hasPrivateRegistry = /--(?:index-url|registry)\s+["']?(?!https?:\/\/pypi\.org|https?:\/\/registry\.npmjs\.org)/i.test(code) || /(?:registry|index[-_]url)\s*[:=]\s*["']https?:\/\/(?!.*(?:pypi\.org|registry\.npmjs\.org))/i.test(code);
+  if (!hasPrivateRegistry) {
+    const scopedRe = /["'](@[a-z0-9][a-z0-9-]*\/[a-z0-9_.-]+)["']/g;
+    while ((m = scopedRe.exec(code)) !== null) {
+      const ln = lineNo2(code, m.index);
+      out.push({
+        file,
+        line: ln,
+        type: "dependency_confusion",
+        category: "Dependency confusion — scoped package, no private registry",
+        severity: "medium",
+        evidence: (ls[ln - 1] ?? "").trim(),
+        detail: `The scoped package ${m[1]} is referenced but no private registry is pinned — if the @scope is not registered/reserved on the public registry, an attacker can publish ${m[1]} there and the build will pull malicious code (CWE-427). Verify the registry resolution and pin it.`
+      });
+    }
+  }
+}
+function detectMlSupplyChain(code, file, out) {
+  const ls = lines2(code);
+  const clean = stripCommentsOnly(code);
+  const sinks = [
+    { re: /torch\.load\s*\(/g, name: "torch.load", note: "uses pickle; pass weights_only=True", skipIfSafe: /weights_only\s*=\s*True/ },
+    { re: /\bjoblib\.load\s*\(/g, name: "joblib.load", note: "uses pickle (no safe flag)" },
+    { re: /(?:tf\.)?keras\.models\.load_model\s*\(/g, name: "keras load_model", note: "deserializes the model graph (pickle/h5)" },
+    { re: /\bnp\.load\s*\(/g, name: "np.load", note: "allow_pickle=True is RCE", requireFlag: /allow_pickle\s*=\s*True/i }
+  ];
+  for (const s of sinks) {
+    s.re.lastIndex = 0;
+    let m;
+    while ((m = s.re.exec(clean)) !== null) {
+      const ln = lineNo2(code, m.index);
+      const l = ls[ln - 1] ?? "";
+      if (s.skipIfSafe && s.skipIfSafe.test(l))
+        continue;
+      if (s.requireFlag && !s.requireFlag.test(l))
+        continue;
+      const flagIsSignal = s.requireFlag != null;
+      if (!flagIsSignal && !SOURCE_TOKENS3.test(l) && !/https?:\/\//.test(l) && !/download|request|upload|user|input|temp|tmp/i.test(l))
+        continue;
+      out.push({
+        file,
+        line: ln,
+        type: "ml_supply_chain",
+        category: "ML supply chain — untrusted model load",
+        severity: "high",
+        evidence: l.trim(),
+        detail: `\`${s.name}\` loads a model from an untrusted source — ${s.note}. A poisoned model file executes arbitrary code on load (CWE-502). Pin hashes, load from a trusted artifact store, and use the safe flag where available.`
+      });
+    }
+  }
+}
 var SOURCE_TOKENS3, MAGIC_METHODS, SECRET_FIELD_RE, SECRET_PLACEHOLDER_RE, ENTROPY_EXCLUDE_VAR;
 var init_complex_bugs = __esm(() => {
   init_security_state();
@@ -16694,8 +16768,8 @@ var init_complex_bugs = __esm(() => {
 // src/verify-harness.ts
 function runVerificationHarness() {
   const cases = CASES.map((c) => {
-    const pos = detectComplexBugs(c.positive, "positive.php").filter((f) => f.type === c.detector);
-    const neg = detectComplexBugs(c.negative, "negative.php").filter((f) => f.type === c.detector);
+    const pos = detectComplexBugs(c.positive, c.file ?? "positive.php").filter((f) => f.type === c.detector);
+    const neg = detectComplexBugs(c.negative, c.file ?? "negative.php").filter((f) => f.type === c.detector);
     const positive_fired = pos.length > 0;
     const negative_fired = neg.length > 0;
     const tp = positive_fired;
@@ -16860,6 +16934,20 @@ $r = openai.chat.completions.create(['messages' => [['role' => 'user', 'content'
       detector: "grpc_reflection",
       positive: PHP(`$server->addService(enable_server_reflection());`),
       negative: PHP(`$server->addService($my_service);`)
+    },
+    {
+      id: "dependency-confusion",
+      detector: "dependency_confusion",
+      file: "requirements.txt",
+      positive: `--extra-index-url https://pypi.org/simple\\nnumpy==1.24.0\\n`,
+      negative: `--index-url https://pypi.internal.company.com/simple\\nnumpy==1.24.0\\n`
+    },
+    {
+      id: "ml-supply-chain",
+      detector: "ml_supply_chain",
+      file: "train.py",
+      positive: `import torch\\nmodel = torch.load(downloaded_model)\\n`,
+      negative: `import torch\\nmodel = torch.load("model.pt", weights_only=True)\\n`
     }
   ];
 });
@@ -16879,7 +16967,7 @@ function loadVariants() {
 function scanVariants() {
   const variants = loadVariants().filter((v) => !CROSS_FILE_ONLY.has(v.class));
   const results = variants.map((v, i) => {
-    const findings = detectComplexBugs(v.code, `variant-${i}.php`).filter((f) => f.type === v.class);
+    const findings = detectComplexBugs(v.code, v.file ?? `variant-${i}.php`).filter((f) => f.type === v.class);
     return { id: `variant-${i}`, class: v.class, fired: findings.length > 0, note: v.note };
   });
   const per_class = {};
@@ -57791,7 +57879,16 @@ var ALIASES = {
   "header injection": "crlf_injection",
   "http response splitting": "crlf_injection",
   "wrong sanitizer": "wrong_sanitizer",
-  "wrong context sanitization": "wrong_sanitizer"
+  "wrong context sanitization": "wrong_sanitizer",
+  "dependency confusion": "dependency_confusion",
+  "dep confusion": "dependency_confusion",
+  "supply chain": "dependency_confusion",
+  "supply chain attack": "dependency_confusion",
+  "ml supply chain": "ml_supply_chain",
+  "ai supply chain": "ml_supply_chain",
+  "model poisoning": "ml_supply_chain",
+  "ml security": "ml_supply_chain",
+  "ai ml security": "ml_supply_chain"
 };
 function normalize(term) {
   return term.trim().toLowerCase().replace(/[_-]+/g, " ").replace(/\s+/g, " ").trim();
@@ -58076,7 +58173,13 @@ var VRT_MAP = {
   prototype_pollution: { vrt: "injection > prototype_pollution", priority: "P2", severity: "high", rationale: "Object prototype corruption can escalate to code execution in gadget-heavy runtimes." },
   crlf_injection: { vrt: "injection > crlf_injection", priority: "P3", severity: "medium", rationale: "Header injection enables cookie poisoning or cache poisoning." },
   missing_nonce: { vrt: "broken_access_control > cross_site_request_forgery", priority: "P3", severity: "medium", rationale: "A state-changing action lacks an anti-CSRF token." },
-  wrong_sanitizer: { vrt: "injection > improper_input_validation", priority: "P3", severity: "medium", rationale: "A value sanitized for the wrong context still reaches the sink; severity follows the sink." }
+  wrong_sanitizer: { vrt: "injection > improper_input_validation", priority: "P3", severity: "medium", rationale: "A value sanitized for the wrong context still reaches the sink; severity follows the sink." },
+  llm_injection: { vrt: "injection > prompt_injection", priority: "P2", severity: "high", rationale: "Prompt injection can exfiltrate the system prompt, RAG data, or trigger privileged tool use." },
+  graphql_exposure: { vrt: "misconfiguration > graphql_introspection", priority: "P4", severity: "low", rationale: "GraphQL introspection exposes the schema but is not directly exploitable." },
+  oauth_misconfig: { vrt: "authentication > oauth_misconfiguration", priority: "P2", severity: "high", rationale: "An OAuth/open-redirect misconfiguration can leak authorization codes → account takeover." },
+  grpc_reflection: { vrt: "misconfiguration > debug_information_exposure", priority: "P5", severity: "low", rationale: "gRPC reflection exposes the API contract but is not directly exploitable." },
+  dependency_confusion: { vrt: "insecure_design > dependency_confusion", priority: "P2", severity: "high", rationale: "An internal package resolves from a squattable public registry → attacker-controlled code in the build." },
+  ml_supply_chain: { vrt: "injection > insecure_deserialization", priority: "P1", severity: "critical", rationale: "Untrusted model loading via pickle (torch/joblib/numpy) → arbitrary code execution on load." }
 };
 function severityCalibrate(input) {
   const type = input.type?.toLowerCase() ?? "";
@@ -59596,7 +59699,7 @@ function createServer() {
 ` + `- A hard block (Cloudflare/WAF/IP-block/captcha) is NOT the end: mark the finding blocked + note the required vantage (residential / authorized / correct-SNI / --resolve direct-to-origin), then CONTINUE to the next lead (origin bypass, non-prod cluster, mobile APK, subdomain).
 ` + `- Keep trying every lead AND every chain step until each is verified/executed or blocked, THEN generate_report. Never deliver a bare surface map, and never stop at 'found X' when X enables more.
 
-` + "TWO PATHS:\\n" + "- Source path on disk -> blitz_scan / taint_file / eagle_eye2 (static).\\n" + "- Live URL -> live_recon / active_scan / strike_verify (web-hunting).\\n\\n" + "DEEPEN A FINDING: attack_plan(target, tech, params) to get the prioritized vector plan (decide what to test next with data); list_chains (escalation), chain_links (compose), technique_lookup(cls), payload_lookup, bypass_lookup (blocked). Ground any detector hit empirically with pattern_lookup(id) — it returns the class's CWE, real-world signature, escalation chains, citable references, per-class bypass techniques, and the high-value assets (crown jewels) that class hits, so a raw hit becomes a class-aware finding. Resolve free-form terminology first with synonym_lookup(term) (IDOR/BOLA/SQLi/prompt-injection → canonical id). For an llm_injection hit, its pattern carries a validation discipline — the RUN-TWICE RULE (reproduce token-for-token across two fresh sessions), NON-GUESSABLE ANCHOR (must leak a real key/URL, not a plausible guess), and OOB PROOF (a verifiable callback log) — apply all three before reporting. BEFORE generating a report, run submission_gate(...) and only ship a finding that passes all 7 questions (reproducible, in-scope, real-impact, no-privileged-assumption, verified-live, evidence-redacted, severity-derived); one false = kill it. Calibrate severity with severity_calibrate(type, cvss) to get a P1–P5 tier + VRT-style category. Start each engagement with engagement_scaffold(target, scope) for the folder + scope.md structure, and check data_refresh() to confirm the data layers are consistent. Phase doctrine: read_skill(bs-orchestrate-engagement | bs-web-hunting | bs-source-audit | bs-verify-finding). Campaign plan: read_playbook(target-type). On any failure call retry_guidance(signal) / model_fallback(signal) before giving up.\n" + "KNOWLEDGE BASE (discover, don't guess): skillLookup(topic) / listSkills for the 40 attack-path + hunting skills (ap-*, hp-*, bs-*); list_attack_vectors / attack_vectors(cat) for the 34-category vector taxonomy; taxonomy(kind) for OWASP/CWE/ASVS/API-top-10; read_playbook(type) for the 17 campaign playbooks; list_manuals / read_tool_manual for 317 tool references; list_tools / run_catalog_tool for the 141-tool catalog. Every tool, skill, and data layer is reachable from these. CROSS-TARGET INTELLIGENCE: strike_resolve auto-records confirmed/false_positive verdicts into the empirical ledger; query it with intelligence(action=hit_rates/top_vectors/recall) so a new target on a known tech inherits historical hit-rates (attack_plan already blends them into success_probability). intelligence(action=recall, tech, target) is the per-engagement pattern recall — it returns which patterns historically CONFIRMED on that tech (prioritize them) versus which only ever produced false positives (avoid them), so a new engagement starts from the empirical playbook of past ones. LIVE PENTEST + TARGETING (black-box, WAF-safe): cache_gap(base_url, endpoint) fuzzes path-normalization + static-extension variants for cache deception/poisoning; blind_oracle(base_url, param, value) detects which SINK a param reaches (sql/ssti/xss) via benign arithmetic (id=1+0, test${7*7}) WITHOUT a malicious payload; param_precedence(base_url, param, A, B) maps duplicate-parameter precedence (first/last-wins) for WAF-bypass. SOURCE TARGETING: action_surface(code) maps every wp_ajax_* action to its vuln class + DERIVED priority (what to look for WHERE); security_state(sanitizers, sink) gives a wrong-context sanitization verdict; framework_knowledge(framework) returns auth/nonce primitives for 9 frameworks; variant_scan(root, signature) mass-sweeps an install base for ONE bug family; patch_analyze(old, new) REVERSES a security patch into the 0-day, and its mine_signature feeds variant_scan to sweep unpatched copies. All of these are DETECTION HINTS — verify each live (strike_verify / browser_validate) before it enters the report. NEWEST DETECTORS — understand AND try them: variant_scan also emits priv_esc (privilege escalation — a role/capability/user change fed by request input, traced cross-file via reverse call-graph, e.g. set_role($id, sanitize_key($_POST['um-role'])) or update_user_meta(...,'wp_capabilities', $_POST[...])) and flags uploadAllow=>array('all') unrestricted-upload configs as file_upload (the file-manager/connector shape). TO TRY a priv_esc hit: submit the role field with 'administrator' (or send wp_capabilities meta) and confirm the account actually gains admin. TO TRY an unrestricted-upload hit: POST a .php/.phtml and confirm it lands web-reachable + executes. variant_scan also emits hardcoded_secret (CWE-798) in three tiers: a secret field (api_key/db_password/access_token/aws_*) assigned a literal (HIGH), a known secret FORMAT (JWT eyJ…/AWS AKIA…/GitHub ghp_…/Slack xoxb-…/…) regardless of name (HIGH), or a high-entropy suspect token (MEDIUM — verify before reporting). Verify a frontend/JS secret live via drive_devtools (inspect the JS bundle / network response and confirm the key is actually exposed), and for a backend secret confirm it is reachable/valid. A static hit is a HYPOTHESIS until verified live — never report unverified. For a repo, also scan_git_history(root) — secrets DELETED from HEAD still live in .git history (the removed-later-is-not-fixed trap), and it feeds every recovered pre-deletion blob through the same secret detector. Once you recover a credential, prove it is still ACTIVE with validate_leaked_key(apiBase, endpoints, key|blobUrl) — a READ-ONLY differential test (401-without-key vs 200-with-key = auth bypass PROVEN).\n" + `PRECISION ANALYSIS — chrome-devtools MCP is MANDATORY, not optional:
+` + "TWO PATHS:\\n" + "- Source path on disk -> blitz_scan / taint_file / eagle_eye2 (static).\\n" + "- Live URL -> live_recon / active_scan / strike_verify (web-hunting).\\n\\n" + "DEEPEN A FINDING: attack_plan(target, tech, params) to get the prioritized vector plan (decide what to test next with data); list_chains (escalation), chain_links (compose), technique_lookup(cls), payload_lookup, bypass_lookup (blocked). Ground any detector hit empirically with pattern_lookup(id) — it returns the class's CWE, real-world signature, escalation chains, citable references, per-class bypass techniques, and the high-value assets (crown jewels) that class hits, so a raw hit becomes a class-aware finding. Resolve free-form terminology first with synonym_lookup(term) (IDOR/BOLA/SQLi/prompt-injection → canonical id). For an llm_injection hit, its pattern carries a validation discipline — the RUN-TWICE RULE (reproduce token-for-token across two fresh sessions), NON-GUESSABLE ANCHOR (must leak a real key/URL, not a plausible guess), and OOB PROOF (a verifiable callback log) — apply all three before reporting. BEFORE generating a report, run submission_gate(...) and only ship a finding that passes all 7 questions (reproducible, in-scope, real-impact, no-privileged-assumption, verified-live, evidence-redacted, severity-derived); one false = kill it. Calibrate severity with severity_calibrate(type, cvss) to get a P1–P5 tier + VRT-style category. Start each engagement with engagement_scaffold(target, scope) for the folder + scope.md structure, and check data_refresh() to confirm the data layers are consistent. Phase doctrine: read_skill(bs-orchestrate-engagement | bs-web-hunting | bs-source-audit | bs-verify-finding). Campaign plan: read_playbook(target-type). On any failure call retry_guidance(signal) / model_fallback(signal) before giving up.\n" + "KNOWLEDGE BASE (discover, don't guess): skillLookup(topic) / listSkills for the 40 attack-path + hunting skills (ap-*, hp-*, bs-*); list_attack_vectors / attack_vectors(cat) for the 34-category vector taxonomy; taxonomy(kind) for OWASP/CWE/ASVS/API-top-10; read_playbook(type) for the 17 campaign playbooks; list_manuals / read_tool_manual for 317 tool references; list_tools / run_catalog_tool for the 141-tool catalog. Every tool, skill, and data layer is reachable from these. CROSS-TARGET INTELLIGENCE: strike_resolve auto-records confirmed/false_positive verdicts into the empirical ledger; query it with intelligence(action=hit_rates/top_vectors/recall) so a new target on a known tech inherits historical hit-rates (attack_plan already blends them into success_probability). intelligence(action=recall, tech, target) is the per-engagement pattern recall — it returns which patterns historically CONFIRMED on that tech (prioritize them) versus which only ever produced false positives (avoid them), so a new engagement starts from the empirical playbook of past ones. LIVE PENTEST + TARGETING (black-box, WAF-safe): cache_gap(base_url, endpoint) fuzzes path-normalization + static-extension variants for cache deception/poisoning; blind_oracle(base_url, param, value) detects which SINK a param reaches (sql/ssti/xss) via benign arithmetic (id=1+0, test${7*7}) WITHOUT a malicious payload; param_precedence(base_url, param, A, B) maps duplicate-parameter precedence (first/last-wins) for WAF-bypass. SOURCE TARGETING: action_surface(code) maps every wp_ajax_* action to its vuln class + DERIVED priority (what to look for WHERE); security_state(sanitizers, sink) gives a wrong-context sanitization verdict; framework_knowledge(framework) returns auth/nonce primitives for 9 frameworks; variant_scan(root, signature) mass-sweeps an install base for ONE bug family; patch_analyze(old, new) REVERSES a security patch into the 0-day, and its mine_signature feeds variant_scan to sweep unpatched copies. All of these are DETECTION HINTS — verify each live (strike_verify / browser_validate) before it enters the report. NEWEST DETECTORS — understand AND try them: variant_scan also emits priv_esc (privilege escalation — a role/capability/user change fed by request input, traced cross-file via reverse call-graph, e.g. set_role($id, sanitize_key($_POST['um-role'])) or update_user_meta(...,'wp_capabilities', $_POST[...])) and flags uploadAllow=>array('all') unrestricted-upload configs as file_upload (the file-manager/connector shape). TO TRY a priv_esc hit: submit the role field with 'administrator' (or send wp_capabilities meta) and confirm the account actually gains admin. TO TRY an unrestricted-upload hit: POST a .php/.phtml and confirm it lands web-reachable + executes. variant_scan also emits hardcoded_secret (CWE-798) in three tiers: a secret field (api_key/db_password/access_token/aws_*) assigned a literal (HIGH), a known secret FORMAT (JWT eyJ…/AWS AKIA…/GitHub ghp_…/Slack xoxb-…/…) regardless of name (HIGH), or a high-entropy suspect token (MEDIUM — verify before reporting). Verify a frontend/JS secret live via drive_devtools (inspect the JS bundle / network response and confirm the key is actually exposed), and for a backend secret confirm it is reachable/valid. A static hit is a HYPOTHESIS until verified live — never report unverified. For a repo, also scan_git_history(root) — secrets DELETED from HEAD still live in .git history (the removed-later-is-not-fixed trap), and it feeds every recovered pre-deletion blob through the same secret detector. Once you recover a credential, prove it is still ACTIVE with validate_leaked_key(apiBase, endpoints, key|blobUrl) — a READ-ONLY differential test (401-without-key vs 200-with-key = auth bypass PROVEN). Two supply-chain detectors: dependency_confusion (a manifest/build file resolving a package from a public registry — pypi.org/npmjs.org --extra-index-url, or a scoped @company/pkg with no private registry) and ml_supply_chain (torch.load without weights_only=True / joblib.load / np.load(allow_pickle=True) / keras load_model on an untrusted model → pickle RCE).\n" + `PRECISION ANALYSIS — chrome-devtools MCP is MANDATORY, not optional:
 ` + `- When a lead needs DOM/JS precision — DOM-XSS sink execution, AJAX endpoint + payload interception, JS runtime errors, redirect chains, SSO/token flow, or anything a static HTML glance cannot prove — call drive_devtools(target). It spawns chrome-devtools-mcp and drives a REAL headless browser (navigate -> list_network_requests -> list_console_messages -> evaluate_script), giving reproducible evidence instead of a guess.
 ` + `- Before calling it, check_mcp() to confirm the browser MCP is available; if not, blitzstrike install-tools or npm i -g chrome-devtools-mcp. Never substitute eyeballing minified JS or a static sink guess when a live browser can PROVE it. This is the precision + consistency layer.
 ` + "EXTERNAL MCP SERVERS (verified, connect them — NOT one-shot CLIs): chrome-devtools-mcp (29 tools: list_network_requests/get_network_request for raw HTTP interception, list_console_messages for JS errors + DOM-XSS, evaluate_script to run JS, take_screenshot) -> stdio chrome-devtools-mcp --headless --chromeArg=--no-sandbox --chromeArg=--disable-gpu (as root/container this is MANDATORY or the browser crashes; add --proxyServer http://127.0.0.1:8080 to route through Burp, --acceptInsecureCerts for bad TLS). burp-suite-mcp (proxy history + active scan + repeater) -> NOT npm: build the JAR (git clone https://github.com/PortSwigger/mcp-server.git && cd mcp-server && ./gradlew embedProxyJar), load it in Burp Extensions, then connect the client to http://127.0.0.1:9876 (SSE) or the stdio proxy java -jar mcp-proxy-all.jar --sse-url http://127.0.0.1:9876."

package/intelligence/cwe_map.json

@@ -1,67 +1,325 @@
 {
   "_comment": "Technique class -> CWE mapping (standard weakness IDs, for grounding + professional reporting). Each entry maps a techniques.json class id to its CWE ID(s) and name.",
   "mapping": [
-    {"id": "ssrf", "cwe": "CWE-918", "name": "Server-Side Request Forgery (SSRF)"},
-    {"id": "request_smuggling", "cwe": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (Request Smuggling)"},
-    {"id": "cache_poisoning", "cwe": "CWE-524", "name": "Use of Cache Containing Sensitive Information"},
-    {"id": "race_condition", "cwe": "CWE-362", "name": "Concurrent Execution using Shared Resource (TOCTOU)"},
-    {"id": "ssti", "cwe": "CWE-1336", "name": "Improper Neutralization of Special Elements Used in a Template Engine (SSTI)"},
-    {"id": "deserialization", "cwe": "CWE-502", "name": "Deserialization of Untrusted Data"},
-    {"id": "prototype_pollution", "cwe": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution)"},
-    {"id": "mass_assignment", "cwe": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"},
-    {"id": "sql_injection", "cwe": "CWE-89", "name": "SQL Injection"},
-    {"id": "nosql_injection", "cwe": "CWE-943", "name": "Improper Neutralization of Special Elements in Data Query Logic (NoSQL Injection)"},
-    {"id": "xss", "cwe": "CWE-79", "name": "Cross-site Scripting"},
-    {"id": "cors", "cwe": "CWE-942", "name": "Permissive Cross-domain Policy with Untrusted Domains (CORS)"},
-    {"id": "csrf", "cwe": "CWE-352", "name": "Cross-Site Request Forgery"},
-    {"id": "jwt", "cwe": "CWE-347", "name": "Improper Verification of Cryptographic Signature"},
-    {"id": "oauth", "cwe": "CWE-287", "name": "Improper Authentication"},
-    {"id": "host_header", "cwe": "CWE-644", "name": "Improper Neutralization of HTTP Headers for Scripting Syntax (Host Header)"},
-    {"id": "open_redirect", "cwe": "CWE-601", "name": "URL Redirection to Untrusted Site (Open Redirect)"},
-    {"id": "subdomain_takeover", "cwe": "CWE-350", "name": "Reliance on Reverse DNS Resolution for a Security-Critical Action"},
-    {"id": "idor", "cwe": "CWE-639", "name": "Authorization Bypass Through User-Controlled Key (IDOR/BOLA)"},
-    {"id": "graphql", "cwe": "CWE-862", "name": "Missing Authorization"},
-    {"id": "websocket", "cwe": "CWE-345", "name": "Insufficient Verification of Data Authenticity (WebSocket Hijacking)"},
-    {"id": "file_upload", "cwe": "CWE-434", "name": "Unrestricted Upload of File with Dangerous Type"},
-    {"id": "path_traversal_lfi", "cwe": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)"},
-    {"id": "command_injection", "cwe": "CWE-78", "name": "OS Command Injection"},
-    {"id": "xxe", "cwe": "CWE-611", "name": "Improper Restriction of XML External Entity Reference (XXE)"},
-    {"id": "crlf_injection", "cwe": "CWE-93", "name": "Improper Neutralization of CRLF Sequences (CRLF Injection)"},
-    {"id": "ldap_injection", "cwe": "CWE-90", "name": "Improper Neutralization of Special Elements in LDAP Queries"},
-    {"id": "xpath_injection", "cwe": "CWE-643", "name": "Improper Neutralization of Data within XPath Expressions"},
-    {"id": "xslt_injection", "cwe": "CWE-91", "name": "XML Injection (XSLT)"},
-    {"id": "ssi_injection", "cwe": "CWE-97", "name": "Improper Neutralization of Server-Side Includes (SSI)"},
-    {"id": "xssi", "cwe": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor (XSSI)"},
-    {"id": "email_injection", "cwe": "CWE-74", "name": "Improper Neutralization of Special Elements in Output (Email Header Injection)"},
-    {"id": "formula_csv_injection", "cwe": "CWE-1236", "name": "Improper Neutralization of Formula Elements in a CSV File"},
-    {"id": "orm_injection", "cwe": "CWE-89", "name": "SQL Injection (via ORM)"},
-    {"id": "rsql_injection", "cwe": "CWE-89", "name": "SQL Injection (RSQL/FIQL)"},
-    {"id": "unicode_injection", "cwe": "CWE-180", "name": "Incorrect Behavior Order: Validate Before Canonicalize"},
-    {"id": "dangling_markup", "cwe": "CWE-79", "name": "Cross-site Scripting (Dangling Markup)"},
-    {"id": "account_takeover", "cwe": "CWE-287", "name": "Improper Authentication (Account Takeover)"},
-    {"id": "two_fa_bypass", "cwe": "CWE-308", "name": "Use of Single-factor Authentication"},
-    {"id": "rate_limit_bypass", "cwe": "CWE-799", "name": "Improper Control of Interaction Frequency (Rate Limit)"},
-    {"id": "password_reset_bypass", "cwe": "CWE-640", "name": "Weak Password Recovery Mechanism for Forgotten Password"},
-    {"id": "captcha_bypass", "cwe": "CWE-804", "name": "Guessable CAPTCHA"},
-    {"id": "registration_vulnerabilities", "cwe": "CWE-799", "name": "Improper Control of Interaction Frequency"},
-    {"id": "payment_bypass", "cwe": "CWE-841", "name": "Improper Enforcement of Behavioral Workflow (Business Logic)"},
-    {"id": "timing_attacks", "cwe": "CWE-208", "name": "Observable Timing Discrepancy"},
-    {"id": "uuid_insecurities", "cwe": "CWE-330", "name": "Use of Insufficiently Random Values"},
-    {"id": "reverse_tab_nabbing", "cwe": "CWE-1022", "name": "Use of Web Link to Untrusted Target with window.opener Access (Reverse Tabnabbing)"},
-    {"id": "iframe_traps", "cwe": "CWE-1021", "name": "Improper Restriction of Rendered UI Layers or Frames (Clickjacking)"},
-    {"id": "cookie_hacking", "cwe": "CWE-565", "name": "Reliance on Cookies without Validation and Integrity Checking"},
-    {"id": "postmessage_vulnerabilities", "cwe": "CWE-345", "name": "Insufficient Verification of Data Authenticity (postMessage)"},
-    {"id": "web_vulnerabilities_methodology", "cwe": "CWE-1057", "name": "Improper Inventory / Methodology"},
-    {"id": "missing_authz", "cwe": "CWE-862", "name": "Missing Authorization"},
-    {"id": "missing_nonce", "cwe": "CWE-352", "name": "Cross-Site Request Forgery (Missing Nonce)"},
-    {"id": "priv_esc", "cwe": "CWE-269", "name": "Improper Privilege Management"},
-    {"id": "hardcoded_secret", "cwe": "CWE-798", "name": "Use of Hard-coded Credentials"},
-    {"id": "type_juggling", "cwe": "CWE-697", "name": "Incorrect Comparison"},
-    {"id": "path_confusion", "cwe": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)"},
-    {"id": "wrong_sanitizer", "cwe": "CWE-20", "name": "Improper Input Validation"},
-    {"id": "llm_injection", "cwe": "CWE-77", "name": "Improper Neutralization of Special Elements used in a Command (LLM Prompt Injection)"},
-    {"id": "graphql_exposure", "cwe": "CWE-200", "name": "Exposure of Sensitive Information"},
-    {"id": "oauth_misconfig", "cwe": "CWE-601", "name": "URL Redirection to Untrusted Site (Open Redirect)"},
-    {"id": "grpc_reflection", "cwe": "CWE-200", "name": "Exposure of Sensitive Information"}
+    {
+      "id": "ssrf",
+      "cwe": "CWE-918",
+      "name": "Server-Side Request Forgery (SSRF)"
+    },
+    {
+      "id": "request_smuggling",
+      "cwe": "CWE-444",
+      "name": "Inconsistent Interpretation of HTTP Requests (Request Smuggling)"
+    },
+    {
+      "id": "cache_poisoning",
+      "cwe": "CWE-524",
+      "name": "Use of Cache Containing Sensitive Information"
+    },
+    {
+      "id": "race_condition",
+      "cwe": "CWE-362",
+      "name": "Concurrent Execution using Shared Resource (TOCTOU)"
+    },
+    {
+      "id": "ssti",
+      "cwe": "CWE-1336",
+      "name": "Improper Neutralization of Special Elements Used in a Template Engine (SSTI)"
+    },
+    {
+      "id": "deserialization",
+      "cwe": "CWE-502",
+      "name": "Deserialization of Untrusted Data"
+    },
+    {
+      "id": "prototype_pollution",
+      "cwe": "CWE-1321",
+      "name": "Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution)"
+    },
+    {
+      "id": "mass_assignment",
+      "cwe": "CWE-915",
+      "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
+    },
+    {
+      "id": "sql_injection",
+      "cwe": "CWE-89",
+      "name": "SQL Injection"
+    },
+    {
+      "id": "nosql_injection",
+      "cwe": "CWE-943",
+      "name": "Improper Neutralization of Special Elements in Data Query Logic (NoSQL Injection)"
+    },
+    {
+      "id": "xss",
+      "cwe": "CWE-79",
+      "name": "Cross-site Scripting"
+    },
+    {
+      "id": "cors",
+      "cwe": "CWE-942",
+      "name": "Permissive Cross-domain Policy with Untrusted Domains (CORS)"
+    },
+    {
+      "id": "csrf",
+      "cwe": "CWE-352",
+      "name": "Cross-Site Request Forgery"
+    },
+    {
+      "id": "jwt",
+      "cwe": "CWE-347",
+      "name": "Improper Verification of Cryptographic Signature"
+    },
+    {
+      "id": "oauth",
+      "cwe": "CWE-287",
+      "name": "Improper Authentication"
+    },
+    {
+      "id": "host_header",
+      "cwe": "CWE-644",
+      "name": "Improper Neutralization of HTTP Headers for Scripting Syntax (Host Header)"
+    },
+    {
+      "id": "open_redirect",
+      "cwe": "CWE-601",
+      "name": "URL Redirection to Untrusted Site (Open Redirect)"
+    },
+    {
+      "id": "subdomain_takeover",
+      "cwe": "CWE-350",
+      "name": "Reliance on Reverse DNS Resolution for a Security-Critical Action"
+    },
+    {
+      "id": "idor",
+      "cwe": "CWE-639",
+      "name": "Authorization Bypass Through User-Controlled Key (IDOR/BOLA)"
+    },
+    {
+      "id": "graphql",
+      "cwe": "CWE-862",
+      "name": "Missing Authorization"
+    },
+    {
+      "id": "websocket",
+      "cwe": "CWE-345",
+      "name": "Insufficient Verification of Data Authenticity (WebSocket Hijacking)"
+    },
+    {
+      "id": "file_upload",
+      "cwe": "CWE-434",
+      "name": "Unrestricted Upload of File with Dangerous Type"
+    },
+    {
+      "id": "path_traversal_lfi",
+      "cwe": "CWE-22",
+      "name": "Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)"
+    },
+    {
+      "id": "command_injection",
+      "cwe": "CWE-78",
+      "name": "OS Command Injection"
+    },
+    {
+      "id": "xxe",
+      "cwe": "CWE-611",
+      "name": "Improper Restriction of XML External Entity Reference (XXE)"
+    },
+    {
+      "id": "crlf_injection",
+      "cwe": "CWE-93",
+      "name": "Improper Neutralization of CRLF Sequences (CRLF Injection)"
+    },
+    {
+      "id": "ldap_injection",
+      "cwe": "CWE-90",
+      "name": "Improper Neutralization of Special Elements in LDAP Queries"
+    },
+    {
+      "id": "xpath_injection",
+      "cwe": "CWE-643",
+      "name": "Improper Neutralization of Data within XPath Expressions"
+    },
+    {
+      "id": "xslt_injection",
+      "cwe": "CWE-91",
+      "name": "XML Injection (XSLT)"
+    },
+    {
+      "id": "ssi_injection",
+      "cwe": "CWE-97",
+      "name": "Improper Neutralization of Server-Side Includes (SSI)"
+    },
+    {
+      "id": "xssi",
+      "cwe": "CWE-200",
+      "name": "Exposure of Sensitive Information to an Unauthorized Actor (XSSI)"
+    },
+    {
+      "id": "email_injection",
+      "cwe": "CWE-74",
+      "name": "Improper Neutralization of Special Elements in Output (Email Header Injection)"
+    },
+    {
+      "id": "formula_csv_injection",
+      "cwe": "CWE-1236",
+      "name": "Improper Neutralization of Formula Elements in a CSV File"
+    },
+    {
+      "id": "orm_injection",
+      "cwe": "CWE-89",
+      "name": "SQL Injection (via ORM)"
+    },
+    {
+      "id": "rsql_injection",
+      "cwe": "CWE-89",
+      "name": "SQL Injection (RSQL/FIQL)"
+    },
+    {
+      "id": "unicode_injection",
+      "cwe": "CWE-180",
+      "name": "Incorrect Behavior Order: Validate Before Canonicalize"
+    },
+    {
+      "id": "dangling_markup",
+      "cwe": "CWE-79",
+      "name": "Cross-site Scripting (Dangling Markup)"
+    },
+    {
+      "id": "account_takeover",
+      "cwe": "CWE-287",
+      "name": "Improper Authentication (Account Takeover)"
+    },
+    {
+      "id": "two_fa_bypass",
+      "cwe": "CWE-308",
+      "name": "Use of Single-factor Authentication"
+    },
+    {
+      "id": "rate_limit_bypass",
+      "cwe": "CWE-799",
+      "name": "Improper Control of Interaction Frequency (Rate Limit)"
+    },
+    {
+      "id": "password_reset_bypass",
+      "cwe": "CWE-640",
+      "name": "Weak Password Recovery Mechanism for Forgotten Password"
+    },
+    {
+      "id": "captcha_bypass",
+      "cwe": "CWE-804",
+      "name": "Guessable CAPTCHA"
+    },
+    {
+      "id": "registration_vulnerabilities",
+      "cwe": "CWE-799",
+      "name": "Improper Control of Interaction Frequency"
+    },
+    {
+      "id": "payment_bypass",
+      "cwe": "CWE-841",
+      "name": "Improper Enforcement of Behavioral Workflow (Business Logic)"
+    },
+    {
+      "id": "timing_attacks",
+      "cwe": "CWE-208",
+      "name": "Observable Timing Discrepancy"
+    },
+    {
+      "id": "uuid_insecurities",
+      "cwe": "CWE-330",
+      "name": "Use of Insufficiently Random Values"
+    },
+    {
+      "id": "reverse_tab_nabbing",
+      "cwe": "CWE-1022",
+      "name": "Use of Web Link to Untrusted Target with window.opener Access (Reverse Tabnabbing)"
+    },
+    {
+      "id": "iframe_traps",
+      "cwe": "CWE-1021",
+      "name": "Improper Restriction of Rendered UI Layers or Frames (Clickjacking)"
+    },
+    {
+      "id": "cookie_hacking",
+      "cwe": "CWE-565",
+      "name": "Reliance on Cookies without Validation and Integrity Checking"
+    },
+    {
+      "id": "postmessage_vulnerabilities",
+      "cwe": "CWE-345",
+      "name": "Insufficient Verification of Data Authenticity (postMessage)"
+    },
+    {
+      "id": "web_vulnerabilities_methodology",
+      "cwe": "CWE-1057",
+      "name": "Improper Inventory / Methodology"
+    },
+    {
+      "id": "missing_authz",
+      "cwe": "CWE-862",
+      "name": "Missing Authorization"
+    },
+    {
+      "id": "missing_nonce",
+      "cwe": "CWE-352",
+      "name": "Cross-Site Request Forgery (Missing Nonce)"
+    },
+    {
+      "id": "priv_esc",
+      "cwe": "CWE-269",
+      "name": "Improper Privilege Management"
+    },
+    {
+      "id": "hardcoded_secret",
+      "cwe": "CWE-798",
+      "name": "Use of Hard-coded Credentials"
+    },
+    {
+      "id": "type_juggling",
+      "cwe": "CWE-697",
+      "name": "Incorrect Comparison"
+    },
+    {
+      "id": "path_confusion",
+      "cwe": "CWE-22",
+      "name": "Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)"
+    },
+    {
+      "id": "wrong_sanitizer",
+      "cwe": "CWE-20",
+      "name": "Improper Input Validation"
+    },
+    {
+      "id": "llm_injection",
+      "cwe": "CWE-77",
+      "name": "Improper Neutralization of Special Elements used in a Command (LLM Prompt Injection)"
+    },
+    {
+      "id": "graphql_exposure",
+      "cwe": "CWE-200",
+      "name": "Exposure of Sensitive Information"
+    },
+    {
+      "id": "oauth_misconfig",
+      "cwe": "CWE-601",
+      "name": "URL Redirection to Untrusted Site (Open Redirect)"
+    },
+    {
+      "id": "grpc_reflection",
+      "cwe": "CWE-200",
+      "name": "Exposure of Sensitive Information"
+    },
+    {
+      "id": "dependency_confusion",
+      "cwe": "CWE-427",
+      "name": "Uncontrolled Search Path Element"
+    },
+    {
+      "id": "ml_supply_chain",
+      "cwe": "CWE-502",
+      "name": "Deserialization of Untrusted Data"
+    }
   ]
-}
+}