blitzstrike 2.4.71 → 2.4.73

package/dist/index.js

@@ -15584,11 +15584,11 @@ var require_src = __commonJS(function(exports, module) {
 });
 
 // src/mcp-status.ts
-import { existsSync as existsSync9 } from "node:fs";
+import { existsSync as existsSync10 } from "node:fs";
 import { spawnSync as spawnSync3 } from "node:child_process";
 async function checkMcpServers() {
   const out = [];
-  const bin = ["/usr/bin/chrome-devtools-mcp", "/usr/local/bin/chrome-devtools-mcp"].find((p) => existsSync9(p));
+  const bin = ["/usr/bin/chrome-devtools-mcp", "/usr/local/bin/chrome-devtools-mcp"].find((p) => existsSync10(p));
   const npxOk = spawnSync3("npx", ["--version"], { timeout: 8000 }).error === undefined;
   const devtoolsOk = Boolean(bin) || npxOk;
   out.push({
@@ -17009,12 +17009,12 @@ $r = openai.chat.completions.create(['messages' => [['role' => 'user', 'content'
 });
 
 // src/variants.ts
-import { readFileSync as readFileSync19 } from "node:fs";
-import { join as join19, dirname as dirname4 } from "node:path";
-import { fileURLToPath as fileURLToPath10 } from "node:url";
+import { readFileSync as readFileSync20 } from "node:fs";
+import { join as join20, dirname as dirname5 } from "node:path";
+import { fileURLToPath as fileURLToPath11 } from "node:url";
 function loadVariants() {
   try {
-    const doc = JSON.parse(readFileSync19(join19(__dirname4, "..", "intelligence", "variants.json"), "utf8"));
+    const doc = JSON.parse(readFileSync20(join20(__dirname5, "..", "intelligence", "variants.json"), "utf8"));
     return doc.variants ?? [];
   } catch {
     return [];
@@ -17065,18 +17065,18 @@ function variantCoverageText() {
   return lines.join(`
 `);
 }
-var __dirname4, CROSS_FILE_ONLY;
+var __dirname5, CROSS_FILE_ONLY;
 var init_variants = __esm(() => {
   init_complex_bugs();
-  __dirname4 = dirname4(fileURLToPath10(import.meta.url));
+  __dirname5 = dirname5(fileURLToPath11(import.meta.url));
   CROSS_FILE_ONLY = new Set(["priv_esc"]);
 });
 
 // src/sync.ts
-import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync8, readFileSync as readFileSync25, readdirSync as readdirSync7, statSync as statSync4, rmSync as rmSync4 } from "node:fs";
-import { join as join23 } from "node:path";
+import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync8, readFileSync as readFileSync26, readdirSync as readdirSync7, statSync as statSync4, rmSync as rmSync4 } from "node:fs";
+import { join as join24 } from "node:path";
 import { homedir as homedir10 } from "node:os";
-import { fileURLToPath as fileURLToPath12 } from "node:url";
+import { fileURLToPath as fileURLToPath13 } from "node:url";
 import { spawnSync as spawnSync4 } from "node:child_process";
 function dirExists(p) {
   try {
@@ -17091,7 +17091,7 @@ function countFiles(dir) {
     const walk = (d) => {
       for (const e of readdirSync7(d, { withFileTypes: true })) {
         if (e.isDirectory())
-          walk(join23(d, e.name));
+          walk(join24(d, e.name));
         else
           n++;
       }
@@ -17105,8 +17105,8 @@ function countFiles(dir) {
 function syncData() {
   if (!dirExists(DATA_ROOT2))
     mkdirSync9(DATA_ROOT2, { recursive: true });
-  const payloadsPath = join23(DATA_ROOT2, "payloads");
-  const templatesPath = join23(DATA_ROOT2, "templates");
+  const payloadsPath = join24(DATA_ROOT2, "payloads");
+  const templatesPath = join24(DATA_ROOT2, "templates");
   const hasPayloads = dirExists(payloadsPath) && countFiles(payloadsPath) > 0;
   const hasTemplates = dirExists(templatesPath) && countFiles(templatesPath) > 0;
   if (hasPayloads && hasTemplates) {
@@ -17116,8 +17116,8 @@ function syncData() {
       data_root: DATA_ROOT2
     };
   }
-  const localPayloads = join23(ROOT7, "payloads");
-  const localTemplates = join23(ROOT7, "templates");
+  const localPayloads = join24(ROOT7, "payloads");
+  const localTemplates = join24(ROOT7, "templates");
   let payloadsSynced = false;
   let templatesSynced = false;
   if (!hasPayloads && dirExists(localPayloads)) {
@@ -17130,7 +17130,7 @@ function syncData() {
   }
   const gitOk = spawnSync4("git", ["--version"]).status === 0;
   if (gitOk && (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0 || !dirExists(templatesPath) || countFiles(templatesPath) === 0)) {
-    const tmp = join23(DATA_ROOT2, ".tmp-clone");
+    const tmp = join24(DATA_ROOT2, ".tmp-clone");
     if (dirExists(tmp))
       rmSync4(tmp, { recursive: true, force: true });
     const r = spawnSync4("git", ["clone", "--depth", "1", "--filter=blob:none", "--sparse", GITHUB_REPO, tmp], { timeout: 120000 });
@@ -17138,11 +17138,11 @@ function syncData() {
       const sparse = spawnSync4("git", ["-C", tmp, "sparse-checkout", "set", "payloads", "templates"], { timeout: 120000 });
       if (sparse.status === 0) {
         if (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0) {
-          copyDir(join23(tmp, "payloads"), payloadsPath);
+          copyDir(join24(tmp, "payloads"), payloadsPath);
           payloadsSynced = true;
         }
         if (!dirExists(templatesPath) || countFiles(templatesPath) === 0) {
-          copyDir(join23(tmp, "templates"), templatesPath);
+          copyDir(join24(tmp, "templates"), templatesPath);
           templatesSynced = true;
         }
       }
@@ -17164,18 +17164,18 @@ function copyDir(src, dst) {
 function manualCopy(src, dst) {
   mkdirSync9(dst, { recursive: true });
   for (const e of readdirSync7(src, { withFileTypes: true })) {
-    const s = join23(src, e.name);
-    const d = join23(dst, e.name);
+    const s = join24(src, e.name);
+    const d = join24(dst, e.name);
     if (e.isDirectory())
       manualCopy(s, d);
     else
-      writeFileSync8(d, readFileSync25(s));
+      writeFileSync8(d, readFileSync26(s));
   }
 }
 var ROOT7, DATA_ROOT2, GITHUB_REPO = "https://github.com/shinthink/blitzstrike.git";
 var init_sync = __esm(() => {
-  ROOT7 = join23(fileURLToPath12(new URL(".", import.meta.url)), "..");
-  DATA_ROOT2 = process.env.BLITZSTRIKE_DATA ?? join23(homedir10(), ".blitzstrike", "data");
+  ROOT7 = join24(fileURLToPath13(new URL(".", import.meta.url)), "..");
+  DATA_ROOT2 = process.env.BLITZSTRIKE_DATA ?? join24(homedir10(), ".blitzstrike", "data");
 });
 
 // src/update.ts
@@ -17220,15 +17220,15 @@ var init_update = __esm(() => {
 });
 
 // src/release.ts
-import { readFileSync as readFileSync27, existsSync as existsSync13 } from "node:fs";
-import { join as join24 } from "node:path";
-import { fileURLToPath as fileURLToPath13 } from "node:url";
+import { readFileSync as readFileSync28, existsSync as existsSync14 } from "node:fs";
+import { join as join25 } from "node:path";
+import { fileURLToPath as fileURLToPath14 } from "node:url";
 import { execSync as execSync2 } from "node:child_process";
 function validateRelease() {
   const checks = [];
   checks.push({ name: "package.json version", ok: true, detail: VERSION });
   try {
-    const changelog = readFileSync27(join24(ROOT8, "CHANGELOG.md"), "utf8");
+    const changelog = readFileSync28(join25(ROOT8, "CHANGELOG.md"), "utf8");
     const m = changelog.match(/^##\s+\[([0-9]+\.[0-9]+\.[0-9]+)\]/m);
     const changelogVersion = m?.[1] ?? null;
     checks.push({
@@ -17260,22 +17260,22 @@ function validateRelease() {
   return { version: VERSION, checks, consistent: checks.filter((c) => !c.soft).every((c) => c.ok) };
 }
 function lockfilePresent() {
-  return existsSync13(join24(ROOT8, "package-lock.json")) || existsSync13(join24(ROOT8, "bun.lock")) || existsSync13(join24(ROOT8, "bun.lockb"));
+  return existsSync14(join25(ROOT8, "package-lock.json")) || existsSync14(join25(ROOT8, "bun.lock")) || existsSync14(join25(ROOT8, "bun.lockb"));
 }
 var ROOT8;
 var init_release = __esm(() => {
   init_version();
-  ROOT8 = join24(fileURLToPath13(new URL(".", import.meta.url)), "..");
+  ROOT8 = join25(fileURLToPath14(new URL(".", import.meta.url)), "..");
 });
 
 // src/dependency.ts
-import { readFileSync as readFileSync28 } from "node:fs";
-import { join as join25 } from "node:path";
-import { fileURLToPath as fileURLToPath14 } from "node:url";
+import { readFileSync as readFileSync29 } from "node:fs";
+import { join as join26 } from "node:path";
+import { fileURLToPath as fileURLToPath15 } from "node:url";
 function checkDependencies() {
   let pkg = {};
   try {
-    pkg = JSON.parse(readFileSync28(join25(ROOT9, "package.json"), "utf8"));
+    pkg = JSON.parse(readFileSync29(join26(ROOT9, "package.json"), "utf8"));
   } catch {
     return { install_scripts: [], git_dependencies: [], total_dependencies: 0, safe: false };
   }
@@ -17298,14 +17298,14 @@ function checkDependencies() {
 }
 var ROOT9;
 var init_dependency = __esm(() => {
-  ROOT9 = join25(fileURLToPath14(new URL(".", import.meta.url)), "..");
+  ROOT9 = join26(fileURLToPath15(new URL(".", import.meta.url)), "..");
 });
 
 // src/cli.ts
-import { readFileSync as readFileSync29, existsSync as existsSync14, writeFileSync as writeFileSync9, mkdirSync as mkdirSync10 } from "node:fs";
-import { join as join26, dirname as dirname5 } from "node:path";
+import { readFileSync as readFileSync30, existsSync as existsSync15, writeFileSync as writeFileSync9, mkdirSync as mkdirSync10 } from "node:fs";
+import { join as join27, dirname as dirname6 } from "node:path";
 import { homedir as homedir11 } from "node:os";
-import { fileURLToPath as fileURLToPath15 } from "node:url";
+import { fileURLToPath as fileURLToPath16 } from "node:url";
 import { spawnSync as spawnSync5 } from "node:child_process";
 function which(cmd) {
   return spawnSync5("sh", ["-c", 'command -v "$1" >/dev/null 2>&1', "sh", cmd]).status === 0;
@@ -17348,7 +17348,7 @@ async function runDoctor() {
     detail: h1 ? `X-HackerOne-Research: ${h1}` : "H1_USERNAME not set",
     fix: h1 ? undefined : "export H1_USERNAME=<your-hackerone-username> (adds X-HackerOne-Research to outbound requests)"
   });
-  const dataOk = existsSync14(join26(ROOT10, "chains.json")) && existsSync14(join26(ROOT10, "tools-catalog.json"));
+  const dataOk = existsSync15(join27(ROOT10, "chains.json")) && existsSync15(join27(ROOT10, "tools-catalog.json"));
   issues.push({
     name: "Data layers (chains + tools-catalog)",
     status: dataOk ? "ok" : "fail",
@@ -17399,29 +17399,29 @@ BlitzStrike — ${verdict}`);
 function resolveCommand() {
   if (which("blitzstrike"))
     return { command: "blitzstrike", args: ["serve", "--mcp"] };
-  const src = join26(ROOT10, "src", "index.ts");
-  if (which("bun") && existsSync14(src))
+  const src = join27(ROOT10, "src", "index.ts");
+  if (which("bun") && existsSync15(src))
     return { command: "bun", args: ["run", src, "serve", "--mcp"] };
   if (which("npx"))
     return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
   if (which("bunx"))
     return { command: "bunx", args: ["blitzstrike", "serve", "--mcp"] };
-  const dist = join26(ROOT10, "dist", "index.js");
-  if (existsSync14(dist))
+  const dist = join27(ROOT10, "dist", "index.js");
+  if (existsSync15(dist))
     return { command: "bun", args: [dist, "serve", "--mcp"] };
   return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
 }
 function readJson(p) {
   try {
-    return JSON.parse(readFileSync29(p, "utf8"));
+    return JSON.parse(readFileSync30(p, "utf8"));
   } catch {
     return null;
   }
 }
 function jsonMcpServersWrite(p) {
   return (command, args) => {
-    const dir = dirname5(p);
-    if (!existsSync14(dir))
+    const dir = dirname6(p);
+    if (!existsSync15(dir))
       mkdirSync10(dir, { recursive: true });
     const existing = readJson(p) ?? {};
     existing.mcpServers = {
@@ -17433,8 +17433,8 @@ function jsonMcpServersWrite(p) {
 }
 function opencodeWrite(p) {
   return (command, args) => {
-    const dir = dirname5(p);
-    if (!existsSync14(dir))
+    const dir = dirname6(p);
+    if (!existsSync15(dir))
       mkdirSync10(dir, { recursive: true });
     const existing = readJson(p) ?? {};
     existing.mcp = {
@@ -17446,26 +17446,26 @@ function opencodeWrite(p) {
   };
 }
 function copyOpenCodeAgents() {
-  const srcDir = join26(ROOT10, "opencode-agents");
-  const dstDir = join26(homedir11(), ".config", "opencode", "agents");
-  if (!existsSync14(srcDir))
+  const srcDir = join27(ROOT10, "opencode-agents");
+  const dstDir = join27(homedir11(), ".config", "opencode", "agents");
+  if (!existsSync15(srcDir))
     return;
-  if (!existsSync14(dstDir))
+  if (!existsSync15(dstDir))
     mkdirSync10(dstDir, { recursive: true });
   for (const f of ["Blitz Strike.md", "Blitz.md", "Eagle Eye.md", "Strike.md"]) {
-    const src = join26(srcDir, f);
-    const dst = join26(dstDir, f);
-    if (existsSync14(src)) {
-      writeFileSync9(dst, readFileSync29(src, "utf8"));
+    const src = join27(srcDir, f);
+    const dst = join27(dstDir, f);
+    if (existsSync15(src)) {
+      writeFileSync9(dst, readFileSync30(src, "utf8"));
     }
   }
 }
 function codexWrite(p) {
   return (command, args) => {
-    const dir = dirname5(p);
-    if (!existsSync14(dir))
+    const dir = dirname6(p);
+    if (!existsSync15(dir))
       mkdirSync10(dir, { recursive: true });
-    let existing = existsSync14(p) ? readFileSync29(p, "utf8") : "";
+    let existing = existsSync15(p) ? readFileSync30(p, "utf8") : "";
     if (!existing.trimEnd().endsWith(`
 `))
       existing += `
@@ -17481,10 +17481,10 @@ args = ${JSON.stringify(args)}
 }
 function hermesWrite(p) {
   return (command, args) => {
-    const dir = dirname5(p);
-    if (!existsSync14(dir))
+    const dir = dirname6(p);
+    if (!existsSync15(dir))
       mkdirSync10(dir, { recursive: true });
-    let existing = existsSync14(p) ? readFileSync29(p, "utf8") : "";
+    let existing = existsSync15(p) ? readFileSync30(p, "utf8") : "";
     existing = existing.replace(/^  blitzstrike:\n(?:    .*\n?)*/m, "");
     if (!existing.trimEnd().endsWith(`
 `))
@@ -17511,74 +17511,74 @@ mcp_servers:
 function detectAgents() {
   const home = homedir11();
   const agents = [];
-  const claudeJson = join26(home, ".claude.json");
+  const claudeJson = join27(home, ".claude.json");
   agents.push({
     name: "Claude Code",
     detectPath: claudeJson,
-    installed: () => existsSync14(claudeJson) || which("claude"),
+    installed: () => existsSync15(claudeJson) || which("claude"),
     write: jsonMcpServersWrite(claudeJson)
   });
-  const claudeDesktop = join26(home, ".config", "Claude", "claude_desktop_config.json");
+  const claudeDesktop = join27(home, ".config", "Claude", "claude_desktop_config.json");
   agents.push({
     name: "Claude Desktop",
     detectPath: claudeDesktop,
-    installed: () => existsSync14(claudeDesktop),
+    installed: () => existsSync15(claudeDesktop),
     write: jsonMcpServersWrite(claudeDesktop)
   });
-  const cursor = join26(home, ".cursor", "mcp.json");
+  const cursor = join27(home, ".cursor", "mcp.json");
   agents.push({
     name: "Cursor",
     detectPath: cursor,
-    installed: () => existsSync14(join26(home, ".cursor")) || which("cursor"),
+    installed: () => existsSync15(join27(home, ".cursor")) || which("cursor"),
     write: jsonMcpServersWrite(cursor)
   });
-  const opencode = join26(home, ".config", "opencode", "opencode.jsonc");
+  const opencode = join27(home, ".config", "opencode", "opencode.jsonc");
   agents.push({
     name: "OpenCode",
     detectPath: opencode,
-    installed: () => existsSync14(join26(home, ".config", "opencode")) || which("opencode"),
+    installed: () => existsSync15(join27(home, ".config", "opencode")) || which("opencode"),
     write: opencodeWrite(opencode)
   });
-  const codex = join26(home, ".codex", "config.toml");
+  const codex = join27(home, ".codex", "config.toml");
   agents.push({
     name: "Codex",
     detectPath: codex,
-    installed: () => existsSync14(join26(home, ".codex")) || which("codex"),
+    installed: () => existsSync15(join27(home, ".codex")) || which("codex"),
     write: codexWrite(codex)
   });
-  const hermes = join26(home, ".hermes", "config.yaml");
+  const hermes = join27(home, ".hermes", "config.yaml");
   agents.push({
     name: "Hermes",
     detectPath: hermes,
-    installed: () => existsSync14(join26(home, ".hermes")) || which("hermes"),
+    installed: () => existsSync15(join27(home, ".hermes")) || which("hermes"),
     write: hermesWrite(hermes)
   });
-  const gemini = join26(home, ".gemini", "settings.json");
+  const gemini = join27(home, ".gemini", "settings.json");
   agents.push({
     name: "Gemini CLI",
     detectPath: gemini,
-    installed: () => existsSync14(join26(home, ".gemini")) || which("gemini"),
+    installed: () => existsSync15(join27(home, ".gemini")) || which("gemini"),
     write: jsonMcpServersWrite(gemini)
   });
-  const windsurf = join26(home, ".codeium", "windsurf", "mcp_config.json");
+  const windsurf = join27(home, ".codeium", "windsurf", "mcp_config.json");
   agents.push({
     name: "Windsurf",
     detectPath: windsurf,
-    installed: () => existsSync14(join26(home, ".codeium")) || which("windsurf"),
+    installed: () => existsSync15(join27(home, ".codeium")) || which("windsurf"),
     write: jsonMcpServersWrite(windsurf)
   });
-  const copilot = join26(home, ".copilot", "mcp.json");
+  const copilot = join27(home, ".copilot", "mcp.json");
   agents.push({
     name: "Copilot",
     detectPath: copilot,
-    installed: () => existsSync14(join26(home, ".copilot")),
+    installed: () => existsSync15(join27(home, ".copilot")),
     write: jsonMcpServersWrite(copilot)
   });
-  const cline = join26(home, ".cline", "mcp_settings.json");
+  const cline = join27(home, ".cline", "mcp_settings.json");
   agents.push({
     name: "Cline",
     detectPath: cline,
-    installed: () => existsSync14(join26(home, ".cline")),
+    installed: () => existsSync15(join27(home, ".cline")),
     write: jsonMcpServersWrite(cline)
   });
   return agents;
@@ -17696,7 +17696,7 @@ var init_cli = __esm(() => {
   init_release();
   init_dependency();
   init_mcp_status();
-  ROOT10 = join26(fileURLToPath15(new URL(".", import.meta.url)), "..");
+  ROOT10 = join27(fileURLToPath16(new URL(".", import.meta.url)), "..");
 });
 
 // node_modules/zod/v3/helpers/util.js
@@ -32334,7 +32334,7 @@ class StdioServerTransport {
 
 // src/server.ts
 init_scanner();
-import { readFileSync as readFileSync26 } from "node:fs";
+import { readFileSync as readFileSync27 } from "node:fs";
 
 // src/recon.ts
 var TIMEOUT_MS = 25000;
@@ -32417,7 +32417,7 @@ async function nvdLookup(cveId) {
 
 // src/orchestrator.ts
 init_scanner();
-import { readFileSync as readFileSync9, existsSync as existsSync7, statSync as statSync2 } from "node:fs";
+import { readFileSync as readFileSync9, existsSync as existsSync8, statSync as statSync2 } from "node:fs";
 import { join as join11 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 
@@ -33181,6 +33181,8 @@ function resolveFinding(finding, verdict) {
 
 // src/hash.ts
 import { createHash as createHash3 } from "node:crypto";
+import { createReadStream, existsSync as existsSync4 } from "node:fs";
+import { createInterface } from "node:readline";
 var COMMON_PASSWORDS = [
   "password",
   "123456",
@@ -33211,6 +33213,14 @@ var COMMON_PASSWORDS = [
   "P@ssw0rd",
   "qwertyuiop"
 ];
+var AUTOLOAD_WORDLISTS = [
+  "/usr/share/wordlists/rockyou.txt",
+  "/opt/seclists/Passwords/Leaked-Databases/rockyou-70.txt",
+  "/opt/seclists/Passwords/Leaked-Databases/rockyou-35.txt",
+  "/opt/seclists/Passwords/Leaked-Databases/rockyou-40.txt",
+  "/opt/seclists/Passwords/Common-Credentials/100k-most-used-passwords-NCSC.txt",
+  "/opt/seclists/Passwords/Common-Credentials/10k-most-common.txt"
+];
 function identifyHash(hash) {
   if (/^\$2[aby]\$\d+\$/.test(hash))
     return "bcrypt";
@@ -33243,31 +33253,141 @@ var HASHCAT_MODE = {
   sha512crypt: "1800",
   ntlm: "1000"
 };
-async function crackHash(hash, extra = []) {
+function hashMatches(type, pw, hash) {
+  const target = hash.toLowerCase();
+  if (type === "md5")
+    return createHash3("md5").update(pw).digest("hex") === target;
+  if (type === "sha1")
+    return createHash3("sha1").update(pw).digest("hex") === target;
+  if (type === "sha256")
+    return createHash3("sha256").update(pw).digest("hex") === target;
+  if (type === "sha512")
+    return createHash3("sha512").update(pw).digest("hex") === target;
+  if (type === "ntlm") {
+    const md4 = (buf) => {
+      const pad = (s) => {
+        const len = s.length;
+        const bitLen = len * 8;
+        const out = Buffer.concat([s, Buffer.from([128])]);
+        const mod = out.length % 64;
+        const padLen = mod < 56 ? 56 - mod : 120 - mod;
+        const padded = Buffer.concat([out, Buffer.alloc(padLen)]);
+        const lenBuf = Buffer.alloc(8);
+        lenBuf.writeUInt32LE(bitLen >>> 0, 0);
+        lenBuf.writeUInt32LE(Math.floor(bitLen / 4294967296), 4);
+        return Buffer.concat([padded, lenBuf]);
+      };
+      const rotl = (x, n) => (x << n | x >>> 32 - n) >>> 0;
+      const F = (x, y, z) => x & y | ~x & z;
+      const G = (x, y, z) => x & y | x & z | y & z;
+      const H = (x, y, z) => x ^ y ^ z;
+      const msg = pad(buf);
+      let a0 = 1732584193, b0 = 4023233417, c0 = 2562383102, d0 = 271733878;
+      for (let i = 0;i < msg.length; i += 64) {
+        const X = [];
+        for (let j = 0;j < 16; j++)
+          X[j] = msg.readUInt32LE(i + j * 4);
+        let A = a0, B = b0, C = c0, D = d0;
+        for (let r = 0;r < 16; r++) {
+          const k = r;
+          const s = [3, 7, 11, 19][r % 4];
+          const order = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15];
+          A = rotl(A + F(B, C, D) + X[order[k]] + 0 >>> 0, s);
+          [A, B, C, D] = [D, A, B, C];
+        }
+        for (let r = 0;r < 16; r++) {
+          const order = [0, 4, 8, 12, 1, 5, 9, 13, 2, 6, 10, 14, 3, 7, 11, 15];
+          const s = [3, 5, 9, 13][r % 4];
+          A = rotl(A + G(B, C, D) + X[order[r]] + 1518500249 >>> 0, s);
+          [A, B, C, D] = [D, A, B, C];
+        }
+        for (let r = 0;r < 16; r++) {
+          const order = [0, 8, 4, 12, 2, 10, 6, 14, 1, 9, 5, 13, 3, 11, 7, 15];
+          const s = [3, 9, 11, 15][r % 4];
+          A = rotl(A + H(B, C, D) + X[order[r]] + 1859775393 >>> 0, s);
+          [A, B, C, D] = [D, A, B, C];
+        }
+        a0 = a0 + A >>> 0;
+        b0 = b0 + B >>> 0;
+        c0 = c0 + C >>> 0;
+        d0 = d0 + D >>> 0;
+      }
+      const le = (x) => Buffer.from([x & 255, x >>> 8 & 255, x >>> 16 & 255, x >>> 24 & 255]);
+      return Buffer.concat([le(a0), le(b0), le(c0), le(d0)]).toString("hex");
+    };
+    const utf16le = Buffer.from(pw, "utf16le");
+    return md4(utf16le) === target;
+  }
+  return false;
+}
+async function crackWordlists(hash, type, paths, maxCandidates) {
+  let checked = 0;
+  for (const p of paths) {
+    if (!existsSync4(p))
+      continue;
+    const stream = createReadStream(p, { encoding: "utf8" });
+    const rl = createInterface({ input: stream, crlfDelay: Infinity });
+    let found = null;
+    for await (const line of rl) {
+      if (found)
+        break;
+      const pw = line.endsWith("\r") ? line.slice(0, -1) : line;
+      if (!pw)
+        continue;
+      checked += 1;
+      if (checked > maxCandidates)
+        break;
+      if (hashMatches(type, pw, hash))
+        found = pw;
+    }
+    stream.destroy();
+    if (found)
+      return { password: found, checked };
+    if (checked > maxCandidates)
+      break;
+  }
+  return { password: null, checked };
+}
+async function crackHash(hash, extra = [], opts = {}) {
   const type = identifyHash(hash);
-  const wordlist = [...new Set([...extra, ...COMMON_PASSWORDS])];
-  const matches = [];
-  for (const pw of wordlist) {
-    try {
-      if (type === "bcrypt") {
-        const verify = globalThis.Bun;
-        if (verify?.password?.verifySync?.(pw, hash))
-          matches.push(pw);
-      } else {
-        const algo = type === "md5" ? "md5" : type === "sha1" ? "sha1" : type === "sha256" ? "sha256" : "sha512";
-        if (["md5", "sha1", "sha256", "sha512"].includes(type)) {
-          if (createHash3(algo).update(pw).digest("hex").toLowerCase() === hash.toLowerCase())
-            matches.push(pw);
-        }
-      }
-    } catch {}
+  const maxCandidates = opts.maxCandidates ?? 5000000;
+  const fast = [...new Set([...extra, ...COMMON_PASSWORDS])];
+  let matched = "";
+  for (const pw of fast) {
+    if (hashMatches(type, pw, hash)) {
+      matched = pw;
+      break;
+    }
+  }
+  if (matched) {
+    return {
+      type,
+      cracked: true,
+      matches: [matched],
+      source: "common",
+      recommendation: `CRACKED — authenticate with '${matched}' and continue the chain (login → dashboard → privileged actions).`
+    };
+  }
+  const explicit = opts.wordlist ? Array.isArray(opts.wordlist) ? opts.wordlist : [opts.wordlist] : [];
+  const paths = [...new Set([...explicit, ...AUTOLOAD_WORDLISTS])];
+  const { password, checked } = await crackWordlists(hash, type, paths, maxCandidates);
+  if (password) {
+    return {
+      type,
+      cracked: true,
+      matches: [password],
+      source: "wordlist",
+      candidates_checked: checked,
+      recommendation: `CRACKED from wordlist — authenticate with '${password}' and continue the chain (login → dashboard → privileged actions).`
+    };
   }
   const mode = HASHCAT_MODE[type];
   return {
     type,
-    cracked: matches.length > 0,
-    matches,
-    recommendation: matches.length > 0 ? `CRACKED — authenticate with '${matches[0]}' and continue the chain (login → dashboard → privileged actions).` : mode ? `Not in the built-in common list. Full crack: hashcat -m ${mode} -a 0 <hashes.txt> <wordlist> (bcrypt cost 12 needs GPU + time). Reuse the credential if it matches another account's hash (password reuse).` : "Unknown hash format — save it and identify manually before cracking."
+    cracked: false,
+    matches: [],
+    candidates_checked: checked,
+    recommendation: mode ? `Not in the built-in common list or ${checked} wordlist candidates. Full crack: hashcat -m ${mode} -a 0 <hashes.txt> <wordlist> (bcrypt cost 12 needs GPU + time). Pass a target-specific wordlist via the wordlist arg (e.g. company names, usernames, pattern guesses). Reuse the credential if it matches another account's hash (password reuse).` : "Unknown hash format — save it and identify manually before cracking."
   };
 }
 
@@ -33447,7 +33567,7 @@ async function browserValidate(check, target, payload) {
 
 // src/devtools.ts
 import { spawn as spawn2, spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync4, readdirSync as readdirSync3 } from "node:fs";
+import { existsSync as existsSync5, readdirSync as readdirSync3 } from "node:fs";
 import { join as join7 } from "node:path";
 import { homedir as homedir4 } from "node:os";
 function mcpClient(command, args) {
@@ -33521,17 +33641,17 @@ function findChromium() {
   for (const c of candidates) {
     for (const dir of ["/usr/bin", "/usr/local/bin", "/opt/google/chrome"]) {
       const p = join7(dir, c);
-      if (existsSync4(p))
+      if (existsSync5(p))
         return p;
     }
   }
   const pw = join7(homedir4(), ".cache", "ms-playwright");
-  if (existsSync4(pw)) {
+  if (existsSync5(pw)) {
     for (const d of readdirSync3(pw)) {
       if (!d.startsWith("chromium"))
         continue;
       const full = join7(pw, d, "chrome-linux64", "chrome");
-      if (existsSync4(full))
+      if (existsSync5(full))
         return full;
     }
   }
@@ -33539,7 +33659,7 @@ function findChromium() {
 }
 function chromeDevtoolsCommand() {
   for (const c of ["/usr/bin/chrome-devtools-mcp", "/usr/local/bin/chrome-devtools-mcp"]) {
-    if (existsSync4(c))
+    if (existsSync5(c))
       return { command: c, args: [] };
   }
   const npx = spawnSync2("npx", ["--version"], { timeout: 8000 });
@@ -33851,12 +33971,12 @@ function uniqueFindings(findings) {
 }
 
 // src/intel.ts
-import { readFileSync as readFileSync8, existsSync as existsSync6 } from "node:fs";
+import { readFileSync as readFileSync8, existsSync as existsSync7 } from "node:fs";
 import { join as join9 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 
 // src/intelligence.ts
-import { readFileSync as readFileSync7, appendFileSync as appendFileSync3, mkdirSync as mkdirSync4, existsSync as existsSync5 } from "node:fs";
+import { readFileSync as readFileSync7, appendFileSync as appendFileSync3, mkdirSync as mkdirSync4, existsSync as existsSync6 } from "node:fs";
 import { join as join8 } from "node:path";
 import { createHash as createHash4 } from "node:crypto";
 import { homedir as homedir5 } from "node:os";
@@ -33882,14 +34002,14 @@ function sinkToVector(sinkType) {
   return SINK_TO_VECTOR[sinkType.toLowerCase()] ?? sinkType.toLowerCase();
 }
 function ensureDir2() {
-  if (!existsSync5(HOME_DIR3))
+  if (!existsSync6(HOME_DIR3))
     mkdirSync4(HOME_DIR3, { recursive: true });
 }
 function dedupHash2(vector, tech, target, outcome) {
   return createHash4("sha256").update(`${vector}\x00${tech}\x00${target}\x00${outcome}`).digest("hex").slice(0, 16);
 }
 function loadIntel() {
-  if (!existsSync5(INTEL_PATH))
+  if (!existsSync6(INTEL_PATH))
     return [];
   try {
     const out = [];
@@ -34041,7 +34161,7 @@ var ROOT3 = join9(fileURLToPath4(new URL(".", import.meta.url)), "..");
 var INTEL = join9(ROOT3, "intelligence");
 function loadJson(name) {
   const p = join9(INTEL, `${name}.json`);
-  if (!existsSync6(p))
+  if (!existsSync7(p))
     return null;
   try {
     return JSON.parse(readFileSync8(p, "utf8"));
@@ -34328,12 +34448,12 @@ var PACKAGE_PAYLOADS = join9(ROOT3, "payloads");
 var PACKAGE_TEMPLATES = join9(ROOT3, "templates");
 var DATA_ROOT = process.env.BLITZSTRIKE_DATA ?? join9(homedir6(), ".blitzstrike", "data");
 function payloadsDir() {
-  if (existsSync6(PACKAGE_PAYLOADS))
+  if (existsSync7(PACKAGE_PAYLOADS))
     return PACKAGE_PAYLOADS;
   return join9(DATA_ROOT, "payloads");
 }
 function templatesDir() {
-  if (existsSync6(PACKAGE_TEMPLATES))
+  if (existsSync7(PACKAGE_TEMPLATES))
     return PACKAGE_TEMPLATES;
   return join9(DATA_ROOT, "templates");
 }
@@ -35941,7 +36061,7 @@ function classifyTarget(target) {
   if (/^https?:\/\//i.test(target))
     return { kind: "live", target };
   try {
-    if (existsSync7(target) && (statSync2(target).isDirectory() || statSync2(target).isFile())) {
+    if (existsSync8(target) && (statSync2(target).isDirectory() || statSync2(target).isFile())) {
       return { kind: "source", target };
     }
   } catch {}
@@ -36082,7 +36202,7 @@ function runEngagement(target, scope = "", mode = "bug-bounty", maxFiles = 2000,
   };
   const isPath = (() => {
     try {
-      return existsSync7(target) && (statSync2(target).isDirectory() || statSync2(target).isFile());
+      return existsSync8(target) && (statSync2(target).isDirectory() || statSync2(target).isFile());
     } catch {
       return false;
     }
@@ -57558,7 +57678,7 @@ function analyzePatchFiles(oldPath, newPath, language) {
 }
 
 // src/frameworks.ts
-import { readFileSync as readFileSync16, existsSync as existsSync8 } from "node:fs";
+import { readFileSync as readFileSync16, existsSync as existsSync9 } from "node:fs";
 import { join as join15 } from "node:path";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
 var ROOT4 = join15(fileURLToPath7(new URL(".", import.meta.url)), "..");
@@ -57568,7 +57688,7 @@ function load2() {
   if (cache)
     return cache;
   const p = join15(INTEL2, "frameworks.json");
-  if (!existsSync8(p))
+  if (!existsSync9(p))
     return null;
   try {
     cache = JSON.parse(readFileSync16(p, "utf8"));
@@ -58253,7 +58373,7 @@ function submissionGate(input) {
 // src/git-history.ts
 init_complex_bugs();
 import { execFileSync as execFileSync4 } from "node:child_process";
-import { existsSync as existsSync10 } from "node:fs";
+import { existsSync as existsSync11 } from "node:fs";
 import { join as join17 } from "node:path";
 function parseDeletions(output) {
   const out = [];
@@ -58283,7 +58403,7 @@ function blobBeforeDeletion(root, commit, path) {
 function scanGitHistory(root, opts) {
   const limit = opts?.limit ?? 30;
   const findings = [];
-  if (!existsSync10(join17(root, ".git"))) {
+  if (!existsSync11(join17(root, ".git"))) {
     return { root, is_git_repo: false, total: 0, findings: [], error: "not a git repository (no .git dir)" };
   }
   if (opts?.secretPattern) {
@@ -58429,6 +58549,103 @@ async function validateLeakedKey(input) {
   };
 }
 
+// src/hackbot-arena.ts
+import { readFileSync as readFileSync18 } from "node:fs";
+import { join as join18, dirname as dirname3 } from "node:path";
+import { fileURLToPath as fileURLToPath9 } from "node:url";
+var __dirname3 = dirname3(fileURLToPath9(import.meta.url));
+function load4() {
+  try {
+    return JSON.parse(readFileSync18(join18(__dirname3, "..", "intelligence", "hackbot-arena.json"), "utf8"));
+  } catch {
+    return { total: 0, flag_format: "FLAG{nusasec-<32 hex>}", labs: [] };
+  }
+}
+var VECTOR_MAP = [
+  { re: /jwt|algorithm confusion|rs256|hs256/i, vectors: ["jwt"], detectors: ["missing_authz"], chains: ["jwt"], tools: ["jwt_analyze", "live_recon"] },
+  { re: /ssrf|server-side request/i, vectors: ["ssrf"], detectors: ["ssrf"], chains: ["ssrf"], tools: ["live_recon", "blind_oracle", "active_scan"] },
+  { re: /sql injection|sqli|postgresql|sql/i, vectors: ["sql_injection"], detectors: ["sql_injection"], chains: ["sql_injection"], tools: ["live_recon", "blind_oracle", "active_scan"] },
+  { re: /ssti|template injection|liquid|jinja|twig/i, vectors: ["ssti"], detectors: ["ssti"], chains: ["ssti"], tools: ["live_recon", "blind_oracle"] },
+  { re: /command injection|os command|command execution/i, vectors: ["command_injection"], detectors: ["command_injection"], chains: ["command_injection"], tools: ["live_recon", "blind_oracle"] },
+  { re: /idor|bola|authorization|broken function|role|membership|ownership|entitlement|directory search|excessive data|data exposure|harvest/i, vectors: ["broken_object_level_authorization"], detectors: ["missing_authz"], chains: ["idor"], tools: ["live_recon", "active_scan", "param_precedence"] },
+  { re: /graphql/i, vectors: ["graphql_exposure"], detectors: ["graphql_exposure", "sql_injection"], chains: ["graphql"], tools: ["live_recon", "active_scan"] },
+  { re: /cache/i, vectors: ["web_cache_deception"], detectors: [], chains: ["cache_deception"], tools: ["cache_gap", "live_recon"] },
+  { re: /credential|key|token|bearer|secret|leak|websocket|rum|api key/i, vectors: ["hardcoded_secret"], detectors: ["hardcoded_secret"], chains: ["secret_leak"], tools: ["live_recon", "drive_devtools", "scan_git_history"] },
+  { re: /rate.limit|batching|otp/i, vectors: ["business_logic"], detectors: [], chains: ["rate_limit_bypass"], tools: ["race_test", "active_scan"] },
+  { re: /mass assignment|self.regist|admin account|user creation|scope/i, vectors: ["mass_assignment"], detectors: ["mass_assignment", "missing_authz"], chains: ["mass_assignment"], tools: ["live_recon", "active_scan"] },
+  { re: /deserialization|rce|workflow|execution/i, vectors: ["code_execution"], detectors: ["deserialization"], chains: ["deserialization"], tools: ["live_recon", "active_scan"] }
+];
+function mapLab(lab) {
+  const out = { vectors: [], detectors: [], chains: [], tools: [] };
+  for (const m of VECTOR_MAP) {
+    if (m.re.test(lab.vuln_class)) {
+      out.vectors.push(...m.vectors);
+      out.detectors.push(...m.detectors);
+      out.chains.push(...m.chains);
+      out.tools.push(...m.tools);
+    }
+  }
+  out.vectors = [...new Set(out.vectors)];
+  out.detectors = [...new Set(out.detectors)];
+  out.chains = [...new Set(out.chains)];
+  out.tools = [...new Set(out.tools)];
+  return out;
+}
+function findByLab(labId) {
+  const id = labId.toLowerCase().replace(/[^a-z0-9]/g, "");
+  return load4().labs.find((l) => l.id.toLowerCase() === id || l.id.toLowerCase() === `labs${id}`) ?? null;
+}
+function hackbotArenaList() {
+  const doc = load4();
+  return {
+    arena: "Hackbot-Arena (NusaSec)",
+    total: doc.total,
+    flag_format: doc.flag_format,
+    note: "Port = 8080 + lab number (labs01 -> 8081 … labs30 -> 8110). Each lab has a solver/ reference exploit + judge.success_when solve criteria.",
+    labs: doc.labs.map((l) => ({ id: l.id, name: l.name, difficulty: l.difficulty, port: l.port, vuln_class: l.vuln_class, stack: l.stack }))
+  };
+}
+function hackbotArenaBrief(labId) {
+  const lab = findByLab(labId);
+  if (!lab)
+    return { error: `unknown lab '${labId}'`, hint: "use hackbot_arena_list() to see all 30 labs" };
+  const plan = mapLab(lab);
+  return {
+    id: lab.id,
+    name: lab.name,
+    difficulty: lab.difficulty,
+    target: `http://localhost:${lab.port}`,
+    vuln_class: lab.vuln_class,
+    stack: lab.stack,
+    flag_format: load4().flag_format,
+    attack_plan: {
+      vectors: plan.vectors,
+      detectors: plan.detectors,
+      chains: plan.chains,
+      tools: plan.tools
+    },
+    hint: `Start with live_recon(target) to fingerprint, then drive the ${plan.chains.join(" + ") || "detected"} chain. Verify every step live (strike_verify / browser_validate) and recover the flag. Flag format: ${load4().flag_format}.`
+  };
+}
+function hackbotArenaCoverage() {
+  const doc = load4();
+  const rows = doc.labs.map((l) => {
+    const plan = mapLab(l);
+    return { id: l.id, name: l.name, vuln_class: l.vuln_class, vectors: plan.vectors, detectors: plan.detectors, chains: plan.chains };
+  });
+  const withVector = rows.filter((r) => r.vectors.length > 0).length;
+  const withDetector = rows.filter((r) => r.detectors.length > 0).length;
+  return {
+    arena: "Hackbot-Arena (NusaSec)",
+    total_labs: doc.total,
+    labs_with_mapped_vector: withVector,
+    labs_with_detector_coverage: withDetector,
+    coverage_ratio: Number((withVector / doc.total).toFixed(2)),
+    note: "A mapped vector/detector means Blitz Strike has the deterministic tooling to drive that vuln class; the agent still has to execute the chain + recover the flag.",
+    rows
+  };
+}
+
 // src/severity.ts
 var VRT_MAP = {
   sql_injection: { vrt: "injection > sql_injection", priority: "P1", severity: "critical", rationale: "SQL injection reaches sensitive data or enables admin takeover." },
@@ -58493,13 +58710,13 @@ function listSeverityMap() {
 }
 
 // src/datarefresh.ts
-import { readFileSync as readFileSync18 } from "node:fs";
-import { join as join18, dirname as dirname3 } from "node:path";
-import { fileURLToPath as fileURLToPath9 } from "node:url";
-var __dirname3 = dirname3(fileURLToPath9(import.meta.url));
+import { readFileSync as readFileSync19 } from "node:fs";
+import { join as join19, dirname as dirname4 } from "node:path";
+import { fileURLToPath as fileURLToPath10 } from "node:url";
+var __dirname4 = dirname4(fileURLToPath10(import.meta.url));
 function loadJson2(rel) {
   try {
-    return JSON.parse(readFileSync18(join18(__dirname3, "..", rel), "utf8"));
+    return JSON.parse(readFileSync19(join19(__dirname4, "..", rel), "utf8"));
   } catch {
     return null;
   }
@@ -58534,18 +58751,18 @@ init_verify_harness();
 init_variants();
 
 // src/benchmark.ts
-import { readFileSync as readFileSync20, readdirSync as readdirSync5, writeFileSync as writeFileSync6, rmSync as rmSync3, mkdirSync as mkdirSync7 } from "node:fs";
-import { join as join20 } from "node:path";
-import { fileURLToPath as fileURLToPath11 } from "node:url";
+import { readFileSync as readFileSync21, readdirSync as readdirSync5, writeFileSync as writeFileSync6, rmSync as rmSync3, mkdirSync as mkdirSync7 } from "node:fs";
+import { join as join21 } from "node:path";
+import { fileURLToPath as fileURLToPath12 } from "node:url";
 import { tmpdir as tmpdir3, homedir as homedir8 } from "node:os";
 init_complex_bugs();
-var ROOT5 = join20(fileURLToPath11(new URL(".", import.meta.url)), "..");
-var CORPUS = join20(ROOT5, "bench", "corpus");
-var CAPTURED_CORPUS_DIR = process.env.BLITZSTRIKE_CORPUS_DIR ?? join20(homedir8(), ".blitzstrike", "corpus");
+var ROOT5 = join21(fileURLToPath12(new URL(".", import.meta.url)), "..");
+var CORPUS = join21(ROOT5, "bench", "corpus");
+var CAPTURED_CORPUS_DIR = process.env.BLITZSTRIKE_CORPUS_DIR ?? join21(homedir8(), ".blitzstrike", "corpus");
 function parseCorpusFile(path) {
   let text;
   try {
-    text = readFileSync20(path, "utf8");
+    text = readFileSync21(path, "utf8");
   } catch {
     return null;
   }
@@ -58601,7 +58818,7 @@ function loadDir(dir) {
     for (const f of readdirSync5(dir)) {
       if (!f.endsWith(".md"))
         continue;
-      const e = parseCorpusFile(join20(dir, f));
+      const e = parseCorpusFile(join21(dir, f));
       if (e)
         entries.push(e);
     }
@@ -58628,7 +58845,7 @@ function captureFalsePositive(input) {
     input.code,
     "```"
   ].filter((l) => l !== null);
-  const path = join20(CAPTURED_CORPUS_DIR, `${id}.md`);
+  const path = join21(CAPTURED_CORPUS_DIR, `${id}.md`);
   writeFileSync6(path, lines.join(`
 `) + `
 `, "utf8");
@@ -58650,7 +58867,7 @@ function detect(entry) {
   }
   const lang = entry.language;
   if (lang === "php") {
-    const tmp = join20(tmpdir3(), `blitzstrike-bench-${entry.id}-${process.pid}.php`);
+    const tmp = join21(tmpdir3(), `blitzstrike-bench-${entry.id}-${process.pid}.php`);
     writeFileSync6(tmp, entry.code);
     const r = analyzeDataFlow2(tmp);
     rmSync3(tmp, { force: true });
@@ -58719,25 +58936,25 @@ function runBenchmark() {
 }
 
 // src/obligations.ts
-import { readFileSync as readFileSync21, appendFileSync as appendFileSync4, mkdirSync as mkdirSync8, existsSync as existsSync11, writeFileSync as writeFileSync7 } from "node:fs";
-import { join as join21 } from "node:path";
+import { readFileSync as readFileSync22, appendFileSync as appendFileSync4, mkdirSync as mkdirSync8, existsSync as existsSync12, writeFileSync as writeFileSync7 } from "node:fs";
+import { join as join22 } from "node:path";
 import { createHash as createHash6 } from "node:crypto";
 import { homedir as homedir9 } from "node:os";
-var HOME_DIR4 = process.env.BLITZSTRIKE_HOME ?? join21(homedir9(), ".blitzstrike");
-var OBLIGATION_PATH = join21(HOME_DIR4, "obligations.jsonl");
+var HOME_DIR4 = process.env.BLITZSTRIKE_HOME ?? join22(homedir9(), ".blitzstrike");
+var OBLIGATION_PATH = join22(HOME_DIR4, "obligations.jsonl");
 function ensureDir3() {
-  if (!existsSync11(HOME_DIR4))
+  if (!existsSync12(HOME_DIR4))
     mkdirSync8(HOME_DIR4, { recursive: true });
 }
 function shortId2(claim) {
   return `obl-${createHash6("sha256").update(`${claim}\x00${Date.now()}`).digest("hex").slice(0, 12)}`;
 }
 function loadObligations() {
-  if (!existsSync11(OBLIGATION_PATH))
+  if (!existsSync12(OBLIGATION_PATH))
     return [];
   try {
     const out = [];
-    for (const line of readFileSync21(OBLIGATION_PATH, "utf8").split(`
+    for (const line of readFileSync22(OBLIGATION_PATH, "utf8").split(`
 `)) {
       const t = line.trim();
       if (!t)
@@ -58841,11 +59058,11 @@ init_framework_security();
 // src/variant-scan.ts
 init_scanner();
 init_complex_bugs();
-import { readFileSync as readFileSync23 } from "node:fs";
+import { readFileSync as readFileSync24 } from "node:fs";
 
 // src/cross-file.ts
 init_scanner();
-import { readFileSync as readFileSync22 } from "node:fs";
+import { readFileSync as readFileSync23 } from "node:fs";
 var PUBLIC_HOOK_RE = /(?:wp_ajax_nopriv_\w+|admin_post_nopriv_\w+|init|template_redirect|wp_loaded|parse_request|user_register|um_user_register|register_new_user|authenticate)/;
 var PRIV_SINK_RE = /\b(set_role|add_role|remove_role|set_user_role|wp_set_current_user|wp_set_auth_cookie|wp_insert_user|wp_create_user|wp_update_user)\s*\(/;
 var ROLE_META_RE = /update_user_meta\s*\(\s*[^,]+,\s*['"](wp_capabilities|role|roles|capabilities|wp_user_level)['"]/;
@@ -58897,7 +59114,7 @@ function detectCrossFilePrivesc(root) {
   for (const file of files) {
     let code;
     try {
-      code = stripComments(readFileSync22(file, "utf8"));
+      code = stripComments(readFileSync23(file, "utf8"));
     } catch {
       continue;
     }
@@ -58938,7 +59155,7 @@ function detectCrossFilePrivesc(root) {
   for (const file of files) {
     let code;
     try {
-      code = stripComments(readFileSync22(file, "utf8"));
+      code = stripComments(readFileSync23(file, "utf8"));
     } catch {
       continue;
     }
@@ -58961,7 +59178,7 @@ function detectCrossFilePrivesc(root) {
   for (const file of files) {
     let code;
     try {
-      code = stripComments(readFileSync22(file, "utf8"));
+      code = stripComments(readFileSync23(file, "utf8"));
     } catch {
       continue;
     }
@@ -59076,7 +59293,7 @@ function variantScan(root, opts = {}) {
   for (const file of files) {
     let code;
     try {
-      code = readFileSync23(file, "utf8");
+      code = readFileSync24(file, "utf8");
     } catch {
       continue;
     }
@@ -59736,17 +59953,17 @@ function analyzeJwt(token, opts = {}) {
 }
 
 // src/enterprise-benchmark.ts
-import { existsSync as existsSync12, readFileSync as readFileSync24, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
-import { join as join22, resolve } from "node:path";
+import { existsSync as existsSync13, readFileSync as readFileSync25, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
+import { join as join23, resolve } from "node:path";
 init_complex_bugs();
 var ROOT6 = resolve(process.cwd(), "bench", "enterprise");
 var ENTERPRISE_FIXTURES = [
-  { id: "php-laravel", dir: join22(ROOT6, "php-laravel"), expected_vulns: 4 },
-  { id: "js-express", dir: join22(ROOT6, "js-express"), expected_vulns: 2 },
-  { id: "py-django", dir: join22(ROOT6, "py-django"), expected_vulns: 2 },
-  { id: "java-spring", dir: join22(ROOT6, "java-spring"), expected_vulns: 2 },
-  { id: "wp-batch-route", dir: join22(ROOT6, "wp-batch-route"), expected_vulns: 3 },
-  { id: "php-complex", dir: join22(ROOT6, "php-complex"), expected_vulns: 4 }
+  { id: "php-laravel", dir: join23(ROOT6, "php-laravel"), expected_vulns: 4 },
+  { id: "js-express", dir: join23(ROOT6, "js-express"), expected_vulns: 2 },
+  { id: "py-django", dir: join23(ROOT6, "py-django"), expected_vulns: 2 },
+  { id: "java-spring", dir: join23(ROOT6, "java-spring"), expected_vulns: 2 },
+  { id: "wp-batch-route", dir: join23(ROOT6, "wp-batch-route"), expected_vulns: 3 },
+  { id: "php-complex", dir: join23(ROOT6, "php-complex"), expected_vulns: 4 }
 ];
 function sourceFiles(root) {
   const out = [];
@@ -59758,7 +59975,7 @@ function sourceFiles(root) {
       return;
     }
     for (const e of entries) {
-      const p = join22(dir, e);
+      const p = join23(dir, e);
       let st;
       try {
         st = statSync3(p);
@@ -59779,7 +59996,7 @@ function detectFixture(dir) {
   for (const f of sourceFiles(dir)) {
     let code;
     try {
-      code = readFileSync24(f, "utf8");
+      code = readFileSync25(f, "utf8");
     } catch {
       continue;
     }
@@ -59797,7 +60014,7 @@ function detectFixture(dir) {
 function runEnterpriseBenchmark() {
   const fixtures = [];
   for (const fx of ENTERPRISE_FIXTURES) {
-    if (!existsSync12(fx.dir)) {
+    if (!existsSync13(fx.dir)) {
       fixtures.push({ id: fx.id, available: false, detected: 0, expected: fx.expected_vulns, recall: 0 });
       continue;
     }
@@ -60221,16 +60438,19 @@ function createServer() {
   });
   server.registerTool("crack_hash", {
     title: "Identify + crack a dumped credential hash",
-    description: "CREDENTIAL: when you dump password hashes, EXECUTE this instead of leaving 'crack the hashes' as a recommendation. Identifies the hash type (bcrypt/md5/sha1/sha256/sha512/ntlm) and immediately tries a built-in common-password list offline, then returns the exact hashcat/john command for the full crack. Pass one hash string or a list.",
+    description: "CREDENTIAL: when you dump password hashes, EXECUTE this instead of leaving 'crack the hashes' as a recommendation. Identifies the hash type (bcrypt/md5/sha1/sha256/sha512/ntlm) and immediately tries a built-in common-password list offline, then streams any supplied wordlist (and autoloads seclists/rockyou when present), then returns the exact hashcat/john command for the full crack. Pass one hash string or a list.",
     inputSchema: {
       hash: string2().describe("The hash string (or a list of hashes, one per line)"),
-      extra: array(string2()).optional().describe("Extra candidate passwords to try (e.g. usernames, target-specific words)")
+      extra: array(string2()).optional().describe("Extra candidate passwords to try (e.g. usernames, target-specific words)"),
+      wordlist: string2().optional().describe("Optional wordlist file path(s) to stream (comma-separated). Autoloads rockyou/seclists if present."),
+      maxCandidates: number2().int().optional().describe("Max wordlist candidates to stream (default 5,000,000)")
     }
-  }, async ({ hash, extra }) => {
+  }, async ({ hash, extra, wordlist, maxCandidates }) => {
     const hashes = hash.split(/\r?\n/).map((h) => h.trim()).filter(Boolean).slice(0, 50);
+    const wl = wordlist ? wordlist.split(",").map((s) => s.trim()).filter(Boolean) : undefined;
     const results = [];
     for (const h of hashes) {
-      results.push({ hash: h.slice(0, 24) + (h.length > 24 ? "…" : ""), ...await crackHash(h, extra ?? []) });
+      results.push({ hash: h.slice(0, 24) + (h.length > 24 ? "…" : ""), ...await crackHash(h, extra ?? [], { wordlist: wl, maxCandidates }) });
     }
     return { content: [{ type: "text", text: JSON.stringify({ hashes_scanned: results.length, results }) }] };
   });
@@ -60462,6 +60682,29 @@ ${statusLine}` : statusLine },
   }, async (input) => {
     return { content: [{ type: "text", text: JSON.stringify(await validateLeakedKey(input)) }] };
   });
+  server.registerTool("hackbot_arena_list", {
+    title: "List Hackbot Arena benchmark labs",
+    description: "BENCHMARK: list the 30 Hackbot Arena (NusaSec) dockerized web-security labs — a local benchmark of realistic vulnerability chains with deterministic flags. Returns id/name/difficulty/port/vuln_class per lab (evaluator view; no flags or solutions).",
+    inputSchema: {}
+  }, async () => {
+    return { content: [{ type: "text", text: JSON.stringify(hackbotArenaList()) }] };
+  });
+  server.registerTool("hackbot_arena_brief", {
+    title: "Attack-plan brief for one Hackbot Arena lab",
+    description: "BENCHMARK: given a lab id (e.g. labs03), return the target URL, vuln class, stack, flag format, and the DERIVED Blitz Strike attack plan (vectors/detectors/chains/tools) to solve it. This is the agent brief — it never contains the flag, judge criteria, or reference solution.",
+    inputSchema: {
+      labId: string2().describe("Lab id (e.g. labs03, labs20)")
+    }
+  }, async ({ labId }) => {
+    return { content: [{ type: "text", text: JSON.stringify(hackbotArenaBrief(labId)) }] };
+  });
+  server.registerTool("hackbot_arena_coverage", {
+    title: "Blitz Strike coverage vs Hackbot Arena",
+    description: "BENCHMARK: map all 30 Hackbot Arena labs against Blitz Strike's detector/vector coverage — which vuln classes Blitz Strike has deterministic tooling for, per lab, plus the derived chains.",
+    inputSchema: {}
+  }, async () => {
+    return { content: [{ type: "text", text: JSON.stringify(hackbotArenaCoverage()) }] };
+  });
   server.registerTool("fofa_search", {
     title: "FOFA asset search",
     description: "STRIKE: search the FOFA asset index (needs FOFA_EMAIL + FOFA_KEY).",
@@ -60847,7 +61090,7 @@ ${statusLine}` : statusLine },
     let src = code;
     if (!src && path) {
       try {
-        src = readFileSync26(path, "utf8");
+        src = readFileSync27(path, "utf8");
       } catch {
         return { content: [{ type: "text", text: JSON.stringify({ error: "unreadable path" }) }] };
       }
@@ -61465,7 +61708,7 @@ ${statusLine}` : statusLine },
     description: "Route confusion (separate class from source→sink taint): detect attacker-controlled dispatch (call_user_func/forward/dispatch), dynamic method calls ($obj->$m()), dynamic include (LFI), batch/proxy forwarding without per-route auth re-check, and route matching without path normalization.",
     inputSchema: { path: string2().describe("Source file path (PHP)") }
   }, async ({ path }) => {
-    const code = readFileSync26(path, "utf8");
+    const code = readFileSync27(path, "utf8");
     const findings = detectRouteConfusion(code, path);
     return {
       content: [{
@@ -61479,7 +61722,7 @@ ${statusLine}` : statusLine },
     description: "Complex-bug detection beyond taint: deserialization→POP gadget chain (unserialize + magic method), type juggling (loose ==/!= vs hash/secret), mass assignment (extract/parse_str without a safe flag), prototype pollution (unsafe merge of request data), CRLF/header injection (user input into a header), path confusion (user input into a file path without canonicalization), SSRF (user-controlled URL with no host allowlist), XXE (user XML parsed without disabling entities), SSTI (user input into a template render with no sandbox), wrong-context sanitization (sanitize_text_field() into a SQL query), and missing authorization/nonce on WordPress entry points (wp_ajax_* / admin_post_* / register_rest_route without current_user_can, nonce verification, or permission_callback).",
     inputSchema: { path: string2().describe("Source file path") }
   }, async ({ path }) => {
-    const code = readFileSync26(path, "utf8");
+    const code = readFileSync27(path, "utf8");
     const findings = detectComplexBugs(code, path);
     return {
       content: [{
@@ -61565,7 +61808,7 @@ ${statusLine}` : statusLine },
     let lang = language;
     if (path && !code) {
       try {
-        src = readFileSync26(path, "utf8");
+        src = readFileSync27(path, "utf8");
       } catch {
         return { content: [{ type: "text", text: JSON.stringify({ error: `cannot read ${path}` }) }] };
       }
@@ -61814,15 +62057,15 @@ async function serve() {
 
 // src/index.ts
 init_cli();
-import { readFileSync as readFileSync30, existsSync as existsSync15 } from "node:fs";
-import { join as join27 } from "node:path";
-import { fileURLToPath as fileURLToPath16 } from "node:url";
-var ROOT11 = join27(fileURLToPath16(new URL(".", import.meta.url)), "..");
+import { readFileSync as readFileSync31, existsSync as existsSync16 } from "node:fs";
+import { join as join28 } from "node:path";
+import { fileURLToPath as fileURLToPath17 } from "node:url";
+var ROOT11 = join28(fileURLToPath17(new URL(".", import.meta.url)), "..");
 function readVersion() {
   try {
-    const p = join27(ROOT11, "package.json");
-    if (existsSync15(p))
-      return JSON.parse(readFileSync30(p, "utf8")).version ?? "1.0.0";
+    const p = join28(ROOT11, "package.json");
+    if (existsSync16(p))
+      return JSON.parse(readFileSync31(p, "utf8")).version ?? "1.0.0";
   } catch {}
   return "1.0.0";
 }