blitzstrike 2.4.72 → 2.4.74

package/CHANGELOG.md

@@ -5,6 +5,36 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.74] — 2026-09-17
+
+### Fixed — live_recon tech fingerprint false-positive (benchmark-driven)
+
+- Tech detection now uses header + cookie signals FIRST (authoritative), then
+  body regex as fallback, via a new `detectTech(headers, body)`:
+  - `x-powered-by: Express` / `connect.sid` cookie → nodejs (was missed).
+  - `laravel_session` / `XSRF-TOKEN` cookie → laravel.
+  - `PHPSESSID` → php, `csrftoken`+`sessionid` → django, `rack.session` → rails.
+- Removed the over-broad `_token` / `csrf-token` → laravel body signature (those
+  are generic CSRF tokens, present in Node/Express apps too) — this caused the
+  Hackbot Arena labs03 (Node/Express) to be mis-flagged as "laravel".
+- `gunicorn` no longer implies "flask" (it's a generic WSGI server shared by
+  Flask/Django/FastAPI); only `werkzeug` maps to flask.
+
+## [2.4.73] — 2026-09-17
+
+### Changed — crack_hash wordlist support (benchmark-driven fix)
+
+- `crack_hash` gained a `wordlist` arg (comma-separated paths) + `maxCandidates`
+  arg, and `crackHash()` now STREAMS any supplied wordlist and AUTOLOADS the
+  standard seclists/rockyou locations (`/usr/share/wordlists/rockyou.txt`,
+  `/opt/seclists/.../rockyou-*.txt`, Common-Credentials) when present. Cracking
+  is line-streamed (no full-file load), so a 14M-line rockyou won't OOM.
+- Added a pure-JS MD4 (NTLM) implementation so NTLM hashes also crack offline.
+- Result now reports `source` (common/wordlist) + `candidates_checked`.
+- Root cause: the Hackbot Arena labs04 run found the built-in common list was too
+  small (missed `md5("xNnWo6272k7x")`, only present in the full rockyou) — the
+  tool now reaches whatever wordlist is available on the box.
+
 ## [2.4.72] — 2026-09-14
 
 ### Added — Hackbot Arena benchmark integration

package/dist/index.js

@@ -15584,11 +15584,11 @@ var require_src = __commonJS(function(exports, module) {
 });
 
 // src/mcp-status.ts
-import { existsSync as existsSync9 } from "node:fs";
+import { existsSync as existsSync10 } from "node:fs";
 import { spawnSync as spawnSync3 } from "node:child_process";
 async function checkMcpServers() {
   const out = [];
-  const bin = ["/usr/bin/chrome-devtools-mcp", "/usr/local/bin/chrome-devtools-mcp"].find((p) => existsSync9(p));
+  const bin = ["/usr/bin/chrome-devtools-mcp", "/usr/local/bin/chrome-devtools-mcp"].find((p) => existsSync10(p));
   const npxOk = spawnSync3("npx", ["--version"], { timeout: 8000 }).error === undefined;
   const devtoolsOk = Boolean(bin) || npxOk;
   out.push({
@@ -17220,7 +17220,7 @@ var init_update = __esm(() => {
 });
 
 // src/release.ts
-import { readFileSync as readFileSync28, existsSync as existsSync13 } from "node:fs";
+import { readFileSync as readFileSync28, existsSync as existsSync14 } from "node:fs";
 import { join as join25 } from "node:path";
 import { fileURLToPath as fileURLToPath14 } from "node:url";
 import { execSync as execSync2 } from "node:child_process";
@@ -17260,7 +17260,7 @@ function validateRelease() {
   return { version: VERSION, checks, consistent: checks.filter((c) => !c.soft).every((c) => c.ok) };
 }
 function lockfilePresent() {
-  return existsSync13(join25(ROOT8, "package-lock.json")) || existsSync13(join25(ROOT8, "bun.lock")) || existsSync13(join25(ROOT8, "bun.lockb"));
+  return existsSync14(join25(ROOT8, "package-lock.json")) || existsSync14(join25(ROOT8, "bun.lock")) || existsSync14(join25(ROOT8, "bun.lockb"));
 }
 var ROOT8;
 var init_release = __esm(() => {
@@ -17302,7 +17302,7 @@ var init_dependency = __esm(() => {
 });
 
 // src/cli.ts
-import { readFileSync as readFileSync30, existsSync as existsSync14, writeFileSync as writeFileSync9, mkdirSync as mkdirSync10 } from "node:fs";
+import { readFileSync as readFileSync30, existsSync as existsSync15, writeFileSync as writeFileSync9, mkdirSync as mkdirSync10 } from "node:fs";
 import { join as join27, dirname as dirname6 } from "node:path";
 import { homedir as homedir11 } from "node:os";
 import { fileURLToPath as fileURLToPath16 } from "node:url";
@@ -17348,7 +17348,7 @@ async function runDoctor() {
     detail: h1 ? `X-HackerOne-Research: ${h1}` : "H1_USERNAME not set",
     fix: h1 ? undefined : "export H1_USERNAME=<your-hackerone-username> (adds X-HackerOne-Research to outbound requests)"
   });
-  const dataOk = existsSync14(join27(ROOT10, "chains.json")) && existsSync14(join27(ROOT10, "tools-catalog.json"));
+  const dataOk = existsSync15(join27(ROOT10, "chains.json")) && existsSync15(join27(ROOT10, "tools-catalog.json"));
   issues.push({
     name: "Data layers (chains + tools-catalog)",
     status: dataOk ? "ok" : "fail",
@@ -17400,14 +17400,14 @@ function resolveCommand() {
   if (which("blitzstrike"))
     return { command: "blitzstrike", args: ["serve", "--mcp"] };
   const src = join27(ROOT10, "src", "index.ts");
-  if (which("bun") && existsSync14(src))
+  if (which("bun") && existsSync15(src))
     return { command: "bun", args: ["run", src, "serve", "--mcp"] };
   if (which("npx"))
     return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
   if (which("bunx"))
     return { command: "bunx", args: ["blitzstrike", "serve", "--mcp"] };
   const dist = join27(ROOT10, "dist", "index.js");
-  if (existsSync14(dist))
+  if (existsSync15(dist))
     return { command: "bun", args: [dist, "serve", "--mcp"] };
   return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
 }
@@ -17421,7 +17421,7 @@ function readJson(p) {
 function jsonMcpServersWrite(p) {
   return (command, args) => {
     const dir = dirname6(p);
-    if (!existsSync14(dir))
+    if (!existsSync15(dir))
       mkdirSync10(dir, { recursive: true });
     const existing = readJson(p) ?? {};
     existing.mcpServers = {
@@ -17434,7 +17434,7 @@ function jsonMcpServersWrite(p) {
 function opencodeWrite(p) {
   return (command, args) => {
     const dir = dirname6(p);
-    if (!existsSync14(dir))
+    if (!existsSync15(dir))
       mkdirSync10(dir, { recursive: true });
     const existing = readJson(p) ?? {};
     existing.mcp = {
@@ -17448,14 +17448,14 @@ function opencodeWrite(p) {
 function copyOpenCodeAgents() {
   const srcDir = join27(ROOT10, "opencode-agents");
   const dstDir = join27(homedir11(), ".config", "opencode", "agents");
-  if (!existsSync14(srcDir))
+  if (!existsSync15(srcDir))
     return;
-  if (!existsSync14(dstDir))
+  if (!existsSync15(dstDir))
     mkdirSync10(dstDir, { recursive: true });
   for (const f of ["Blitz Strike.md", "Blitz.md", "Eagle Eye.md", "Strike.md"]) {
     const src = join27(srcDir, f);
     const dst = join27(dstDir, f);
-    if (existsSync14(src)) {
+    if (existsSync15(src)) {
       writeFileSync9(dst, readFileSync30(src, "utf8"));
     }
   }
@@ -17463,9 +17463,9 @@ function copyOpenCodeAgents() {
 function codexWrite(p) {
   return (command, args) => {
     const dir = dirname6(p);
-    if (!existsSync14(dir))
+    if (!existsSync15(dir))
       mkdirSync10(dir, { recursive: true });
-    let existing = existsSync14(p) ? readFileSync30(p, "utf8") : "";
+    let existing = existsSync15(p) ? readFileSync30(p, "utf8") : "";
     if (!existing.trimEnd().endsWith(`
 `))
       existing += `
@@ -17482,9 +17482,9 @@ args = ${JSON.stringify(args)}
 function hermesWrite(p) {
   return (command, args) => {
     const dir = dirname6(p);
-    if (!existsSync14(dir))
+    if (!existsSync15(dir))
       mkdirSync10(dir, { recursive: true });
-    let existing = existsSync14(p) ? readFileSync30(p, "utf8") : "";
+    let existing = existsSync15(p) ? readFileSync30(p, "utf8") : "";
     existing = existing.replace(/^  blitzstrike:\n(?:    .*\n?)*/m, "");
     if (!existing.trimEnd().endsWith(`
 `))
@@ -17515,70 +17515,70 @@ function detectAgents() {
   agents.push({
     name: "Claude Code",
     detectPath: claudeJson,
-    installed: () => existsSync14(claudeJson) || which("claude"),
+    installed: () => existsSync15(claudeJson) || which("claude"),
     write: jsonMcpServersWrite(claudeJson)
   });
   const claudeDesktop = join27(home, ".config", "Claude", "claude_desktop_config.json");
   agents.push({
     name: "Claude Desktop",
     detectPath: claudeDesktop,
-    installed: () => existsSync14(claudeDesktop),
+    installed: () => existsSync15(claudeDesktop),
     write: jsonMcpServersWrite(claudeDesktop)
   });
   const cursor = join27(home, ".cursor", "mcp.json");
   agents.push({
     name: "Cursor",
     detectPath: cursor,
-    installed: () => existsSync14(join27(home, ".cursor")) || which("cursor"),
+    installed: () => existsSync15(join27(home, ".cursor")) || which("cursor"),
     write: jsonMcpServersWrite(cursor)
   });
   const opencode = join27(home, ".config", "opencode", "opencode.jsonc");
   agents.push({
     name: "OpenCode",
     detectPath: opencode,
-    installed: () => existsSync14(join27(home, ".config", "opencode")) || which("opencode"),
+    installed: () => existsSync15(join27(home, ".config", "opencode")) || which("opencode"),
     write: opencodeWrite(opencode)
   });
   const codex = join27(home, ".codex", "config.toml");
   agents.push({
     name: "Codex",
     detectPath: codex,
-    installed: () => existsSync14(join27(home, ".codex")) || which("codex"),
+    installed: () => existsSync15(join27(home, ".codex")) || which("codex"),
     write: codexWrite(codex)
   });
   const hermes = join27(home, ".hermes", "config.yaml");
   agents.push({
     name: "Hermes",
     detectPath: hermes,
-    installed: () => existsSync14(join27(home, ".hermes")) || which("hermes"),
+    installed: () => existsSync15(join27(home, ".hermes")) || which("hermes"),
     write: hermesWrite(hermes)
   });
   const gemini = join27(home, ".gemini", "settings.json");
   agents.push({
     name: "Gemini CLI",
     detectPath: gemini,
-    installed: () => existsSync14(join27(home, ".gemini")) || which("gemini"),
+    installed: () => existsSync15(join27(home, ".gemini")) || which("gemini"),
     write: jsonMcpServersWrite(gemini)
   });
   const windsurf = join27(home, ".codeium", "windsurf", "mcp_config.json");
   agents.push({
     name: "Windsurf",
     detectPath: windsurf,
-    installed: () => existsSync14(join27(home, ".codeium")) || which("windsurf"),
+    installed: () => existsSync15(join27(home, ".codeium")) || which("windsurf"),
     write: jsonMcpServersWrite(windsurf)
   });
   const copilot = join27(home, ".copilot", "mcp.json");
   agents.push({
     name: "Copilot",
     detectPath: copilot,
-    installed: () => existsSync14(join27(home, ".copilot")),
+    installed: () => existsSync15(join27(home, ".copilot")),
     write: jsonMcpServersWrite(copilot)
   });
   const cline = join27(home, ".cline", "mcp_settings.json");
   agents.push({
     name: "Cline",
     detectPath: cline,
-    installed: () => existsSync14(join27(home, ".cline")),
+    installed: () => existsSync15(join27(home, ".cline")),
     write: jsonMcpServersWrite(cline)
   });
   return agents;
@@ -32417,7 +32417,7 @@ async function nvdLookup(cveId) {
 
 // src/orchestrator.ts
 init_scanner();
-import { readFileSync as readFileSync9, existsSync as existsSync7, statSync as statSync2 } from "node:fs";
+import { readFileSync as readFileSync9, existsSync as existsSync8, statSync as statSync2 } from "node:fs";
 import { join as join11 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 
@@ -33181,6 +33181,8 @@ function resolveFinding(finding, verdict) {
 
 // src/hash.ts
 import { createHash as createHash3 } from "node:crypto";
+import { createReadStream, existsSync as existsSync4 } from "node:fs";
+import { createInterface } from "node:readline";
 var COMMON_PASSWORDS = [
   "password",
   "123456",
@@ -33211,6 +33213,14 @@ var COMMON_PASSWORDS = [
   "P@ssw0rd",
   "qwertyuiop"
 ];
+var AUTOLOAD_WORDLISTS = [
+  "/usr/share/wordlists/rockyou.txt",
+  "/opt/seclists/Passwords/Leaked-Databases/rockyou-70.txt",
+  "/opt/seclists/Passwords/Leaked-Databases/rockyou-35.txt",
+  "/opt/seclists/Passwords/Leaked-Databases/rockyou-40.txt",
+  "/opt/seclists/Passwords/Common-Credentials/100k-most-used-passwords-NCSC.txt",
+  "/opt/seclists/Passwords/Common-Credentials/10k-most-common.txt"
+];
 function identifyHash(hash) {
   if (/^\$2[aby]\$\d+\$/.test(hash))
     return "bcrypt";
@@ -33243,31 +33253,141 @@ var HASHCAT_MODE = {
   sha512crypt: "1800",
   ntlm: "1000"
 };
-async function crackHash(hash, extra = []) {
+function hashMatches(type, pw, hash) {
+  const target = hash.toLowerCase();
+  if (type === "md5")
+    return createHash3("md5").update(pw).digest("hex") === target;
+  if (type === "sha1")
+    return createHash3("sha1").update(pw).digest("hex") === target;
+  if (type === "sha256")
+    return createHash3("sha256").update(pw).digest("hex") === target;
+  if (type === "sha512")
+    return createHash3("sha512").update(pw).digest("hex") === target;
+  if (type === "ntlm") {
+    const md4 = (buf) => {
+      const pad = (s) => {
+        const len = s.length;
+        const bitLen = len * 8;
+        const out = Buffer.concat([s, Buffer.from([128])]);
+        const mod = out.length % 64;
+        const padLen = mod < 56 ? 56 - mod : 120 - mod;
+        const padded = Buffer.concat([out, Buffer.alloc(padLen)]);
+        const lenBuf = Buffer.alloc(8);
+        lenBuf.writeUInt32LE(bitLen >>> 0, 0);
+        lenBuf.writeUInt32LE(Math.floor(bitLen / 4294967296), 4);
+        return Buffer.concat([padded, lenBuf]);
+      };
+      const rotl = (x, n) => (x << n | x >>> 32 - n) >>> 0;
+      const F = (x, y, z) => x & y | ~x & z;
+      const G = (x, y, z) => x & y | x & z | y & z;
+      const H = (x, y, z) => x ^ y ^ z;
+      const msg = pad(buf);
+      let a0 = 1732584193, b0 = 4023233417, c0 = 2562383102, d0 = 271733878;
+      for (let i = 0;i < msg.length; i += 64) {
+        const X = [];
+        for (let j = 0;j < 16; j++)
+          X[j] = msg.readUInt32LE(i + j * 4);
+        let A = a0, B = b0, C = c0, D = d0;
+        for (let r = 0;r < 16; r++) {
+          const k = r;
+          const s = [3, 7, 11, 19][r % 4];
+          const order = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15];
+          A = rotl(A + F(B, C, D) + X[order[k]] + 0 >>> 0, s);
+          [A, B, C, D] = [D, A, B, C];
+        }
+        for (let r = 0;r < 16; r++) {
+          const order = [0, 4, 8, 12, 1, 5, 9, 13, 2, 6, 10, 14, 3, 7, 11, 15];
+          const s = [3, 5, 9, 13][r % 4];
+          A = rotl(A + G(B, C, D) + X[order[r]] + 1518500249 >>> 0, s);
+          [A, B, C, D] = [D, A, B, C];
+        }
+        for (let r = 0;r < 16; r++) {
+          const order = [0, 8, 4, 12, 2, 10, 6, 14, 1, 9, 5, 13, 3, 11, 7, 15];
+          const s = [3, 9, 11, 15][r % 4];
+          A = rotl(A + H(B, C, D) + X[order[r]] + 1859775393 >>> 0, s);
+          [A, B, C, D] = [D, A, B, C];
+        }
+        a0 = a0 + A >>> 0;
+        b0 = b0 + B >>> 0;
+        c0 = c0 + C >>> 0;
+        d0 = d0 + D >>> 0;
+      }
+      const le = (x) => Buffer.from([x & 255, x >>> 8 & 255, x >>> 16 & 255, x >>> 24 & 255]);
+      return Buffer.concat([le(a0), le(b0), le(c0), le(d0)]).toString("hex");
+    };
+    const utf16le = Buffer.from(pw, "utf16le");
+    return md4(utf16le) === target;
+  }
+  return false;
+}
+async function crackWordlists(hash, type, paths, maxCandidates) {
+  let checked = 0;
+  for (const p of paths) {
+    if (!existsSync4(p))
+      continue;
+    const stream = createReadStream(p, { encoding: "utf8" });
+    const rl = createInterface({ input: stream, crlfDelay: Infinity });
+    let found = null;
+    for await (const line of rl) {
+      if (found)
+        break;
+      const pw = line.endsWith("\r") ? line.slice(0, -1) : line;
+      if (!pw)
+        continue;
+      checked += 1;
+      if (checked > maxCandidates)
+        break;
+      if (hashMatches(type, pw, hash))
+        found = pw;
+    }
+    stream.destroy();
+    if (found)
+      return { password: found, checked };
+    if (checked > maxCandidates)
+      break;
+  }
+  return { password: null, checked };
+}
+async function crackHash(hash, extra = [], opts = {}) {
   const type = identifyHash(hash);
-  const wordlist = [...new Set([...extra, ...COMMON_PASSWORDS])];
-  const matches = [];
-  for (const pw of wordlist) {
-    try {
-      if (type === "bcrypt") {
-        const verify = globalThis.Bun;
-        if (verify?.password?.verifySync?.(pw, hash))
-          matches.push(pw);
-      } else {
-        const algo = type === "md5" ? "md5" : type === "sha1" ? "sha1" : type === "sha256" ? "sha256" : "sha512";
-        if (["md5", "sha1", "sha256", "sha512"].includes(type)) {
-          if (createHash3(algo).update(pw).digest("hex").toLowerCase() === hash.toLowerCase())
-            matches.push(pw);
-        }
-      }
-    } catch {}
+  const maxCandidates = opts.maxCandidates ?? 5000000;
+  const fast = [...new Set([...extra, ...COMMON_PASSWORDS])];
+  let matched = "";
+  for (const pw of fast) {
+    if (hashMatches(type, pw, hash)) {
+      matched = pw;
+      break;
+    }
+  }
+  if (matched) {
+    return {
+      type,
+      cracked: true,
+      matches: [matched],
+      source: "common",
+      recommendation: `CRACKED — authenticate with '${matched}' and continue the chain (login → dashboard → privileged actions).`
+    };
+  }
+  const explicit = opts.wordlist ? Array.isArray(opts.wordlist) ? opts.wordlist : [opts.wordlist] : [];
+  const paths = [...new Set([...explicit, ...AUTOLOAD_WORDLISTS])];
+  const { password, checked } = await crackWordlists(hash, type, paths, maxCandidates);
+  if (password) {
+    return {
+      type,
+      cracked: true,
+      matches: [password],
+      source: "wordlist",
+      candidates_checked: checked,
+      recommendation: `CRACKED from wordlist — authenticate with '${password}' and continue the chain (login → dashboard → privileged actions).`
+    };
   }
   const mode = HASHCAT_MODE[type];
   return {
     type,
-    cracked: matches.length > 0,
-    matches,
-    recommendation: matches.length > 0 ? `CRACKED — authenticate with '${matches[0]}' and continue the chain (login → dashboard → privileged actions).` : mode ? `Not in the built-in common list. Full crack: hashcat -m ${mode} -a 0 <hashes.txt> <wordlist> (bcrypt cost 12 needs GPU + time). Reuse the credential if it matches another account's hash (password reuse).` : "Unknown hash format — save it and identify manually before cracking."
+    cracked: false,
+    matches: [],
+    candidates_checked: checked,
+    recommendation: mode ? `Not in the built-in common list or ${checked} wordlist candidates. Full crack: hashcat -m ${mode} -a 0 <hashes.txt> <wordlist> (bcrypt cost 12 needs GPU + time). Pass a target-specific wordlist via the wordlist arg (e.g. company names, usernames, pattern guesses). Reuse the credential if it matches another account's hash (password reuse).` : "Unknown hash format — save it and identify manually before cracking."
   };
 }
 
@@ -33447,7 +33567,7 @@ async function browserValidate(check, target, payload) {
 
 // src/devtools.ts
 import { spawn as spawn2, spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync4, readdirSync as readdirSync3 } from "node:fs";
+import { existsSync as existsSync5, readdirSync as readdirSync3 } from "node:fs";
 import { join as join7 } from "node:path";
 import { homedir as homedir4 } from "node:os";
 function mcpClient(command, args) {
@@ -33521,17 +33641,17 @@ function findChromium() {
   for (const c of candidates) {
     for (const dir of ["/usr/bin", "/usr/local/bin", "/opt/google/chrome"]) {
       const p = join7(dir, c);
-      if (existsSync4(p))
+      if (existsSync5(p))
         return p;
     }
   }
   const pw = join7(homedir4(), ".cache", "ms-playwright");
-  if (existsSync4(pw)) {
+  if (existsSync5(pw)) {
     for (const d of readdirSync3(pw)) {
       if (!d.startsWith("chromium"))
         continue;
       const full = join7(pw, d, "chrome-linux64", "chrome");
-      if (existsSync4(full))
+      if (existsSync5(full))
         return full;
     }
   }
@@ -33539,7 +33659,7 @@ function findChromium() {
 }
 function chromeDevtoolsCommand() {
   for (const c of ["/usr/bin/chrome-devtools-mcp", "/usr/local/bin/chrome-devtools-mcp"]) {
-    if (existsSync4(c))
+    if (existsSync5(c))
       return { command: c, args: [] };
   }
   const npx = spawnSync2("npx", ["--version"], { timeout: 8000 });
@@ -33851,12 +33971,12 @@ function uniqueFindings(findings) {
 }
 
 // src/intel.ts
-import { readFileSync as readFileSync8, existsSync as existsSync6 } from "node:fs";
+import { readFileSync as readFileSync8, existsSync as existsSync7 } from "node:fs";
 import { join as join9 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 
 // src/intelligence.ts
-import { readFileSync as readFileSync7, appendFileSync as appendFileSync3, mkdirSync as mkdirSync4, existsSync as existsSync5 } from "node:fs";
+import { readFileSync as readFileSync7, appendFileSync as appendFileSync3, mkdirSync as mkdirSync4, existsSync as existsSync6 } from "node:fs";
 import { join as join8 } from "node:path";
 import { createHash as createHash4 } from "node:crypto";
 import { homedir as homedir5 } from "node:os";
@@ -33882,14 +34002,14 @@ function sinkToVector(sinkType) {
   return SINK_TO_VECTOR[sinkType.toLowerCase()] ?? sinkType.toLowerCase();
 }
 function ensureDir2() {
-  if (!existsSync5(HOME_DIR3))
+  if (!existsSync6(HOME_DIR3))
     mkdirSync4(HOME_DIR3, { recursive: true });
 }
 function dedupHash2(vector, tech, target, outcome) {
   return createHash4("sha256").update(`${vector}\x00${tech}\x00${target}\x00${outcome}`).digest("hex").slice(0, 16);
 }
 function loadIntel() {
-  if (!existsSync5(INTEL_PATH))
+  if (!existsSync6(INTEL_PATH))
     return [];
   try {
     const out = [];
@@ -34041,7 +34161,7 @@ var ROOT3 = join9(fileURLToPath4(new URL(".", import.meta.url)), "..");
 var INTEL = join9(ROOT3, "intelligence");
 function loadJson(name) {
   const p = join9(INTEL, `${name}.json`);
-  if (!existsSync6(p))
+  if (!existsSync7(p))
     return null;
   try {
     return JSON.parse(readFileSync8(p, "utf8"));
@@ -34328,12 +34448,12 @@ var PACKAGE_PAYLOADS = join9(ROOT3, "payloads");
 var PACKAGE_TEMPLATES = join9(ROOT3, "templates");
 var DATA_ROOT = process.env.BLITZSTRIKE_DATA ?? join9(homedir6(), ".blitzstrike", "data");
 function payloadsDir() {
-  if (existsSync6(PACKAGE_PAYLOADS))
+  if (existsSync7(PACKAGE_PAYLOADS))
     return PACKAGE_PAYLOADS;
   return join9(DATA_ROOT, "payloads");
 }
 function templatesDir() {
-  if (existsSync6(PACKAGE_TEMPLATES))
+  if (existsSync7(PACKAGE_TEMPLATES))
     return PACKAGE_TEMPLATES;
   return join9(DATA_ROOT, "templates");
 }
@@ -35764,6 +35884,59 @@ function extractVersion(headers, body) {
   }
   return out;
 }
+function detectTech(headers, body) {
+  const techs = new Set;
+  const low = (s) => (s ?? "").toLowerCase();
+  const powered = low(headers["x-powered-by"]);
+  const server = low(headers["server"]);
+  const cookies = low(headers["set-cookie"]);
+  const generator = low(headers["x-generator"]);
+  if (/express|node\b|nodejs/i.test(powered))
+    techs.add("nodejs");
+  if (/^php\b|^php\//i.test(powered))
+    techs.add("php");
+  if (/asp\.net/i.test(powered) || (headers["x-aspnet-version"] ?? ""))
+    techs.add("aspnet");
+  if (/werkzeug/i.test(server))
+    techs.add("flask");
+  if (/drupal/i.test(generator))
+    techs.add("drupal");
+  if (/laravel_session|xsrf-token/i.test(cookies))
+    techs.add("laravel");
+  if (/phpsessid/i.test(cookies))
+    techs.add("php");
+  if (/connect\.sid/i.test(cookies))
+    techs.add("nodejs");
+  if (/csrftoken/i.test(cookies) && /sessionid/i.test(cookies))
+    techs.add("django");
+  if (/rack\.session/i.test(cookies))
+    techs.add("rails");
+  const bodySig = [
+    [/wp-content|wp-includes|wp-json/i, "wordpress"],
+    [/wp-login\.php|wp-admin/i, "wordpress"],
+    [/powered by joomla|com_content/i, "joomla"],
+    [/laravel_session|xsrf-token|\blaravel\b/i, "laravel"],
+    [/react|__NEXT_DATA__|next\/static/i, "nextjs"],
+    [/angular|ng-version/i, "angular"],
+    [/vue|__vue__|v-data/i, "vue"],
+    [/django|csrftoken|__debug__/i, "django"],
+    [/ruby on rails|rails/i, "rails"],
+    [/asp\.net|__VIEWSTATE|__EVENTVALIDATION/i, "aspnet"],
+    [/phpBB|phpbb/i, "phpbb"],
+    [/mybb|mybb/i, "mybb"],
+    [/drupal|Drupal\.settings/i, "drupal"],
+    [/magento|Mage\./i, "magento"],
+    [/shopify|cdn\.shopify/i, "shopify"],
+    [/grafana|kibana|elastic/i, "grafana-kibana"],
+    [/node\.js|express/i, "nodejs"],
+    [/flask|werkzeug/i, "flask"],
+    [/spring|actuator/i, "spring"]
+  ];
+  for (const [re, t] of bodySig)
+    if (re.test(body))
+      techs.add(t);
+  return [...techs];
+}
 function correlateIntel(techs, versionList, portList) {
   const tech = techs.map((t) => ({ tech: t, ...techCorrelation(t) }));
   const versions = versionList.map((v) => ({
@@ -35799,28 +35972,7 @@ async function liveRecon(target, includeActive = false) {
     body_size: root.body.length
   };
   const waf = detectWaf(root.headers, root.body);
-  const techSig = [
-    [/wp-content|wp-includes|wp-json/i, "wordpress"],
-    [/wp-login\.php|wp-admin/i, "wordpress"],
-    [/powered by joomla|com_content/i, "joomla"],
-    [/laravel|_token|csrf-token/i, "laravel"],
-    [/react|__NEXT_DATA__|next\/static/i, "nextjs"],
-    [/angular|ng-version/i, "angular"],
-    [/vue|__vue__|v-data/i, "vue"],
-    [/django|csrftoken|__debug__/i, "django"],
-    [/ruby on rails|rails/i, "rails"],
-    [/asp\.net|__VIEWSTATE|__EVENTVALIDATION/i, "aspnet"],
-    [/phpBB|phpbb/i, "phpbb"],
-    [/mybb|mybb/i, "mybb"],
-    [/drupal|Drupal\.settings/i, "drupal"],
-    [/magento|Mage\./i, "magento"],
-    [/shopify|cdn\.shopify/i, "shopify"],
-    [/grafana|kibana|elastic/i, "grafana-kibana"],
-    [/node\.js|express/i, "nodejs"],
-    [/flask|werkzeug/i, "flask"],
-    [/spring|actuator/i, "spring"]
-  ];
-  const techs = [...new Set(techSig.filter(([re]) => re.test(root.body)).map(([, t]) => t))];
+  const techs = detectTech(root.headers, root.body);
   const versions = extractVersion(root.headers, root.body);
   const { links, scripts } = crawlLinks(base, root.body);
   const { robots, sitemap } = await fetchRobotsAndSitemap(base);
@@ -35941,7 +36093,7 @@ function classifyTarget(target) {
   if (/^https?:\/\//i.test(target))
     return { kind: "live", target };
   try {
-    if (existsSync7(target) && (statSync2(target).isDirectory() || statSync2(target).isFile())) {
+    if (existsSync8(target) && (statSync2(target).isDirectory() || statSync2(target).isFile())) {
       return { kind: "source", target };
     }
   } catch {}
@@ -36082,7 +36234,7 @@ function runEngagement(target, scope = "", mode = "bug-bounty", maxFiles = 2000,
   };
   const isPath = (() => {
     try {
-      return existsSync7(target) && (statSync2(target).isDirectory() || statSync2(target).isFile());
+      return existsSync8(target) && (statSync2(target).isDirectory() || statSync2(target).isFile());
     } catch {
       return false;
     }
@@ -57558,7 +57710,7 @@ function analyzePatchFiles(oldPath, newPath, language) {
 }
 
 // src/frameworks.ts
-import { readFileSync as readFileSync16, existsSync as existsSync8 } from "node:fs";
+import { readFileSync as readFileSync16, existsSync as existsSync9 } from "node:fs";
 import { join as join15 } from "node:path";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
 var ROOT4 = join15(fileURLToPath7(new URL(".", import.meta.url)), "..");
@@ -57568,7 +57720,7 @@ function load2() {
   if (cache)
     return cache;
   const p = join15(INTEL2, "frameworks.json");
-  if (!existsSync8(p))
+  if (!existsSync9(p))
     return null;
   try {
     cache = JSON.parse(readFileSync16(p, "utf8"));
@@ -58253,7 +58405,7 @@ function submissionGate(input) {
 // src/git-history.ts
 init_complex_bugs();
 import { execFileSync as execFileSync4 } from "node:child_process";
-import { existsSync as existsSync10 } from "node:fs";
+import { existsSync as existsSync11 } from "node:fs";
 import { join as join17 } from "node:path";
 function parseDeletions(output) {
   const out = [];
@@ -58283,7 +58435,7 @@ function blobBeforeDeletion(root, commit, path) {
 function scanGitHistory(root, opts) {
   const limit = opts?.limit ?? 30;
   const findings = [];
-  if (!existsSync10(join17(root, ".git"))) {
+  if (!existsSync11(join17(root, ".git"))) {
     return { root, is_git_repo: false, total: 0, findings: [], error: "not a git repository (no .git dir)" };
   }
   if (opts?.secretPattern) {
@@ -58816,21 +58968,21 @@ function runBenchmark() {
 }
 
 // src/obligations.ts
-import { readFileSync as readFileSync22, appendFileSync as appendFileSync4, mkdirSync as mkdirSync8, existsSync as existsSync11, writeFileSync as writeFileSync7 } from "node:fs";
+import { readFileSync as readFileSync22, appendFileSync as appendFileSync4, mkdirSync as mkdirSync8, existsSync as existsSync12, writeFileSync as writeFileSync7 } from "node:fs";
 import { join as join22 } from "node:path";
 import { createHash as createHash6 } from "node:crypto";
 import { homedir as homedir9 } from "node:os";
 var HOME_DIR4 = process.env.BLITZSTRIKE_HOME ?? join22(homedir9(), ".blitzstrike");
 var OBLIGATION_PATH = join22(HOME_DIR4, "obligations.jsonl");
 function ensureDir3() {
-  if (!existsSync11(HOME_DIR4))
+  if (!existsSync12(HOME_DIR4))
     mkdirSync8(HOME_DIR4, { recursive: true });
 }
 function shortId2(claim) {
   return `obl-${createHash6("sha256").update(`${claim}\x00${Date.now()}`).digest("hex").slice(0, 12)}`;
 }
 function loadObligations() {
-  if (!existsSync11(OBLIGATION_PATH))
+  if (!existsSync12(OBLIGATION_PATH))
     return [];
   try {
     const out = [];
@@ -59833,7 +59985,7 @@ function analyzeJwt(token, opts = {}) {
 }
 
 // src/enterprise-benchmark.ts
-import { existsSync as existsSync12, readFileSync as readFileSync25, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
+import { existsSync as existsSync13, readFileSync as readFileSync25, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
 import { join as join23, resolve } from "node:path";
 init_complex_bugs();
 var ROOT6 = resolve(process.cwd(), "bench", "enterprise");
@@ -59894,7 +60046,7 @@ function detectFixture(dir) {
 function runEnterpriseBenchmark() {
   const fixtures = [];
   for (const fx of ENTERPRISE_FIXTURES) {
-    if (!existsSync12(fx.dir)) {
+    if (!existsSync13(fx.dir)) {
       fixtures.push({ id: fx.id, available: false, detected: 0, expected: fx.expected_vulns, recall: 0 });
       continue;
     }
@@ -60318,16 +60470,19 @@ function createServer() {
   });
   server.registerTool("crack_hash", {
     title: "Identify + crack a dumped credential hash",
-    description: "CREDENTIAL: when you dump password hashes, EXECUTE this instead of leaving 'crack the hashes' as a recommendation. Identifies the hash type (bcrypt/md5/sha1/sha256/sha512/ntlm) and immediately tries a built-in common-password list offline, then returns the exact hashcat/john command for the full crack. Pass one hash string or a list.",
+    description: "CREDENTIAL: when you dump password hashes, EXECUTE this instead of leaving 'crack the hashes' as a recommendation. Identifies the hash type (bcrypt/md5/sha1/sha256/sha512/ntlm) and immediately tries a built-in common-password list offline, then streams any supplied wordlist (and autoloads seclists/rockyou when present), then returns the exact hashcat/john command for the full crack. Pass one hash string or a list.",
     inputSchema: {
       hash: string2().describe("The hash string (or a list of hashes, one per line)"),
-      extra: array(string2()).optional().describe("Extra candidate passwords to try (e.g. usernames, target-specific words)")
+      extra: array(string2()).optional().describe("Extra candidate passwords to try (e.g. usernames, target-specific words)"),
+      wordlist: string2().optional().describe("Optional wordlist file path(s) to stream (comma-separated). Autoloads rockyou/seclists if present."),
+      maxCandidates: number2().int().optional().describe("Max wordlist candidates to stream (default 5,000,000)")
     }
-  }, async ({ hash, extra }) => {
+  }, async ({ hash, extra, wordlist, maxCandidates }) => {
     const hashes = hash.split(/\r?\n/).map((h) => h.trim()).filter(Boolean).slice(0, 50);
+    const wl = wordlist ? wordlist.split(",").map((s) => s.trim()).filter(Boolean) : undefined;
     const results = [];
     for (const h of hashes) {
-      results.push({ hash: h.slice(0, 24) + (h.length > 24 ? "…" : ""), ...await crackHash(h, extra ?? []) });
+      results.push({ hash: h.slice(0, 24) + (h.length > 24 ? "…" : ""), ...await crackHash(h, extra ?? [], { wordlist: wl, maxCandidates }) });
     }
     return { content: [{ type: "text", text: JSON.stringify({ hashes_scanned: results.length, results }) }] };
   });
@@ -61934,14 +62089,14 @@ async function serve() {
 
 // src/index.ts
 init_cli();
-import { readFileSync as readFileSync31, existsSync as existsSync15 } from "node:fs";
+import { readFileSync as readFileSync31, existsSync as existsSync16 } from "node:fs";
 import { join as join28 } from "node:path";
 import { fileURLToPath as fileURLToPath17 } from "node:url";
 var ROOT11 = join28(fileURLToPath17(new URL(".", import.meta.url)), "..");
 function readVersion() {
   try {
     const p = join28(ROOT11, "package.json");
-    if (existsSync15(p))
+    if (existsSync16(p))
       return JSON.parse(readFileSync31(p, "utf8")).version ?? "1.0.0";
   } catch {}
   return "1.0.0";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.72",
+  "version": "2.4.74",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {