blitzstrike 2.4.85 → 2.4.87

package/CHANGELOG.md

@@ -5,6 +5,30 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.87] — 2026-09-17
+
+### Fixed — web3 class naming consistency + jwt grounding
+
+- Renamed the web3 class `encodePacked_collision` → `encode_packed_collision`
+  (snake_case, matching the other classes; fixes resolution through canonical id).
+- Added the `jwt` → `jwt_alg_confusion` synonym so the `jwt` attack-vector resolves
+  to its pattern grounding + payout (previously returned no bounty signal).
+
+## [2.4.86] — 2026-09-17
+
+### Added — Web3 audit extended to 13 bug classes
+
+- Reentrancy detector now also catches ERC721/ERC1155 callback reentrancy
+  (`safeTransferFrom` / `safeTransfer` invoke `onERC721Received`/`onERC1155Received`
+  hooks).
+- Oracle-manipulation detector now also catches Uniswap V3 `slot0()` and stale
+  Chainlink `latestRoundData()`/`latestAnswer()` (no `updatedAt` staleness check).
+- New `encodePacked_collision` detector — `keccak256(abi.encodePacked(...))` over
+  dynamic types is not injective (CWE-701).
+- New `address_zero_check` detector — a privileged `setOwner`/`constructor`/
+  `initialize` assigning an address param without `!= address(0)` (CWE-20).
+- Foundry PoC templates added for both new classes; web3 severity now supports `low`.
+
 ## [2.4.85] — 2026-09-17
 
 ### Added — CORS, XSS (DOM sinks), and subdomain-takeover detectors
@@ -23,7 +47,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
   verify harness (now 28/28 TP+TN). Complex-bug scan description + system prompt
   updated.
 
-Competitive analysis source: Awarexone/Agentic-Bug-Hunter (web2-vuln-classes).
 
 ## [2.4.84] — 2026-09-17
 
@@ -42,7 +65,6 @@ Competitive analysis source: Awarexone/Agentic-Bug-Hunter (web2-vuln-classes).
 - System prompt now carries the compressed doctrine inline; `missing_authz` pattern's
   validation mandates the two-account IDOR test (attacker A → victim B).
 
-Competitive analysis source: Awarexone/Agentic-Bug-Hunter (rules/hunting.md +
 reporting.md).
 
 ## [2.4.83] — 2026-09-17
@@ -60,7 +82,6 @@ reporting.md).
   Foundry PoC reproduces it.
 - `.sol` added to the scan extensions.
 
-Competitive analysis source: Awarexone/Agentic-Bug-Hunter (web3-audit + Foundry PoC).
 
 ## [2.4.82] — 2026-09-17
 
@@ -74,7 +95,6 @@ Competitive analysis source: Awarexone/Agentic-Bug-Hunter (web3-audit + Foundry
   ONLY when an interaction for the session's unique id actually arrives. Handles
   interactsh's ANSI-colored `[INF]` banner + JSONL interaction parsing.
 
-Competitive analysis source: Awarexone/Agentic-Bug-Hunter (interactsh OOB).
 
 ## [2.4.81] — 2026-09-17
 
@@ -90,7 +110,6 @@ Competitive analysis source: Awarexone/Agentic-Bug-Hunter (interactsh OOB).
   Non-detector vectors (xss / business_logic / open_redirect / …) fall back to a
   curated PAYOUT_FALLBACK table.
 
-Competitive analysis source: Awarexone/Agentic-Bug-Hunter (impact-first framing).
 
 ## [2.4.80] — 2026-09-17
 

package/dist/index.js

@@ -34491,6 +34491,7 @@ var ALIASES = {
   "rust format string": "rust_format_string",
   "format string": "rust_format_string",
   "format string injection": "rust_format_string",
+  jwt: "jwt_alg_confusion",
   "jwt algorithm confusion": "jwt_alg_confusion",
   "jwt alg confusion": "jwt_alg_confusion",
   "alg confusion": "jwt_alg_confusion",
@@ -60488,7 +60489,9 @@ var SEVERITY = {
   missing_access_control: { severity: "high", cwe: "CWE-284", category: "Privileged function missing access control" },
   timestamp_dependence: { severity: "medium", cwe: "CWE-1164", category: "block.timestamp / block.number dependence" },
   oracle_manipulation: { severity: "high", cwe: "CWE-1235", category: "Spot-price oracle (DEX pair) manipulation" },
-  unbounded_loop: { severity: "medium", cwe: "CWE-834", category: "Unbounded loop over user-controlled length" }
+  unbounded_loop: { severity: "medium", cwe: "CWE-834", category: "Unbounded loop over user-controlled length" },
+  encode_packed_collision: { severity: "high", cwe: "CWE-701", category: "abi.encodePacked hash collision (dynamic types)" },
+  address_zero_check: { severity: "low", cwe: "CWE-20", category: "Missing address(0) validation on privileged assignment" }
 };
 function lines3(code) {
   return code.split(`
@@ -60564,7 +60567,7 @@ function web3Audit(code, file) {
   const out = [];
   const clean = stripComments2(code);
   const ls = lines3(code);
-  const callRe = /\.call\{value:|\.call\(|\.send\(|\.transfer\(/g;
+  const callRe = /\.call\{value:|\.call\(|\.send\(|\.transfer\(|safeTransferFrom\s*\(|safeTransfer\s*\(/g;
   let m;
   while ((m = callRe.exec(clean)) !== null) {
     const ln = lineNo4(code, m.index);
@@ -60631,7 +60634,7 @@ function web3Audit(code, file) {
   while ((m = tsRe.exec(clean)) !== null) {
     push(out, file, code, m.index, "timestamp_dependence", (ls[lineNo4(code, m.index) - 1] ?? "").trim(), "`block.timestamp`/`block.number` is used in critical logic — miners can manipulate it within a range, and it must never be a source of randomness or a payout/auction boundary. Use an oracle (Chainlink VRF) for randomness and tolerate timestamp skew.");
   }
-  const oracleRe = /\bgetReserves\s*\(|\bspotPrice\b|\bgetAmountsOut\s*\(|\bgetAmountOut\s*\(/g;
+  const oracleRe = /\bgetReserves\s*\(|\bspotPrice\b|\bgetAmountsOut\s*\(|\bgetAmountOut\s*\(|\bslot0\s*\(|\blatestRoundData\s*\(|\blatestAnswer\s*\(/g;
   while ((m = oracleRe.exec(clean)) !== null) {
     push(out, file, code, m.index, "oracle_manipulation", (ls[lineNo4(code, m.index) - 1] ?? "").trim(), "A DEX pair's spot price (`getReserves`/`getAmountOut`) is used as a price oracle — it can be manipulated with a flash loan. Use a time-weighted average price (TWAP) or a Chainlink price feed.");
   }
@@ -60645,6 +60648,22 @@ function web3Audit(code, file) {
       continue;
     push(out, file, code, m.index, "unbounded_loop", line.trim(), "A loop iterates over a user-controlled array length with no bound — an attacker can grow the array to force an out-of-gas DoS. Cap the iteration or use a pull-based pattern.");
   }
+  const packedRe = /keccak256\s*\(\s*abi\.encodePacked\s*\(/g;
+  while ((m = packedRe.exec(clean)) !== null) {
+    push(out, file, code, m.index, "encode_packed_collision", (ls[lineNo4(code, m.index) - 1] ?? "").trim(), "`keccak256(abi.encodePacked(...))` over dynamic types (string/bytes/array) is ambiguous — ['a','bc'] and ['ab','c'] pack identically, enabling hash collisions and signature forgery (CWE-701). Use `abi.encode` (which pads + length-prefixes each argument) for any hash or signature digest.");
+  }
+  const zeroCheckRe = /\b(constructor|initialize|setOwner|transferOwnership|setAdmin|setFeeRecipient|setPendingOwner)\s*\(/g;
+  const cleanLines = lines3(clean);
+  while ((m = zeroCheckRe.exec(clean)) !== null) {
+    const ln = lineNo4(code, m.index);
+    const line = ls[ln - 1] ?? "";
+    if (!/\baddress\b/.test(line))
+      continue;
+    const cleanLine = cleanLines[ln - 1] ?? "";
+    if (/address\s*\(\s*0\s*\)/.test(cleanLine) || /!=?\s*address\s*\(\s*0\s*\)/.test(cleanLine))
+      continue;
+    push(out, file, code, m.index, "address_zero_check", line.trim(), "An address parameter is assigned in a privileged function (owner/admin) without a `!= address(0)` check — a zero-address owner can permanently lock the contract. Validate the address before assignment.");
+  }
   const seen = new Set;
   return out.filter((f) => {
     const k = `${f.class_}:${f.line}`;
@@ -60655,7 +60674,7 @@ function web3Audit(code, file) {
   });
 }
 function web3Rank(findings) {
-  const order = { critical: 0, high: 1, medium: 2 };
+  const order = { critical: 0, high: 1, medium: 2, low: 3 };
   const agg = new Map;
   for (const f of findings) {
     const e = agg.get(f.class_) ?? { count: 0, severity: f.severity, cwe: f.cwe };
@@ -60771,6 +60790,18 @@ contract Evil {
         for (uint i = 0; i < 100_000; i++) target.add(address(uint160(i)));
         vm.expectRevert(); // or assert gas consumption
         target.processAll();
+    }`,
+    encode_packed_collision: `    function testEncodePackedCollision() public {
+        // two distinct inputs pack to the same hash
+        bytes32 a = target.hashFor("a", "bc");
+        bytes32 b = target.hashFor("ab", "c");
+        assertEq(a, b, "abi.encodePacked collision");
+    }`,
+    address_zero_check: `    function testAddressZeroCheck() public {
+        // assign the zero address as owner — should revert
+        vm.expectRevert();
+        target.setOwner(address(0));
+        assertTrue(target.owner() != address(0), "zero address became owner");
     }`
   };
   return base + (exploit[cls] ?? exploit.missing_access_control) + `
@@ -61129,7 +61160,7 @@ function createServer2() {
 ` + `- A hard block (Cloudflare/WAF/IP-block/captcha) is NOT the end: mark the finding blocked + note the required vantage (residential / authorized / correct-SNI / --resolve direct-to-origin), then CONTINUE to the next lead (origin bypass, non-prod cluster, mobile APK, subdomain).
 ` + `- Keep trying every lead AND every chain step until each is verified/executed or blocked, THEN generate_report. Never deliver a bare surface map, and never stop at 'found X' when X enables more.
 
-` + "TWO PATHS:\\n" + "- Source path on disk -> blitz_scan / taint_file / eagle_eye2 (static).\\n" + "- Live URL -> live_recon / active_scan / strike_verify (web-hunting).\\n\\n" + "DEEPEN A FINDING: attack_plan(target, tech, params) to get the prioritized vector plan (decide what to test next with data); list_chains (escalation), chain_links (compose), technique_lookup(cls), payload_lookup, bypass_lookup (blocked). Ground any detector hit empirically with pattern_lookup(id) — it returns the class's CWE, real-world signature, escalation chains, citable references, per-class bypass techniques, and the high-value assets (crown jewels) that class hits, so a raw hit becomes a class-aware finding. Resolve free-form terminology first with synonym_lookup(term) (IDOR/BOLA/SQLi/prompt-injection → canonical id). For an llm_injection hit, its pattern carries a validation discipline — the RUN-TWICE RULE (reproduce token-for-token across two fresh sessions), NON-GUESSABLE ANCHOR (must leak a real key/URL, not a plausible guess), and OOB PROOF (a verifiable callback log) — apply all three before reporting. BEFORE generating a report, run submission_gate(...) and only ship a finding that passes all 7 questions (reproducible, in-scope, real-impact, no-privileged-assumption, verified-live, evidence-redacted, severity-derived); one false = kill it. Calibrate severity with severity_calibrate(type, cvss) to get a P1–P5 tier + VRT-style category. Start each engagement with engagement_scaffold(target, scope) for the folder + scope.md structure, and check data_refresh() to confirm the data layers are consistent. Phase doctrine: read_skill(bs-orchestrate-engagement | bs-web-hunting | bs-source-audit | bs-verify-finding). Campaign plan: read_playbook(target-type). On any failure call retry_guidance(signal) / model_fallback(signal) before giving up. HUNTING DOCTRINE (maximize payout rate): (1) SIBLING RULE — if one endpoint requires auth, check every sibling (/export /delete /share); ~30% of paid IDOR/auth bugs come from siblings. (2) A→B SIGNAL — a confirmed bug signals a class of developer mistake; hunt B and C (20-min box) before reporting. (3) TWO-ACCOUNT IDOR — always test with attacker account A reading victim account B, and state it in the report. (4) PoC ESCALATION — IDOR shows victim data (not 200), XSS shows cookie exfil (not alert), SSRF shows internal response (not DNS), SQLi shows DB content (not error). (5) FOLLOW THE MONEY — billing/credits/refunds/wallet flows. (6) Kill weak findings with kill_list(type) BEFORE the gate — missing headers, self-XSS, open-redirect-alone, SSRF-DNS-only, GraphQL-introspection-alone are always N/A standalone. (7) CI/CD + SAML/SSO are critical attack surfaces (pull_request_target, expression injection, XML signature wrapping, comment injection). Full doctrine: hunting_doctrine().\n" + "KNOWLEDGE BASE (discover, don't guess): skillLookup(topic) / listSkills for the 40 attack-path + hunting skills (ap-*, hp-*, bs-*); list_attack_vectors / attack_vectors(cat) for the 34-category vector taxonomy; taxonomy(kind) for OWASP/CWE/ASVS/API-top-10; read_playbook(type) for the 17 campaign playbooks; list_manuals / read_tool_manual for 317 tool references; list_tools / run_catalog_tool for the 141-tool catalog. Every tool, skill, and data layer is reachable from these. CROSS-TARGET INTELLIGENCE: strike_resolve auto-records confirmed/false_positive verdicts into the empirical ledger; query it with intelligence(action=hit_rates/top_vectors/recall) so a new target on a known tech inherits historical hit-rates (attack_plan already blends them into success_probability). intelligence(action=recall, tech, target) is the per-engagement pattern recall — it returns which patterns historically CONFIRMED on that tech (prioritize them) versus which only ever produced false positives (avoid them), so a new engagement starts from the empirical playbook of past ones. LIVE PENTEST + TARGETING (black-box, WAF-safe): cache_gap(base_url, endpoint) fuzzes path-normalization + static-extension variants for cache deception/poisoning; blind_oracle(base_url, param, value) detects which SINK a param reaches (sql/ssti/xss) via benign arithmetic (id=1+0, test${7*7}) WITHOUT a malicious payload; param_precedence(base_url, param, A, B) maps duplicate-parameter precedence (first/last-wins) for WAF-bypass. OOB (out-of-band) PROOF for BLIND vulns: oob_start() spins an interactsh listener (unique *.oast.* domain, streams DNS/HTTP interactions — the standard for public targets) or a local HTTP listener for local labs; inject the canary, then oob_poll(id) until the hit arrives; oob_stop(id) to clean up. A blind SSRF/XXE/SQLi/command-injection is CONFIRMED only when the canary actually arrives — never from a guess. SOURCE TARGETING: action_surface(code) maps every wp_ajax_* action to its vuln class + DERIVED priority (what to look for WHERE); security_state(sanitizers, sink) gives a wrong-context sanitization verdict; framework_knowledge(framework) returns auth/nonce primitives for 9 frameworks; variant_scan(root, signature) mass-sweeps an install base for ONE bug family; patch_analyze(old, new) REVERSES a security patch into the 0-day, and its mine_signature feeds variant_scan to sweep unpatched copies. All of these are DETECTION HINTS — verify each live (strike_verify / browser_validate) before it enters the report. NEWEST DETECTORS — understand AND try them: variant_scan also emits priv_esc (privilege escalation — a role/capability/user change fed by request input, traced cross-file via reverse call-graph, e.g. set_role($id, sanitize_key($_POST['um-role'])) or update_user_meta(...,'wp_capabilities', $_POST[...])) and flags uploadAllow=>array('all') unrestricted-upload configs as file_upload (the file-manager/connector shape). TO TRY a priv_esc hit: submit the role field with 'administrator' (or send wp_capabilities meta) and confirm the account actually gains admin. TO TRY an unrestricted-upload hit: POST a .php/.phtml and confirm it lands web-reachable + executes. variant_scan also emits hardcoded_secret (CWE-798) in three tiers: a secret field (api_key/db_password/access_token/aws_*) assigned a literal (HIGH), a known secret FORMAT (JWT eyJ…/AWS AKIA…/GitHub ghp_…/Slack xoxb-…/…) regardless of name (HIGH), or a high-entropy suspect token (MEDIUM — verify before reporting). Verify a frontend/JS secret live via drive_devtools (inspect the JS bundle / network response and confirm the key is actually exposed), and for a backend secret confirm it is reachable/valid. A static hit is a HYPOTHESIS until verified live — never report unverified. For a repo, also scan_git_history(root) — secrets DELETED from HEAD still live in .git history (the removed-later-is-not-fixed trap), and it feeds every recovered pre-deletion blob through the same secret detector. Once you recover a credential, prove it is still ACTIVE with validate_leaked_key(apiBase, endpoints, key|blobUrl) — a READ-ONLY differential test (401-without-key vs 200-with-key = auth bypass PROVEN). Two supply-chain detectors: dependency_confusion (a manifest/build file resolving a package from a public registry — pypi.org/npmjs.org --extra-index-url, or a scoped @company/pkg with no private registry) and ml_supply_chain (torch.load without weights_only=True / joblib.load / np.load(allow_pickle=True) / keras load_model on an untrusted model → pickle RCE). Rust is supported end-to-end: the taint engine (blitz_scan / taint_file) maps Rust sinks (std::process::Command, sqlx/diesel, reqwest/hyper, std::fs, serde/bincode) to the classic classes, plus two Rust-specific detectors — rust_unsafe (transmute / assume_init / from_raw_parts / ptr::* — memory-unsafety surface, CWE-119) and rust_format_string (println!/format! with a variable as the format string — CWE-134). The sqlx query! compile-time macro is treated as safe (suppressed). Two more web-class detectors: jwt_alg_confusion (a JWT verifier that dispatches on the token's alg header and accepts BOTH RS256 and HS256, with the HS256 HMAC secret derived from public/shared key material — CWE-347; the attacker sets alg=HS256 and signs with the public key to forge admin tokens) and cache_deception (a reverse proxy caching static-extension URLs with a cache key that omits the session cookie, over a session-authenticated backend — CWE-525; the victim's cached private response is re-fetched anonymously). TO TRY a jwt_alg_confusion hit: fetch the public key (/.well-known/jwks.json), forge an HS256 token signed with that public key, and confirm admin access. TO TRY a cache_deception hit: request an authenticated path with a static extension appended (.css/.js) and re-fetch it anonymously. Three more detectors: cors_misconfiguration (Access-Control-Allow-Origin reflects the request Origin or is '*' while credentials are true — CWE-942; any site reads the victim's authenticated responses), xss (user input into a DOM sink — innerHTML / dangerouslySetInnerHTML / document.write / .html() / eval — CWE-79), and subdomain_takeover (a dangling CNAME/AliasTarget to a claimable service like *.github.io/*.herokuapp.com/*.amazonaws.com — CWE-404). TO TRY a cors hit: send an evil Origin + confirm the response echoes it with Allow-Credentials:true. TO TRY an xss hit: confirm the sink executes (drive_devtools). TO TRY a takeover hit: verify the CNAME target resolves to an unclaimed/not-found page. WEB3: for Solidity/EVM, call web3_audit(code|path) — a deterministic 10-class smart-contract audit (reentrancy, unchecked return, unchecked arithmetic, tx.origin auth, signature replay, unprotected selfdestruct, delegatecall-to-user-input, missing access control, timestamp dependence, spot-price oracle manipulation, unbounded loop) returning ranked findings (class/CWE/severity/line), then foundry_poc(class, contract) to generate an executable Foundry test that PROVES the bug. A web3 hit is a HYPOTHESIS until the Foundry PoC reproduces it.\n" + `PRECISION ANALYSIS — chrome-devtools MCP is MANDATORY, not optional:
+` + "TWO PATHS:\\n" + "- Source path on disk -> blitz_scan / taint_file / eagle_eye2 (static).\\n" + "- Live URL -> live_recon / active_scan / strike_verify (web-hunting).\\n\\n" + "DEEPEN A FINDING: attack_plan(target, tech, params) to get the prioritized vector plan (decide what to test next with data); list_chains (escalation), chain_links (compose), technique_lookup(cls), payload_lookup, bypass_lookup (blocked). Ground any detector hit empirically with pattern_lookup(id) — it returns the class's CWE, real-world signature, escalation chains, citable references, per-class bypass techniques, and the high-value assets (crown jewels) that class hits, so a raw hit becomes a class-aware finding. Resolve free-form terminology first with synonym_lookup(term) (IDOR/BOLA/SQLi/prompt-injection → canonical id). For an llm_injection hit, its pattern carries a validation discipline — the RUN-TWICE RULE (reproduce token-for-token across two fresh sessions), NON-GUESSABLE ANCHOR (must leak a real key/URL, not a plausible guess), and OOB PROOF (a verifiable callback log) — apply all three before reporting. BEFORE generating a report, run submission_gate(...) and only ship a finding that passes all 7 questions (reproducible, in-scope, real-impact, no-privileged-assumption, verified-live, evidence-redacted, severity-derived); one false = kill it. Calibrate severity with severity_calibrate(type, cvss) to get a P1–P5 tier + VRT-style category. Start each engagement with engagement_scaffold(target, scope) for the folder + scope.md structure, and check data_refresh() to confirm the data layers are consistent. Phase doctrine: read_skill(bs-orchestrate-engagement | bs-web-hunting | bs-source-audit | bs-verify-finding). Campaign plan: read_playbook(target-type). On any failure call retry_guidance(signal) / model_fallback(signal) before giving up. HUNTING DOCTRINE (maximize payout rate): (1) SIBLING RULE — if one endpoint requires auth, check every sibling (/export /delete /share); ~30% of paid IDOR/auth bugs come from siblings. (2) A→B SIGNAL — a confirmed bug signals a class of developer mistake; hunt B and C (20-min box) before reporting. (3) TWO-ACCOUNT IDOR — always test with attacker account A reading victim account B, and state it in the report. (4) PoC ESCALATION — IDOR shows victim data (not 200), XSS shows cookie exfil (not alert), SSRF shows internal response (not DNS), SQLi shows DB content (not error). (5) FOLLOW THE MONEY — billing/credits/refunds/wallet flows. (6) Kill weak findings with kill_list(type) BEFORE the gate — missing headers, self-XSS, open-redirect-alone, SSRF-DNS-only, GraphQL-introspection-alone are always N/A standalone. (7) CI/CD + SAML/SSO are critical attack surfaces (pull_request_target, expression injection, XML signature wrapping, comment injection). Full doctrine: hunting_doctrine().\n" + "KNOWLEDGE BASE (discover, don't guess): skillLookup(topic) / listSkills for the 40 attack-path + hunting skills (ap-*, hp-*, bs-*); list_attack_vectors / attack_vectors(cat) for the 34-category vector taxonomy; taxonomy(kind) for OWASP/CWE/ASVS/API-top-10; read_playbook(type) for the 17 campaign playbooks; list_manuals / read_tool_manual for 317 tool references; list_tools / run_catalog_tool for the 141-tool catalog. Every tool, skill, and data layer is reachable from these. CROSS-TARGET INTELLIGENCE: strike_resolve auto-records confirmed/false_positive verdicts into the empirical ledger; query it with intelligence(action=hit_rates/top_vectors/recall) so a new target on a known tech inherits historical hit-rates (attack_plan already blends them into success_probability). intelligence(action=recall, tech, target) is the per-engagement pattern recall — it returns which patterns historically CONFIRMED on that tech (prioritize them) versus which only ever produced false positives (avoid them), so a new engagement starts from the empirical playbook of past ones. LIVE PENTEST + TARGETING (black-box, WAF-safe): cache_gap(base_url, endpoint) fuzzes path-normalization + static-extension variants for cache deception/poisoning; blind_oracle(base_url, param, value) detects which SINK a param reaches (sql/ssti/xss) via benign arithmetic (id=1+0, test${7*7}) WITHOUT a malicious payload; param_precedence(base_url, param, A, B) maps duplicate-parameter precedence (first/last-wins) for WAF-bypass. OOB (out-of-band) PROOF for BLIND vulns: oob_start() spins an interactsh listener (unique *.oast.* domain, streams DNS/HTTP interactions — the standard for public targets) or a local HTTP listener for local labs; inject the canary, then oob_poll(id) until the hit arrives; oob_stop(id) to clean up. A blind SSRF/XXE/SQLi/command-injection is CONFIRMED only when the canary actually arrives — never from a guess. SOURCE TARGETING: action_surface(code) maps every wp_ajax_* action to its vuln class + DERIVED priority (what to look for WHERE); security_state(sanitizers, sink) gives a wrong-context sanitization verdict; framework_knowledge(framework) returns auth/nonce primitives for 9 frameworks; variant_scan(root, signature) mass-sweeps an install base for ONE bug family; patch_analyze(old, new) REVERSES a security patch into the 0-day, and its mine_signature feeds variant_scan to sweep unpatched copies. All of these are DETECTION HINTS — verify each live (strike_verify / browser_validate) before it enters the report. NEWEST DETECTORS — understand AND try them: variant_scan also emits priv_esc (privilege escalation — a role/capability/user change fed by request input, traced cross-file via reverse call-graph, e.g. set_role($id, sanitize_key($_POST['um-role'])) or update_user_meta(...,'wp_capabilities', $_POST[...])) and flags uploadAllow=>array('all') unrestricted-upload configs as file_upload (the file-manager/connector shape). TO TRY a priv_esc hit: submit the role field with 'administrator' (or send wp_capabilities meta) and confirm the account actually gains admin. TO TRY an unrestricted-upload hit: POST a .php/.phtml and confirm it lands web-reachable + executes. variant_scan also emits hardcoded_secret (CWE-798) in three tiers: a secret field (api_key/db_password/access_token/aws_*) assigned a literal (HIGH), a known secret FORMAT (JWT eyJ…/AWS AKIA…/GitHub ghp_…/Slack xoxb-…/…) regardless of name (HIGH), or a high-entropy suspect token (MEDIUM — verify before reporting). Verify a frontend/JS secret live via drive_devtools (inspect the JS bundle / network response and confirm the key is actually exposed), and for a backend secret confirm it is reachable/valid. A static hit is a HYPOTHESIS until verified live — never report unverified. For a repo, also scan_git_history(root) — secrets DELETED from HEAD still live in .git history (the removed-later-is-not-fixed trap), and it feeds every recovered pre-deletion blob through the same secret detector. Once you recover a credential, prove it is still ACTIVE with validate_leaked_key(apiBase, endpoints, key|blobUrl) — a READ-ONLY differential test (401-without-key vs 200-with-key = auth bypass PROVEN). Two supply-chain detectors: dependency_confusion (a manifest/build file resolving a package from a public registry — pypi.org/npmjs.org --extra-index-url, or a scoped @company/pkg with no private registry) and ml_supply_chain (torch.load without weights_only=True / joblib.load / np.load(allow_pickle=True) / keras load_model on an untrusted model → pickle RCE). Rust is supported end-to-end: the taint engine (blitz_scan / taint_file) maps Rust sinks (std::process::Command, sqlx/diesel, reqwest/hyper, std::fs, serde/bincode) to the classic classes, plus two Rust-specific detectors — rust_unsafe (transmute / assume_init / from_raw_parts / ptr::* — memory-unsafety surface, CWE-119) and rust_format_string (println!/format! with a variable as the format string — CWE-134). The sqlx query! compile-time macro is treated as safe (suppressed). Two more web-class detectors: jwt_alg_confusion (a JWT verifier that dispatches on the token's alg header and accepts BOTH RS256 and HS256, with the HS256 HMAC secret derived from public/shared key material — CWE-347; the attacker sets alg=HS256 and signs with the public key to forge admin tokens) and cache_deception (a reverse proxy caching static-extension URLs with a cache key that omits the session cookie, over a session-authenticated backend — CWE-525; the victim's cached private response is re-fetched anonymously). TO TRY a jwt_alg_confusion hit: fetch the public key (/.well-known/jwks.json), forge an HS256 token signed with that public key, and confirm admin access. TO TRY a cache_deception hit: request an authenticated path with a static extension appended (.css/.js) and re-fetch it anonymously. Three more detectors: cors_misconfiguration (Access-Control-Allow-Origin reflects the request Origin or is '*' while credentials are true — CWE-942; any site reads the victim's authenticated responses), xss (user input into a DOM sink — innerHTML / dangerouslySetInnerHTML / document.write / .html() / eval — CWE-79), and subdomain_takeover (a dangling CNAME/AliasTarget to a claimable service like *.github.io/*.herokuapp.com/*.amazonaws.com — CWE-404). TO TRY a cors hit: send an evil Origin + confirm the response echoes it with Allow-Credentials:true. TO TRY an xss hit: confirm the sink executes (drive_devtools). TO TRY a takeover hit: verify the CNAME target resolves to an unclaimed/not-found page. WEB3: for Solidity/EVM, call web3_audit(code|path) — a deterministic 13-class smart-contract audit (reentrancy incl. ERC721/ERC1155 callback reentrancy, unchecked return, unchecked arithmetic, tx.origin auth, signature replay, unprotected selfdestruct, delegatecall-to-user-input, missing access control, timestamp dependence, spot-price oracle manipulation incl. slot0/latestRoundData, unbounded loop, abi.encodePacked hash collision, missing address(0) validation) returning ranked findings (class/CWE/severity/line), then foundry_poc(class, contract) to generate an executable Foundry test that PROVES the bug. A web3 hit is a HYPOTHESIS until the Foundry PoC reproduces it.\n" + `PRECISION ANALYSIS — chrome-devtools MCP is MANDATORY, not optional:
 ` + `- When a lead needs DOM/JS precision — DOM-XSS sink execution, AJAX endpoint + payload interception, JS runtime errors, redirect chains, SSO/token flow, or anything a static HTML glance cannot prove — call drive_devtools(target). It spawns chrome-devtools-mcp and drives a REAL headless browser (navigate -> list_network_requests -> list_console_messages -> evaluate_script), giving reproducible evidence instead of a guess.
 ` + `- Before calling it, check_mcp() to confirm the browser MCP is available; if not, blitzstrike install-tools or npm i -g chrome-devtools-mcp. Never substitute eyeballing minified JS or a static sink guess when a live browser can PROVE it. This is the precision + consistency layer.
 ` + "EXTERNAL MCP SERVERS (verified, connect them — NOT one-shot CLIs): chrome-devtools-mcp (29 tools: list_network_requests/get_network_request for raw HTTP interception, list_console_messages for JS errors + DOM-XSS, evaluate_script to run JS, take_screenshot) -> stdio chrome-devtools-mcp --headless --chromeArg=--no-sandbox --chromeArg=--disable-gpu (as root/container this is MANDATORY or the browser crashes; add --proxyServer http://127.0.0.1:8080 to route through Burp, --acceptInsecureCerts for bad TLS). burp-suite-mcp (proxy history + active scan + repeater) -> NOT npm: build the JAR (git clone https://github.com/PortSwigger/mcp-server.git && cd mcp-server && ./gradlew embedProxyJar), load it in Burp Extensions, then connect the client to http://127.0.0.1:9876 (SSE) or the stdio proxy java -jar mcp-proxy-all.jar --sse-url http://127.0.0.1:9876."
@@ -62081,8 +62112,8 @@ ${statusLine}` : statusLine },
     return { content: [{ type: "text", text: JSON.stringify(oobList()) }] };
   });
   server.registerTool("web3_audit", {
-    title: "Solidity / smart-contract audit (10 bug classes + Foundry PoC)",
-    description: "WEB3: deterministic Solidity audit for the 10 highest-value smart-contract bug classes — reentrancy, unchecked return value, unchecked arithmetic, tx.origin auth, signature replay, unprotected selfdestruct, delegatecall-to-user-input, missing access control, timestamp dependence, spot-price oracle manipulation, and unbounded loops. Pass raw Solidity source (or a path) to get ranked findings (class, CWE, severity, line, evidence). Then call foundry_poc(class, contract) to generate an executable Foundry test template that proves the bug. A hit is a HYPOTHESIS until the Foundry PoC reproduces it.",
+    title: "Solidity / smart-contract audit (13 bug classes + Foundry PoC)",
+    description: "WEB3: deterministic Solidity audit for the 13 highest-value smart-contract bug classes — reentrancy (incl. ERC721/ERC1155 safeTransfer callback reentrancy), unchecked return value, unchecked arithmetic, tx.origin auth, signature replay, unprotected selfdestruct, delegatecall-to-user-input, missing access control, timestamp dependence, spot-price oracle manipulation (getReserves/slot0/latestRoundData), unbounded loops, abi.encodePacked hash collision, and missing address(0) validation. Pass raw Solidity source (or a path) to get ranked findings (class, CWE, severity, line, evidence). Then call foundry_poc(class, contract) to generate an executable Foundry test template that proves the bug. A hit is a HYPOTHESIS until the Foundry PoC reproduces it.",
     inputSchema: {
       code: string2().optional().describe("Raw Solidity source"),
       path: string2().optional().describe("Path to a .sol file")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.85",
+  "version": "2.4.87",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {