blitzstrike 2.4.80 → 2.4.82
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +30 -0
- package/dist/index.js +540 -304
- package/intelligence/patterns.json +104 -26
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -5,6 +5,36 @@ All notable changes to Blitz Strike are documented here.
|
|
|
5
5
|
The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
|
|
6
6
|
and this project adheres to [Semantic Versioning](https://semver.org/).
|
|
7
7
|
|
|
8
|
+
## [2.4.82] — 2026-09-17
|
|
9
|
+
|
|
10
|
+
### Added — out-of-band (OOB) listener for blind vuln proof
|
|
11
|
+
|
|
12
|
+
- New `oob_start` / `oob_poll` / `oob_stop` / `oob_list` tools give deterministic
|
|
13
|
+
proof for BLIND SSRF/XXE/SQLi/command-injection that never reflect in the HTTP
|
|
14
|
+
response. `oob_start` prefers the installed `interactsh-client` (unique *.oast.*
|
|
15
|
+
domain streaming DNS/HTTP interactions — the standard for public targets) and
|
|
16
|
+
falls back to a local HTTP listener for local labs. `oob_poll(id)` reports a hit
|
|
17
|
+
ONLY when an interaction for the session's unique id actually arrives. Handles
|
|
18
|
+
interactsh's ANSI-colored `[INF]` banner + JSONL interaction parsing.
|
|
19
|
+
|
|
20
|
+
Competitive analysis source: Awarexone/Agentic-Bug-Hunter (interactsh OOB).
|
|
21
|
+
|
|
22
|
+
## [2.4.81] — 2026-09-17
|
|
23
|
+
|
|
24
|
+
### Added — impact-first prioritization via typical bounty payout
|
|
25
|
+
|
|
26
|
+
- Every pattern in `patterns.json` now carries `payout_min` / `payout_max` /
|
|
27
|
+
`typical_payout` (e.g. sql_injection `$1K–$15K`, ssrf `$1K–$15K`, deserialization
|
|
28
|
+
`$5K–$30K`, idor `$1K–$10K`). `pattern_lookup` returns the range so a raw detector
|
|
29
|
+
hit is grounded with its bounty value.
|
|
30
|
+
- `attack_plan` now emits `typical_payout` + `expected_value_usd`
|
|
31
|
+
(`success_probability × payout midpoint`) per vector, so the driving agent can
|
|
32
|
+
prioritize impact-first (highest expected bounty) instead of relevance-only.
|
|
33
|
+
Non-detector vectors (xss / business_logic / open_redirect / …) fall back to a
|
|
34
|
+
curated PAYOUT_FALLBACK table.
|
|
35
|
+
|
|
36
|
+
Competitive analysis source: Awarexone/Agentic-Bug-Hunter (impact-first framing).
|
|
37
|
+
|
|
8
38
|
## [2.4.80] — 2026-09-17
|
|
9
39
|
|
|
10
40
|
### Changed — LLM-facing wiring for the two new web-class detectors
|