blitzstrike 2.4.84 → 2.4.85

package/CHANGELOG.md

@@ -5,6 +5,26 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.85] — 2026-09-17
+
+### Added — CORS, XSS (DOM sinks), and subdomain-takeover detectors
+
+- New `cors_misconfiguration` detector — Access-Control-Allow-Origin reflects the
+  request Origin (or is `*`) while credentials are allowed (CWE-942); handles the
+  `setHeader('…', …)` comma shape and raw-header/wildcard shapes.
+- New `xss` detector — user-controlled input reaching a DOM/JS sink (innerHTML,
+  dangerouslySetInnerHTML, document.write, .html(), eval, insertAdjacentHTML),
+  fired only when a source (req/location/URLSearchParams/…) is in the same file and
+  the sink value is not a constant string (CWE-79).
+- New `subdomain_takeover` detector — a DNS CNAME/AliasTarget/DNSName/route53 record
+  pointing at a claimable service (github.io / herokuapp.com / amazonaws.com / …)
+  (CWE-404). 24 takeover-able fingerprints.
+- Wired into patterns.json (29), cwe_map (69), severity VRT_MAP, synonyms, and the
+  verify harness (now 28/28 TP+TN). Complex-bug scan description + system prompt
+  updated.
+
+Competitive analysis source: Awarexone/Agentic-Bug-Hunter (web2-vuln-classes).
+
 ## [2.4.84] — 2026-09-17
 
 ### Added — hunting doctrine + always-rejected kill-list (LLM-facing methodology)

package/dist/index.js

@@ -16320,6 +16320,9 @@ function detectComplexBugs(code, file) {
   detectRustFormatString(code, file, out);
   detectJwtAlgConfusion(code, file, out);
   detectCacheDeception(code, file, out);
+  detectCorsMisconfig(code, file, out);
+  detectXss(code, file, out);
+  detectSubdomainTakeover(code, file, out);
   out.push(...detectWrongSanitizer(code, file));
   out.push(...detectMissingAuthz(code, file));
   const seen = new Set;
@@ -16913,6 +16916,89 @@ function detectCacheDeception(code, file, out) {
     detail: "The reverse proxy caches static-extension URLs using a cache key that excludes the session cookie, while a backend route (often a greedy regex like /account(/.*)?) returns per-session private data for such URLs. An attacker can poison the cache with a victim's session response and re-fetch it anonymously. Include the cookie in the cache key, or don't cache cookie-authenticated responses."
   });
 }
+function detectCorsMisconfig(code, file, out) {
+  const clean = stripCommentsOnly(code);
+  const ls = lines2(code);
+  const hasCredentials = /Access-Control-Allow-Credentials['"]?\s*(?::|,|=)\s*['"]?true/i.test(clean) || /\ballow_credentials\s*=\s*True\b/i.test(clean) || /\bcredentials\s*:\s*true\b/i.test(clean) || /\bwithCredentials\s*:\s*true\b/i.test(clean);
+  const reflected = /Access-Control-Allow-Origin['"]?\s*(?::|,|=)\s*['"]?\*['"]?/i.test(clean) || /Access-Control-Allow-Origin['"]?\s*(?::|,|=)\s*[^,;\n]*\borigin\b/i.test(clean) || /allow_origins?\s*=\s*\[\s*['"]\*['"]\s*\]/i.test(clean) || /@CrossOrigin\s*\(\s*origins\s*=\s*['"]\*['"]/i.test(clean);
+  if (!hasCredentials || !reflected)
+    return;
+  const ln = lineNo2(code, clean.search(/Access-Control-Allow-Origin|allow_origins|@CrossOrigin|CORS\s*\(/i));
+  out.push({
+    file,
+    line: ln,
+    type: "cors_misconfiguration",
+    category: "CORS misconfiguration (reflected origin + credentials)",
+    severity: "high",
+    evidence: (ls[ln - 1] ?? "").trim(),
+    detail: "Access-Control-Allow-Origin reflects the request Origin (or is '*') while Access-Control-Allow-Credentials is true — any website can read the victim's authenticated responses cross-origin (CWE-942). Validate the Origin against a static allowlist and never combine a reflected/wildcard origin with credentials."
+  });
+}
+function detectXss(code, file, out) {
+  const clean = stripCommentsOnly(code);
+  const ls = lines2(code);
+  const hasSource = /\b(?:req\.(?:query|params|body|cookies|headers)|request\.(?:get|args|form|json|values|headers|params)|location\.(?:hash|search|href)|window\.location|document\.(?:URL|referrer)|URLSearchParams|searchParams\.get|getElementById\([^)]*\)\.value|routeParams|queryParams|this\.props|params\s*[:=])/i.test(clean) || /\b(?:req\.(?:query|params|body)|request\.(?:get|args|json|values)|location\.(?:hash|search))\b/i.test(clean);
+  if (!hasSource)
+    return;
+  const sinkRe = /dangerouslySetInnerHTML|\.innerHTML\s*=|\.outerHTML\s*=|document\.write\s*\(|insertAdjacentHTML\s*\(|\.html\s*\(|eval\s*\(/g;
+  let m;
+  const seen = new Set;
+  while ((m = sinkRe.exec(clean)) !== null) {
+    const ln = lineNo2(code, m.index);
+    if (seen.has(ln))
+      continue;
+    const line = ls[ln - 1] ?? "";
+    const rest = line.slice(line.indexOf(m[0]) + m[0].length);
+    if (/^\s*["'`]/.test(rest))
+      continue;
+    if (m[0] === "eval(" && /^\s*["'`]/.test(rest))
+      continue;
+    if (m[0] === "dangerouslySetInnerHTML" && !/__html\s*:\s*[^'"`]/.test(line))
+      continue;
+    seen.add(ln);
+    out.push({
+      file,
+      line: ln,
+      type: "xss",
+      category: "Cross-site scripting (user input into a DOM sink)",
+      severity: "high",
+      evidence: line.trim(),
+      detail: "User-controlled input reaches a DOM/JS sink (innerHTML / dangerouslySetInnerHTML / document.write / .html() / eval / insertAdjacentHTML). If the value is not sanitized or context-encoded, an attacker injects script that runs in a victim's session (CWE-79). Use textContent/value assignment, a DOM-purify allowlist, or a framework's escaping — never assign raw user data to an HTML sink."
+    });
+  }
+}
+function detectSubdomainTakeover(code, file, out) {
+  const clean = stripCommentsOnly(code);
+  const ls = lines2(code);
+  const fingerprint = /(?:\.github\.io|\.s3[.-]?[a-z0-9-]*\.amazonaws\.com|\.herokuapp\.com|\.azurewebsites\.net|\.cloudfront\.net|\.fastly\.net|\.myshopify\.com|\.zendesk\.com|\.uservoice\.com|\.bitbucket\.io|\.readme\.io|\.ghost\.io|\.surge\.sh|\.netlify\.app|\.vercel\.app|\.firebaseapp\.com|\.elasticbeanstalk\.com|\.pantheon\.io|\.wordpress\.com|\.tumblr\.com|\.helpscoutdocs\.com|\.cargo\.site|\.getresponse\.com|\.teamwork\.com)\b/i;
+  const targetRe = /["']([a-z0-9.-]+\.[a-z]{2,})["']/g;
+  const seen = new Set;
+  const ls2 = lines2(clean);
+  for (let i = 0;i < ls2.length; i++) {
+    const line = ls2[i];
+    if (!/(?:CNAME|AliasTarget|DNSName|aws_route53_record|dns_zone|records?\s*[:=]\s*\[)/i.test(line))
+      continue;
+    let t;
+    while ((t = targetRe.exec(line)) !== null) {
+      const target = t[1];
+      if (!fingerprint.test(target))
+        continue;
+      const ln = i + 1;
+      if (seen.has(ln))
+        continue;
+      seen.add(ln);
+      out.push({
+        file,
+        line: ln,
+        type: "subdomain_takeover",
+        category: "Subdomain takeover (CNAME to a claimable service)",
+        severity: "high",
+        evidence: (ls[ln - 1] ?? "").trim(),
+        detail: `A DNS record points \`${target}\` at a service that can be claimed by an attacker (GitHub Pages/S3/Heroku/…). If the target is unclaimed/removed, an attacker registers it and hosts content on the victim's subdomain (cookie theft, phishing, same-origin attack). Verify the target resolves to a 'not found'/unclaimed service, then remove the dangling record.`
+      });
+    }
+  }
+}
 var SOURCE_TOKENS3, MAGIC_METHODS, SECRET_FIELD_RE, SECRET_PLACEHOLDER_RE, ENTROPY_EXCLUDE_VAR;
 var init_complex_bugs = __esm(() => {
   init_security_state();
@@ -17138,10 +17224,39 @@ $r = openai.chat.completions.create(['messages' => [['role' => 'user', 'content'
       id: "cache-deception",
       detector: "cache_deception",
       file: "nginx.conf",
-      positive: `location ~* \\.(css|js|png|jpg|gif|ico|svg)$ { proxy_cache ctf_cache; proxy_cache_valid 200 5m; }
+      positive: `location ~* .(css|js|png|jpg|gif|ico|svg)$ { proxy_cache ctf_cache; proxy_cache_valid 200 5m; }
 proxy_cache_key "$scheme$request_method$request_uri";
 `,
       negative: `location / { proxy_pass http://backend; }
+`
+    },
+    {
+      id: "cors-misconfig",
+      detector: "cors_misconfiguration",
+      file: "server.js",
+      positive: `res.setHeader('Access-Control-Allow-Origin', req.headers.origin);
+res.setHeader('Access-Control-Allow-Credentials', 'true');
+`,
+      negative: `res.setHeader('Access-Control-Allow-Origin', 'https://app.example.com');
+`
+    },
+    {
+      id: "xss-dom-sink",
+      detector: "xss",
+      file: "page.js",
+      positive: `const u = new URLSearchParams(location.search).get('name');
+document.getElementById('out').innerHTML = u;
+`,
+      negative: `document.getElementById('out').innerHTML = '<b>static</b>';
+`
+    },
+    {
+      id: "subdomain-takeover",
+      detector: "subdomain_takeover",
+      file: "dns.tf",
+      positive: `resource "aws_route53_record" "blog" { name = "blog.example.com" type = "CNAME" records = ["oldblog.github.io"] }
+`,
+      negative: `resource "aws_route53_record" "www" { name = "www.example.com" type = "A" records = ["1.2.3.4"] }
 `
     }
   ];
@@ -34383,7 +34498,21 @@ var ALIASES = {
   "web cache deception": "cache_deception",
   "cache deception": "cache_deception",
   "cache poisoning": "cache_deception",
-  "cache key injection": "cache_deception"
+  "cache key injection": "cache_deception",
+  cors: "cors_misconfiguration",
+  "cors misconfiguration": "cors_misconfiguration",
+  "cors misconfig": "cors_misconfiguration",
+  "cross origin resource sharing": "cors_misconfiguration",
+  xss: "xss",
+  "cross site scripting": "xss",
+  "cross-site scripting": "xss",
+  "dom xss": "xss",
+  "reflected xss": "xss",
+  "stored xss": "xss",
+  "subdomain takeover": "subdomain_takeover",
+  takeover: "subdomain_takeover",
+  "dangling dns": "subdomain_takeover",
+  "dangling cname": "subdomain_takeover"
 };
 function normalize(term) {
   return term.trim().toLowerCase().replace(/[_-]+/g, " ").replace(/\s+/g, " ").trim();
@@ -58897,7 +59026,10 @@ var VRT_MAP = {
   rust_unsafe: { vrt: "insecure_design > unsafe_memory_operations", priority: "P3", severity: "medium", rationale: "transmute/from_raw_parts/assume_init bypass the borrow checker — a hint that needs bounds verification; memory corruption if attacker-controlled." },
   rust_format_string: { vrt: "injection > format_string_injection", priority: "P2", severity: "high", rationale: "An attacker-controlled format string can read or corrupt memory via format specifiers." },
   jwt_alg_confusion: { vrt: "authentication > jwt_algorithm_confusion", priority: "P1", severity: "critical", rationale: "A verifier accepting HS256 with public-key HMAC lets an attacker forge admin tokens (CVE-2015-9235)." },
-  cache_deception: { vrt: "cryptographic_failure > web_cache_deception", priority: "P2", severity: "high", rationale: "Cookie-less static cache keys leak per-session private responses to anonymous callers." }
+  cache_deception: { vrt: "cryptographic_failure > web_cache_deception", priority: "P2", severity: "high", rationale: "Cookie-less static cache keys leak per-session private responses to anonymous callers." },
+  cors_misconfiguration: { vrt: "configuration > cors_misconfiguration", priority: "P3", severity: "medium", rationale: "A reflected/wildcard origin with credentials lets any website read authenticated responses cross-origin (CWE-942)." },
+  xss: { vrt: "injection > cross_site_scripting", priority: "P2", severity: "high", rationale: "User input into a DOM sink executes script in the victim's origin (CWE-79)." },
+  subdomain_takeover: { vrt: "configuration > subdomain_takeover", priority: "P3", severity: "medium", rationale: "A dangling CNAME lets an attacker host content on the victim's subdomain (CWE-404)." }
 };
 function severityCalibrate(input) {
   const type = input.type?.toLowerCase() ?? "";
@@ -60997,7 +61129,7 @@ function createServer2() {
 ` + `- A hard block (Cloudflare/WAF/IP-block/captcha) is NOT the end: mark the finding blocked + note the required vantage (residential / authorized / correct-SNI / --resolve direct-to-origin), then CONTINUE to the next lead (origin bypass, non-prod cluster, mobile APK, subdomain).
 ` + `- Keep trying every lead AND every chain step until each is verified/executed or blocked, THEN generate_report. Never deliver a bare surface map, and never stop at 'found X' when X enables more.
 
-` + "TWO PATHS:\\n" + "- Source path on disk -> blitz_scan / taint_file / eagle_eye2 (static).\\n" + "- Live URL -> live_recon / active_scan / strike_verify (web-hunting).\\n\\n" + "DEEPEN A FINDING: attack_plan(target, tech, params) to get the prioritized vector plan (decide what to test next with data); list_chains (escalation), chain_links (compose), technique_lookup(cls), payload_lookup, bypass_lookup (blocked). Ground any detector hit empirically with pattern_lookup(id) — it returns the class's CWE, real-world signature, escalation chains, citable references, per-class bypass techniques, and the high-value assets (crown jewels) that class hits, so a raw hit becomes a class-aware finding. Resolve free-form terminology first with synonym_lookup(term) (IDOR/BOLA/SQLi/prompt-injection → canonical id). For an llm_injection hit, its pattern carries a validation discipline — the RUN-TWICE RULE (reproduce token-for-token across two fresh sessions), NON-GUESSABLE ANCHOR (must leak a real key/URL, not a plausible guess), and OOB PROOF (a verifiable callback log) — apply all three before reporting. BEFORE generating a report, run submission_gate(...) and only ship a finding that passes all 7 questions (reproducible, in-scope, real-impact, no-privileged-assumption, verified-live, evidence-redacted, severity-derived); one false = kill it. Calibrate severity with severity_calibrate(type, cvss) to get a P1–P5 tier + VRT-style category. Start each engagement with engagement_scaffold(target, scope) for the folder + scope.md structure, and check data_refresh() to confirm the data layers are consistent. Phase doctrine: read_skill(bs-orchestrate-engagement | bs-web-hunting | bs-source-audit | bs-verify-finding). Campaign plan: read_playbook(target-type). On any failure call retry_guidance(signal) / model_fallback(signal) before giving up. HUNTING DOCTRINE (maximize payout rate): (1) SIBLING RULE — if one endpoint requires auth, check every sibling (/export /delete /share); ~30% of paid IDOR/auth bugs come from siblings. (2) A→B SIGNAL — a confirmed bug signals a class of developer mistake; hunt B and C (20-min box) before reporting. (3) TWO-ACCOUNT IDOR — always test with attacker account A reading victim account B, and state it in the report. (4) PoC ESCALATION — IDOR shows victim data (not 200), XSS shows cookie exfil (not alert), SSRF shows internal response (not DNS), SQLi shows DB content (not error). (5) FOLLOW THE MONEY — billing/credits/refunds/wallet flows. (6) Kill weak findings with kill_list(type) BEFORE the gate — missing headers, self-XSS, open-redirect-alone, SSRF-DNS-only, GraphQL-introspection-alone are always N/A standalone. (7) CI/CD + SAML/SSO are critical attack surfaces (pull_request_target, expression injection, XML signature wrapping, comment injection). Full doctrine: hunting_doctrine().\n" + "KNOWLEDGE BASE (discover, don't guess): skillLookup(topic) / listSkills for the 40 attack-path + hunting skills (ap-*, hp-*, bs-*); list_attack_vectors / attack_vectors(cat) for the 34-category vector taxonomy; taxonomy(kind) for OWASP/CWE/ASVS/API-top-10; read_playbook(type) for the 17 campaign playbooks; list_manuals / read_tool_manual for 317 tool references; list_tools / run_catalog_tool for the 141-tool catalog. Every tool, skill, and data layer is reachable from these. CROSS-TARGET INTELLIGENCE: strike_resolve auto-records confirmed/false_positive verdicts into the empirical ledger; query it with intelligence(action=hit_rates/top_vectors/recall) so a new target on a known tech inherits historical hit-rates (attack_plan already blends them into success_probability). intelligence(action=recall, tech, target) is the per-engagement pattern recall — it returns which patterns historically CONFIRMED on that tech (prioritize them) versus which only ever produced false positives (avoid them), so a new engagement starts from the empirical playbook of past ones. LIVE PENTEST + TARGETING (black-box, WAF-safe): cache_gap(base_url, endpoint) fuzzes path-normalization + static-extension variants for cache deception/poisoning; blind_oracle(base_url, param, value) detects which SINK a param reaches (sql/ssti/xss) via benign arithmetic (id=1+0, test${7*7}) WITHOUT a malicious payload; param_precedence(base_url, param, A, B) maps duplicate-parameter precedence (first/last-wins) for WAF-bypass. OOB (out-of-band) PROOF for BLIND vulns: oob_start() spins an interactsh listener (unique *.oast.* domain, streams DNS/HTTP interactions — the standard for public targets) or a local HTTP listener for local labs; inject the canary, then oob_poll(id) until the hit arrives; oob_stop(id) to clean up. A blind SSRF/XXE/SQLi/command-injection is CONFIRMED only when the canary actually arrives — never from a guess. SOURCE TARGETING: action_surface(code) maps every wp_ajax_* action to its vuln class + DERIVED priority (what to look for WHERE); security_state(sanitizers, sink) gives a wrong-context sanitization verdict; framework_knowledge(framework) returns auth/nonce primitives for 9 frameworks; variant_scan(root, signature) mass-sweeps an install base for ONE bug family; patch_analyze(old, new) REVERSES a security patch into the 0-day, and its mine_signature feeds variant_scan to sweep unpatched copies. All of these are DETECTION HINTS — verify each live (strike_verify / browser_validate) before it enters the report. NEWEST DETECTORS — understand AND try them: variant_scan also emits priv_esc (privilege escalation — a role/capability/user change fed by request input, traced cross-file via reverse call-graph, e.g. set_role($id, sanitize_key($_POST['um-role'])) or update_user_meta(...,'wp_capabilities', $_POST[...])) and flags uploadAllow=>array('all') unrestricted-upload configs as file_upload (the file-manager/connector shape). TO TRY a priv_esc hit: submit the role field with 'administrator' (or send wp_capabilities meta) and confirm the account actually gains admin. TO TRY an unrestricted-upload hit: POST a .php/.phtml and confirm it lands web-reachable + executes. variant_scan also emits hardcoded_secret (CWE-798) in three tiers: a secret field (api_key/db_password/access_token/aws_*) assigned a literal (HIGH), a known secret FORMAT (JWT eyJ…/AWS AKIA…/GitHub ghp_…/Slack xoxb-…/…) regardless of name (HIGH), or a high-entropy suspect token (MEDIUM — verify before reporting). Verify a frontend/JS secret live via drive_devtools (inspect the JS bundle / network response and confirm the key is actually exposed), and for a backend secret confirm it is reachable/valid. A static hit is a HYPOTHESIS until verified live — never report unverified. For a repo, also scan_git_history(root) — secrets DELETED from HEAD still live in .git history (the removed-later-is-not-fixed trap), and it feeds every recovered pre-deletion blob through the same secret detector. Once you recover a credential, prove it is still ACTIVE with validate_leaked_key(apiBase, endpoints, key|blobUrl) — a READ-ONLY differential test (401-without-key vs 200-with-key = auth bypass PROVEN). Two supply-chain detectors: dependency_confusion (a manifest/build file resolving a package from a public registry — pypi.org/npmjs.org --extra-index-url, or a scoped @company/pkg with no private registry) and ml_supply_chain (torch.load without weights_only=True / joblib.load / np.load(allow_pickle=True) / keras load_model on an untrusted model → pickle RCE). Rust is supported end-to-end: the taint engine (blitz_scan / taint_file) maps Rust sinks (std::process::Command, sqlx/diesel, reqwest/hyper, std::fs, serde/bincode) to the classic classes, plus two Rust-specific detectors — rust_unsafe (transmute / assume_init / from_raw_parts / ptr::* — memory-unsafety surface, CWE-119) and rust_format_string (println!/format! with a variable as the format string — CWE-134). The sqlx query! compile-time macro is treated as safe (suppressed). Two more web-class detectors: jwt_alg_confusion (a JWT verifier that dispatches on the token's alg header and accepts BOTH RS256 and HS256, with the HS256 HMAC secret derived from public/shared key material — CWE-347; the attacker sets alg=HS256 and signs with the public key to forge admin tokens) and cache_deception (a reverse proxy caching static-extension URLs with a cache key that omits the session cookie, over a session-authenticated backend — CWE-525; the victim's cached private response is re-fetched anonymously). TO TRY a jwt_alg_confusion hit: fetch the public key (/.well-known/jwks.json), forge an HS256 token signed with that public key, and confirm admin access. TO TRY a cache_deception hit: request an authenticated path with a static extension appended (.css/.js) and re-fetch it anonymously. WEB3: for Solidity/EVM, call web3_audit(code|path) — a deterministic 10-class smart-contract audit (reentrancy, unchecked return, unchecked arithmetic, tx.origin auth, signature replay, unprotected selfdestruct, delegatecall-to-user-input, missing access control, timestamp dependence, spot-price oracle manipulation, unbounded loop) returning ranked findings (class/CWE/severity/line), then foundry_poc(class, contract) to generate an executable Foundry test that PROVES the bug. A web3 hit is a HYPOTHESIS until the Foundry PoC reproduces it.\n" + `PRECISION ANALYSIS — chrome-devtools MCP is MANDATORY, not optional:
+` + "TWO PATHS:\\n" + "- Source path on disk -> blitz_scan / taint_file / eagle_eye2 (static).\\n" + "- Live URL -> live_recon / active_scan / strike_verify (web-hunting).\\n\\n" + "DEEPEN A FINDING: attack_plan(target, tech, params) to get the prioritized vector plan (decide what to test next with data); list_chains (escalation), chain_links (compose), technique_lookup(cls), payload_lookup, bypass_lookup (blocked). Ground any detector hit empirically with pattern_lookup(id) — it returns the class's CWE, real-world signature, escalation chains, citable references, per-class bypass techniques, and the high-value assets (crown jewels) that class hits, so a raw hit becomes a class-aware finding. Resolve free-form terminology first with synonym_lookup(term) (IDOR/BOLA/SQLi/prompt-injection → canonical id). For an llm_injection hit, its pattern carries a validation discipline — the RUN-TWICE RULE (reproduce token-for-token across two fresh sessions), NON-GUESSABLE ANCHOR (must leak a real key/URL, not a plausible guess), and OOB PROOF (a verifiable callback log) — apply all three before reporting. BEFORE generating a report, run submission_gate(...) and only ship a finding that passes all 7 questions (reproducible, in-scope, real-impact, no-privileged-assumption, verified-live, evidence-redacted, severity-derived); one false = kill it. Calibrate severity with severity_calibrate(type, cvss) to get a P1–P5 tier + VRT-style category. Start each engagement with engagement_scaffold(target, scope) for the folder + scope.md structure, and check data_refresh() to confirm the data layers are consistent. Phase doctrine: read_skill(bs-orchestrate-engagement | bs-web-hunting | bs-source-audit | bs-verify-finding). Campaign plan: read_playbook(target-type). On any failure call retry_guidance(signal) / model_fallback(signal) before giving up. HUNTING DOCTRINE (maximize payout rate): (1) SIBLING RULE — if one endpoint requires auth, check every sibling (/export /delete /share); ~30% of paid IDOR/auth bugs come from siblings. (2) A→B SIGNAL — a confirmed bug signals a class of developer mistake; hunt B and C (20-min box) before reporting. (3) TWO-ACCOUNT IDOR — always test with attacker account A reading victim account B, and state it in the report. (4) PoC ESCALATION — IDOR shows victim data (not 200), XSS shows cookie exfil (not alert), SSRF shows internal response (not DNS), SQLi shows DB content (not error). (5) FOLLOW THE MONEY — billing/credits/refunds/wallet flows. (6) Kill weak findings with kill_list(type) BEFORE the gate — missing headers, self-XSS, open-redirect-alone, SSRF-DNS-only, GraphQL-introspection-alone are always N/A standalone. (7) CI/CD + SAML/SSO are critical attack surfaces (pull_request_target, expression injection, XML signature wrapping, comment injection). Full doctrine: hunting_doctrine().\n" + "KNOWLEDGE BASE (discover, don't guess): skillLookup(topic) / listSkills for the 40 attack-path + hunting skills (ap-*, hp-*, bs-*); list_attack_vectors / attack_vectors(cat) for the 34-category vector taxonomy; taxonomy(kind) for OWASP/CWE/ASVS/API-top-10; read_playbook(type) for the 17 campaign playbooks; list_manuals / read_tool_manual for 317 tool references; list_tools / run_catalog_tool for the 141-tool catalog. Every tool, skill, and data layer is reachable from these. CROSS-TARGET INTELLIGENCE: strike_resolve auto-records confirmed/false_positive verdicts into the empirical ledger; query it with intelligence(action=hit_rates/top_vectors/recall) so a new target on a known tech inherits historical hit-rates (attack_plan already blends them into success_probability). intelligence(action=recall, tech, target) is the per-engagement pattern recall — it returns which patterns historically CONFIRMED on that tech (prioritize them) versus which only ever produced false positives (avoid them), so a new engagement starts from the empirical playbook of past ones. LIVE PENTEST + TARGETING (black-box, WAF-safe): cache_gap(base_url, endpoint) fuzzes path-normalization + static-extension variants for cache deception/poisoning; blind_oracle(base_url, param, value) detects which SINK a param reaches (sql/ssti/xss) via benign arithmetic (id=1+0, test${7*7}) WITHOUT a malicious payload; param_precedence(base_url, param, A, B) maps duplicate-parameter precedence (first/last-wins) for WAF-bypass. OOB (out-of-band) PROOF for BLIND vulns: oob_start() spins an interactsh listener (unique *.oast.* domain, streams DNS/HTTP interactions — the standard for public targets) or a local HTTP listener for local labs; inject the canary, then oob_poll(id) until the hit arrives; oob_stop(id) to clean up. A blind SSRF/XXE/SQLi/command-injection is CONFIRMED only when the canary actually arrives — never from a guess. SOURCE TARGETING: action_surface(code) maps every wp_ajax_* action to its vuln class + DERIVED priority (what to look for WHERE); security_state(sanitizers, sink) gives a wrong-context sanitization verdict; framework_knowledge(framework) returns auth/nonce primitives for 9 frameworks; variant_scan(root, signature) mass-sweeps an install base for ONE bug family; patch_analyze(old, new) REVERSES a security patch into the 0-day, and its mine_signature feeds variant_scan to sweep unpatched copies. All of these are DETECTION HINTS — verify each live (strike_verify / browser_validate) before it enters the report. NEWEST DETECTORS — understand AND try them: variant_scan also emits priv_esc (privilege escalation — a role/capability/user change fed by request input, traced cross-file via reverse call-graph, e.g. set_role($id, sanitize_key($_POST['um-role'])) or update_user_meta(...,'wp_capabilities', $_POST[...])) and flags uploadAllow=>array('all') unrestricted-upload configs as file_upload (the file-manager/connector shape). TO TRY a priv_esc hit: submit the role field with 'administrator' (or send wp_capabilities meta) and confirm the account actually gains admin. TO TRY an unrestricted-upload hit: POST a .php/.phtml and confirm it lands web-reachable + executes. variant_scan also emits hardcoded_secret (CWE-798) in three tiers: a secret field (api_key/db_password/access_token/aws_*) assigned a literal (HIGH), a known secret FORMAT (JWT eyJ…/AWS AKIA…/GitHub ghp_…/Slack xoxb-…/…) regardless of name (HIGH), or a high-entropy suspect token (MEDIUM — verify before reporting). Verify a frontend/JS secret live via drive_devtools (inspect the JS bundle / network response and confirm the key is actually exposed), and for a backend secret confirm it is reachable/valid. A static hit is a HYPOTHESIS until verified live — never report unverified. For a repo, also scan_git_history(root) — secrets DELETED from HEAD still live in .git history (the removed-later-is-not-fixed trap), and it feeds every recovered pre-deletion blob through the same secret detector. Once you recover a credential, prove it is still ACTIVE with validate_leaked_key(apiBase, endpoints, key|blobUrl) — a READ-ONLY differential test (401-without-key vs 200-with-key = auth bypass PROVEN). Two supply-chain detectors: dependency_confusion (a manifest/build file resolving a package from a public registry — pypi.org/npmjs.org --extra-index-url, or a scoped @company/pkg with no private registry) and ml_supply_chain (torch.load without weights_only=True / joblib.load / np.load(allow_pickle=True) / keras load_model on an untrusted model → pickle RCE). Rust is supported end-to-end: the taint engine (blitz_scan / taint_file) maps Rust sinks (std::process::Command, sqlx/diesel, reqwest/hyper, std::fs, serde/bincode) to the classic classes, plus two Rust-specific detectors — rust_unsafe (transmute / assume_init / from_raw_parts / ptr::* — memory-unsafety surface, CWE-119) and rust_format_string (println!/format! with a variable as the format string — CWE-134). The sqlx query! compile-time macro is treated as safe (suppressed). Two more web-class detectors: jwt_alg_confusion (a JWT verifier that dispatches on the token's alg header and accepts BOTH RS256 and HS256, with the HS256 HMAC secret derived from public/shared key material — CWE-347; the attacker sets alg=HS256 and signs with the public key to forge admin tokens) and cache_deception (a reverse proxy caching static-extension URLs with a cache key that omits the session cookie, over a session-authenticated backend — CWE-525; the victim's cached private response is re-fetched anonymously). TO TRY a jwt_alg_confusion hit: fetch the public key (/.well-known/jwks.json), forge an HS256 token signed with that public key, and confirm admin access. TO TRY a cache_deception hit: request an authenticated path with a static extension appended (.css/.js) and re-fetch it anonymously. Three more detectors: cors_misconfiguration (Access-Control-Allow-Origin reflects the request Origin or is '*' while credentials are true — CWE-942; any site reads the victim's authenticated responses), xss (user input into a DOM sink — innerHTML / dangerouslySetInnerHTML / document.write / .html() / eval — CWE-79), and subdomain_takeover (a dangling CNAME/AliasTarget to a claimable service like *.github.io/*.herokuapp.com/*.amazonaws.com — CWE-404). TO TRY a cors hit: send an evil Origin + confirm the response echoes it with Allow-Credentials:true. TO TRY an xss hit: confirm the sink executes (drive_devtools). TO TRY a takeover hit: verify the CNAME target resolves to an unclaimed/not-found page. WEB3: for Solidity/EVM, call web3_audit(code|path) — a deterministic 10-class smart-contract audit (reentrancy, unchecked return, unchecked arithmetic, tx.origin auth, signature replay, unprotected selfdestruct, delegatecall-to-user-input, missing access control, timestamp dependence, spot-price oracle manipulation, unbounded loop) returning ranked findings (class/CWE/severity/line), then foundry_poc(class, contract) to generate an executable Foundry test that PROVES the bug. A web3 hit is a HYPOTHESIS until the Foundry PoC reproduces it.\n" + `PRECISION ANALYSIS — chrome-devtools MCP is MANDATORY, not optional:
 ` + `- When a lead needs DOM/JS precision — DOM-XSS sink execution, AJAX endpoint + payload interception, JS runtime errors, redirect chains, SSO/token flow, or anything a static HTML glance cannot prove — call drive_devtools(target). It spawns chrome-devtools-mcp and drives a REAL headless browser (navigate -> list_network_requests -> list_console_messages -> evaluate_script), giving reproducible evidence instead of a guess.
 ` + `- Before calling it, check_mcp() to confirm the browser MCP is available; if not, blitzstrike install-tools or npm i -g chrome-devtools-mcp. Never substitute eyeballing minified JS or a static sink guess when a live browser can PROVE it. This is the precision + consistency layer.
 ` + "EXTERNAL MCP SERVERS (verified, connect them — NOT one-shot CLIs): chrome-devtools-mcp (29 tools: list_network_requests/get_network_request for raw HTTP interception, list_console_messages for JS errors + DOM-XSS, evaluate_script to run JS, take_screenshot) -> stdio chrome-devtools-mcp --headless --chromeArg=--no-sandbox --chromeArg=--disable-gpu (as root/container this is MANDATORY or the browser crashes; add --proxyServer http://127.0.0.1:8080 to route through Burp, --acceptInsecureCerts for bad TLS). burp-suite-mcp (proxy history + active scan + repeater) -> NOT npm: build the JAR (git clone https://github.com/PortSwigger/mcp-server.git && cd mcp-server && ./gradlew embedProxyJar), load it in Burp Extensions, then connect the client to http://127.0.0.1:9876 (SSE) or the stdio proxy java -jar mcp-proxy-all.jar --sse-url http://127.0.0.1:9876."
@@ -62586,7 +62718,7 @@ ${statusLine}` : statusLine },
   });
   server.registerTool("complex_scan", {
     title: "Complex-bug scan (deserialization / type juggling / mass assignment / prototype pollution / CRLF / path confusion / SSRF / XXE / SSTI / wrong-context sanitization / missing authz+nonce)",
-    description: "Complex-bug detection beyond taint: deserialization→POP gadget chain (unserialize + magic method), type juggling (loose ==/!= vs hash/secret), mass assignment (extract/parse_str without a safe flag), prototype pollution (unsafe merge of request data), CRLF/header injection (user input into a header), path confusion (user input into a file path without canonicalization), SSRF (user-controlled URL with no host allowlist), XXE (user XML parsed without disabling entities), SSTI (user input into a template render with no sandbox), wrong-context sanitization (sanitize_text_field() into a SQL query), and missing authorization/nonce on WordPress entry points (wp_ajax_* / admin_post_* / register_rest_route without current_user_can, nonce verification, or permission_callback).",
+    description: "Complex-bug detection beyond taint: deserialization→POP gadget chain (unserialize + magic method), type juggling (loose ==/!= vs hash/secret), mass assignment (extract/parse_str without a safe flag), prototype pollution (unsafe merge of request data), CRLF/header injection (user input into a header), path confusion (user input into a file path without canonicalization), SSRF (user-controlled URL with no host allowlist), XXE (user XML parsed without disabling entities), SSTI (user input into a template render with no sandbox), wrong-context sanitization (sanitize_text_field() into a SQL query), missing authorization/nonce on WordPress entry points (wp_ajax_* / admin_post_* / register_rest_route without current_user_can, nonce verification, or permission_callback), CORS misconfiguration (reflected/wildcard origin + credentials), XSS (user input into a DOM sink: innerHTML / dangerouslySetInnerHTML / document.write / .html / eval), and subdomain takeover (CNAME/AliasTarget to a claimable service).",
     inputSchema: { path: string2().describe("Source file path") }
   }, async ({ path }) => {
     const code = readFileSync27(path, "utf8");

package/intelligence/cwe_map.json

@@ -342,6 +342,11 @@
       "cwe": "CWE-525",
       "name": "Use of Web Browser Cache Containing Sensitive Information",
       "category": "cryptographic_failure"
+    },
+    {
+      "id": "cors_misconfiguration",
+      "cwe": "CWE-942",
+      "name": "Overly Permissive Cross-domain Whitelist (CORS)"
     }
   ]
 }

package/intelligence/patterns.json

@@ -840,6 +840,119 @@
       "payout_min": 1000,
       "payout_max": 10000,
       "typical_payout": "$1K–$10K"
+    },
+    {
+      "id": "cors_misconfiguration",
+      "name": "CORS Misconfiguration",
+      "cwe": "CWE-942",
+      "severity": "high",
+      "signature": "Access-Control-Allow-Origin reflects the request Origin (or is *) while credentials are allowed",
+      "chains": [
+        "cors_misconfig_data_theft",
+        "cors_misconfig_to_session_theft"
+      ],
+      "references": [
+        "CWE-942",
+        "OWASP WSTG-CLNT-01",
+        "PortSwigger — CORS vulnerability with basic origin reflection"
+      ],
+      "real_world": "A server echoes the request Origin header into Access-Control-Allow-Origin while also sending Access-Control-Allow-Credentials: true. Any website the victim visits can then make credentialed requests and read the victim's authenticated responses cross-origin (session theft, account data exfil).",
+      "detection_signatures": [
+        "Access-Control-Allow-Origin = request Origin (reflected)",
+        "Access-Control-Allow-Origin: * + Access-Control-Allow-Credentials: true",
+        "allow_origins=[\"*\"] + allow_credentials=True (Flask/Django CORS)"
+      ],
+      "chain_templates": [
+        "cors_misconfig_data_theft",
+        "cors_misconfig_to_session_theft"
+      ],
+      "bypass_techniques": [
+        "null origin (sandboxed iframe) reflected",
+        "subdomain of the attacker reflected by a naive suffix/prefix check",
+        "Origin with the target as a suffix (evil.com-target.com)"
+      ],
+      "crown_jewels": [
+        "authenticated JSON API responses",
+        "session/CSRF tokens",
+        "account settings + PII"
+      ],
+      "payout_min": 500,
+      "payout_max": 5000,
+      "typical_payout": "$500–$5K"
+    },
+    {
+      "id": "xss",
+      "name": "Cross-Site Scripting (XSS)",
+      "cwe": "CWE-79",
+      "severity": "high",
+      "signature": "user-controlled input reaches a DOM/JS sink (innerHTML / dangerouslySetInnerHTML / document.write / .html / eval)",
+      "chains": [
+        "xss_to_account_takeover"
+      ],
+      "references": [
+        "CWE-79",
+        "OWASP WSTG-INPV-02",
+        "PortSwigger — DOM-based XSS"
+      ],
+      "real_world": "A DOM sink (innerHTML, document.write, dangerouslySetInnerHTML, jQuery .html(), eval) is fed user-controlled input without sanitization/encoding. The injected script runs in the victim's origin, stealing cookies, hijacking the session, or exfiltrating data.",
+      "detection_signatures": [
+        "dangerouslySetInnerHTML={{__html: <var>}}",
+        "element.innerHTML = <var>",
+        "document.write(<var>) / .html(<var>) with a request/location source nearby"
+      ],
+      "chain_templates": [
+        "xss_to_account_takeover"
+      ],
+      "bypass_techniques": [
+        "context-specific encoding (HTML/attribute/JS/URL) mismatches",
+        "DOM clobbering (form/iframe name overrides)",
+        "CSP bypass via nonce reuse / unsafe-inline gaps"
+      ],
+      "crown_jewels": [
+        "session cookies (document.cookie)",
+        "admin panel actions via CSRF tokens",
+        "victim PII in the DOM"
+      ],
+      "payout_min": 500,
+      "payout_max": 5000,
+      "typical_payout": "$500–$5K"
+    },
+    {
+      "id": "subdomain_takeover",
+      "name": "Subdomain Takeover",
+      "cwe": "CWE-404",
+      "severity": "high",
+      "signature": "a DNS CNAME/AliasTarget points at a service that can be claimed by an attacker (GitHub Pages/S3/Heroku/…)",
+      "chains": [
+        "subdomain_takeover",
+        "subdomain_takeover_to_cookie_theft"
+      ],
+      "references": [
+        "CWE-404",
+        "OWASP WSTG-CONFIG-10",
+        "Can I Take Over XYZ (EdOverflow)"
+      ],
+      "real_world": "A dangling DNS record (CNAME/AliasTarget) points to a service the org no longer owns (e.g. a deleted GitHub Pages repo, S3 bucket, or Heroku app). An attacker re-registers that name and serves arbitrary content from the victim's subdomain — phishing, cookie theft via a parent-domain cookie, and same-origin attacks.",
+      "detection_signatures": [
+        "CNAME/AliasTarget/DNSName -> *.github.io / *.herokuapp.com / *.amazonaws.com / …",
+        "aws_route53_record type=CNAME with an unclaimed service target"
+      ],
+      "chain_templates": [
+        "subdomain_takeover",
+        "subdomain_takeover_to_cookie_theft"
+      ],
+      "bypass_techniques": [
+        "check the CNAME resolves to an NXDOMAIN / 'not found' / unclaimed page",
+        "verify via the service's provisioning page (GitHub 404 'repo not found')"
+      ],
+      "crown_jewels": [
+        "wildcard-scoped parent-domain cookies",
+        "subdomains of SSO/portal/main domains",
+        "email-deliverability subdomains (SPF/DKIM trust)"
+      ],
+      "payout_min": 500,
+      "payout_max": 5000,
+      "typical_payout": "$500–$5K"
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.84",
+  "version": "2.4.85",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {