blitzstrike 2.4.70 → 2.4.72
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +39 -0
- package/dist/index.js +411 -121
- package/intelligence/cwe_map.json +10 -0
- package/intelligence/hackbot-arena.json +339 -0
- package/intelligence/patterns.json +57 -0
- package/intelligence/variants.json +24 -0
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -5,6 +5,45 @@ All notable changes to Blitz Strike are documented here.
|
|
|
5
5
|
The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
|
|
6
6
|
and this project adheres to [Semantic Versioning](https://semver.org/).
|
|
7
7
|
|
|
8
|
+
## [2.4.72] — 2026-09-14
|
|
9
|
+
|
|
10
|
+
### Added — Hackbot Arena benchmark integration
|
|
11
|
+
|
|
12
|
+
- New `intelligence/hackbot-arena.json` (schema blitzstrike-hackbot-arena-v1): the
|
|
13
|
+
30 NusaSec Hackbot Arena web-security labs (id/name/difficulty/port/stack/
|
|
14
|
+
vuln_class/flag_location/judge success-when) — a local benchmark of realistic
|
|
15
|
+
Dockerized vulnerability chains with deterministic flags.
|
|
16
|
+
- New `src/hackbot-arena.ts` + three MCP tools:
|
|
17
|
+
- `hackbot_arena_list` — the 30 labs (evaluator view, no flags/solutions).
|
|
18
|
+
- `hackbot_arena_brief(labId)` — the AGENT brief: target URL, vuln class, stack,
|
|
19
|
+
flag FORMAT, and a DERIVED attack plan (vectors/detectors/chains/tools) mapped
|
|
20
|
+
from the vuln class. Never leaks the flag, judge criteria, or solution.
|
|
21
|
+
- `hackbot_arena_coverage` — maps all 30 labs against Blitz Strike's
|
|
22
|
+
detector/vector coverage (currently ~27/30 labs have deterministic tooling).
|
|
23
|
+
- Verified live against labs03 (JWTea): the brief maps it to the jwt vector +
|
|
24
|
+
jwt_analyze tool, and live_recon fingerprints the running lab (nginx + the
|
|
25
|
+
JWKS/docs endpoints) — the agent then drives the JWT alg-confusion chain.
|
|
26
|
+
|
|
27
|
+
## [2.4.71] — 2026-09-14
|
|
28
|
+
|
|
29
|
+
### Added — Rust language support (adapter + detectors)
|
|
30
|
+
|
|
31
|
+
- Rust is now the 5th taint-engine language (php/javascript/python/java/rust): a new
|
|
32
|
+
regex/line-oriented adapter maps Rust sources (env::args, stdin, axum/actix
|
|
33
|
+
Query/Form/Json/Path extractors, env::var) and sinks (std::process::Command,
|
|
34
|
+
sqlx/diesel/rusqlite, reqwest/hyper, std::fs, serde/bincode) onto the existing
|
|
35
|
+
sink classes. The sqlx `query!`/`query_as!` compile-time macro + `canonicalize()`
|
|
36
|
+
are treated as safe (suppressed), so runtime `sqlx::query(&format!(...))` is the
|
|
37
|
+
signal that fires.
|
|
38
|
+
- Two Rust-specific detectors: `rust_unsafe` (transmute / assume_init /
|
|
39
|
+
from_raw_parts / ptr::* — memory-unsafety surface, CWE-119) and
|
|
40
|
+
`rust_format_string` (println!/format! with a VARIABLE as the format string —
|
|
41
|
+
CWE-134, distinct from the safe `println!("{}", v)`).
|
|
42
|
+
- Full pipeline wired: CWE map (66), patterns (24, grounded in RustSec / OWASP
|
|
43
|
+
WSTG-INPV-13 / Rust Foundation "Unsafe Rust in the Wild" / rust-security-handbook),
|
|
44
|
+
variants (78), synonyms, severity VRT, coverage matrix (5 languages), and the
|
|
45
|
+
verification harness (23/23 detectors TP+TN).
|
|
46
|
+
|
|
8
47
|
## [2.4.70] — 2026-09-14
|
|
9
48
|
|
|
10
49
|
### Added — Per-finding per-scope reports (HackerOne-grade)
|