blitzstrike 2.4.73 → 2.4.74

package/CHANGELOG.md

@@ -5,6 +5,21 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.74] — 2026-09-17
+
+### Fixed — live_recon tech fingerprint false-positive (benchmark-driven)
+
+- Tech detection now uses header + cookie signals FIRST (authoritative), then
+  body regex as fallback, via a new `detectTech(headers, body)`:
+  - `x-powered-by: Express` / `connect.sid` cookie → nodejs (was missed).
+  - `laravel_session` / `XSRF-TOKEN` cookie → laravel.
+  - `PHPSESSID` → php, `csrftoken`+`sessionid` → django, `rack.session` → rails.
+- Removed the over-broad `_token` / `csrf-token` → laravel body signature (those
+  are generic CSRF tokens, present in Node/Express apps too) — this caused the
+  Hackbot Arena labs03 (Node/Express) to be mis-flagged as "laravel".
+- `gunicorn` no longer implies "flask" (it's a generic WSGI server shared by
+  Flask/Django/FastAPI); only `werkzeug` maps to flask.
+
 ## [2.4.73] — 2026-09-17
 
 ### Changed — crack_hash wordlist support (benchmark-driven fix)

package/dist/index.js

@@ -35884,6 +35884,59 @@ function extractVersion(headers, body) {
   }
   return out;
 }
+function detectTech(headers, body) {
+  const techs = new Set;
+  const low = (s) => (s ?? "").toLowerCase();
+  const powered = low(headers["x-powered-by"]);
+  const server = low(headers["server"]);
+  const cookies = low(headers["set-cookie"]);
+  const generator = low(headers["x-generator"]);
+  if (/express|node\b|nodejs/i.test(powered))
+    techs.add("nodejs");
+  if (/^php\b|^php\//i.test(powered))
+    techs.add("php");
+  if (/asp\.net/i.test(powered) || (headers["x-aspnet-version"] ?? ""))
+    techs.add("aspnet");
+  if (/werkzeug/i.test(server))
+    techs.add("flask");
+  if (/drupal/i.test(generator))
+    techs.add("drupal");
+  if (/laravel_session|xsrf-token/i.test(cookies))
+    techs.add("laravel");
+  if (/phpsessid/i.test(cookies))
+    techs.add("php");
+  if (/connect\.sid/i.test(cookies))
+    techs.add("nodejs");
+  if (/csrftoken/i.test(cookies) && /sessionid/i.test(cookies))
+    techs.add("django");
+  if (/rack\.session/i.test(cookies))
+    techs.add("rails");
+  const bodySig = [
+    [/wp-content|wp-includes|wp-json/i, "wordpress"],
+    [/wp-login\.php|wp-admin/i, "wordpress"],
+    [/powered by joomla|com_content/i, "joomla"],
+    [/laravel_session|xsrf-token|\blaravel\b/i, "laravel"],
+    [/react|__NEXT_DATA__|next\/static/i, "nextjs"],
+    [/angular|ng-version/i, "angular"],
+    [/vue|__vue__|v-data/i, "vue"],
+    [/django|csrftoken|__debug__/i, "django"],
+    [/ruby on rails|rails/i, "rails"],
+    [/asp\.net|__VIEWSTATE|__EVENTVALIDATION/i, "aspnet"],
+    [/phpBB|phpbb/i, "phpbb"],
+    [/mybb|mybb/i, "mybb"],
+    [/drupal|Drupal\.settings/i, "drupal"],
+    [/magento|Mage\./i, "magento"],
+    [/shopify|cdn\.shopify/i, "shopify"],
+    [/grafana|kibana|elastic/i, "grafana-kibana"],
+    [/node\.js|express/i, "nodejs"],
+    [/flask|werkzeug/i, "flask"],
+    [/spring|actuator/i, "spring"]
+  ];
+  for (const [re, t] of bodySig)
+    if (re.test(body))
+      techs.add(t);
+  return [...techs];
+}
 function correlateIntel(techs, versionList, portList) {
   const tech = techs.map((t) => ({ tech: t, ...techCorrelation(t) }));
   const versions = versionList.map((v) => ({
@@ -35919,28 +35972,7 @@ async function liveRecon(target, includeActive = false) {
     body_size: root.body.length
   };
   const waf = detectWaf(root.headers, root.body);
-  const techSig = [
-    [/wp-content|wp-includes|wp-json/i, "wordpress"],
-    [/wp-login\.php|wp-admin/i, "wordpress"],
-    [/powered by joomla|com_content/i, "joomla"],
-    [/laravel|_token|csrf-token/i, "laravel"],
-    [/react|__NEXT_DATA__|next\/static/i, "nextjs"],
-    [/angular|ng-version/i, "angular"],
-    [/vue|__vue__|v-data/i, "vue"],
-    [/django|csrftoken|__debug__/i, "django"],
-    [/ruby on rails|rails/i, "rails"],
-    [/asp\.net|__VIEWSTATE|__EVENTVALIDATION/i, "aspnet"],
-    [/phpBB|phpbb/i, "phpbb"],
-    [/mybb|mybb/i, "mybb"],
-    [/drupal|Drupal\.settings/i, "drupal"],
-    [/magento|Mage\./i, "magento"],
-    [/shopify|cdn\.shopify/i, "shopify"],
-    [/grafana|kibana|elastic/i, "grafana-kibana"],
-    [/node\.js|express/i, "nodejs"],
-    [/flask|werkzeug/i, "flask"],
-    [/spring|actuator/i, "spring"]
-  ];
-  const techs = [...new Set(techSig.filter(([re]) => re.test(root.body)).map(([, t]) => t))];
+  const techs = detectTech(root.headers, root.body);
   const versions = extractVersion(root.headers, root.body);
   const { links, scripts } = crawlLinks(base, root.body);
   const { robots, sitemap } = await fetchRobotsAndSitemap(base);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.73",
+  "version": "2.4.74",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {