blitzstrike 2.4.88 → 2.4.89

package/CHANGELOG.md

@@ -5,6 +5,19 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.89] — 2026-09-17
+
+### Added — Sibling Rule Engine (deterministic live logic-bug prober)
+
+- New `sibling_scan(base_url, endpoint, token_a, token_b, object_id_b)` tool — a
+  deterministic, evidence-first live prober that closes the gap static detectors
+  cannot cover (the 18 logic-bug FNs): (1) enumerates sibling paths (/export /delete
+  /share /{id} /list /settings …), (2) differential IDOR — the victim's object
+  fetched with the ATTACKER's token (a 200 with A's token + B's id = IDOR proven),
+  (3) auth matrix — each sibling probed with no token (a 2xx/3xx = missing auth),
+  (4) mass assignment — role/admin field injection on POST/PUT, (5) rate limit —
+  15 rapid requests. Hits-only, differential (status + body), real-time append.
+
 ## [2.4.88] — 2026-09-17
 
 ### Changed — XSS detector precision (local taint flow)

package/dist/index.js

@@ -60925,6 +60925,225 @@ function huntingDoctrine() {
   };
 }
 
+// src/sibling-scan.ts
+var SIBLING_SUFFIXES = [
+  "export",
+  "download",
+  "delete",
+  "remove",
+  "share",
+  "update",
+  "edit",
+  "settings",
+  "profile",
+  "details",
+  "info",
+  "list",
+  "all",
+  "index",
+  "invoices",
+  "payments",
+  "billing",
+  "orders",
+  "transactions",
+  "permissions",
+  "roles",
+  "admin",
+  "members",
+  "users",
+  "api_key",
+  "token",
+  "config",
+  "audit",
+  "log",
+  "history",
+  "activity",
+  "export_all",
+  "bulk",
+  "dump"
+];
+var MASS_ASSIGNMENT_FIELDS = ["role", "is_admin", "isAdmin", "admin", "is_staff", "group", "scope", "tenant_id"];
+function stripTrailingSlash(u) {
+  return u.replace(/\/+$/, "");
+}
+function extractObjectId(endpoint) {
+  const segs = endpoint.split("/").filter(Boolean);
+  for (const s of segs) {
+    if (/^\d+$/.test(s))
+      return s;
+    if (/^[0-9a-f]{8}-[0-9a-f-]{27,}$/i.test(s))
+      return s;
+  }
+  return null;
+}
+function swapObjectId(endpoint, newId) {
+  const segs = endpoint.split("/").filter(Boolean);
+  let replaced = false;
+  const out = segs.map((s) => {
+    if (!replaced && (/^\d+$/.test(s) || /^[0-9a-f]{8}-[0-9a-f-]{27,}$/i.test(s))) {
+      replaced = true;
+      return newId ?? s;
+    }
+    return s;
+  });
+  return "/" + out.join("/");
+}
+function generateSiblings(endpoint, objectIdB) {
+  const base = endpoint.split("?")[0];
+  const out = new Set;
+  const id = objectIdB ?? extractObjectId(base);
+  const baseNoId = id ? swapObjectId(base, null) : base;
+  const parent = baseNoId.split("/").slice(0, -1).join("/");
+  for (const sfx of SIBLING_SUFFIXES) {
+    out.add(`${baseNoId}/${sfx}`);
+    if (parent)
+      out.add(`${parent}/${sfx}`);
+  }
+  if (id) {
+    out.add(swapObjectId(base, "0"));
+    out.add(swapObjectId(base, "1"));
+    out.add(swapObjectId(base, id));
+    for (const sfx of ["export", "download", "delete", "share", "settings", "invoices", "permissions", "orders", "details"]) {
+      out.add(`${swapObjectId(base, id)}/${sfx}`);
+    }
+  }
+  if (parent) {
+    out.add(parent);
+    out.add(`${parent}/all`);
+    out.add(`${parent}/list`);
+  }
+  return [...out].filter((p) => p !== base).slice(0, 80);
+}
+async function httpReq(url, method, token, body, timeoutMs = 8000) {
+  const headers = { "User-Agent": "blitzstrike/2" };
+  if (token)
+    headers["Authorization"] = token.startsWith("Bearer ") ? token : `Bearer ${token}`;
+  if (body)
+    headers["Content-Type"] = "application/json";
+  const ctrl = new AbortController;
+  const t = setTimeout(() => ctrl.abort(), timeoutMs);
+  try {
+    const res = await fetch(url, { method, headers, body, signal: ctrl.signal, redirect: "manual" });
+    const text = await res.text();
+    return { status: res.status, size: text.length, preview: text.slice(0, 200).replace(/\s+/g, " ").trim(), ok: res.ok };
+  } catch {
+    return { status: 0, size: 0, preview: "(network error/timeout)", ok: false };
+  } finally {
+    clearTimeout(t);
+  }
+}
+async function siblingScan(input) {
+  const base = stripTrailingSlash(input.baseUrl);
+  const endpoint = input.endpoint.startsWith("/") ? input.endpoint : `/${input.endpoint}`;
+  const methods = input.methods ?? ["GET"];
+  const maxSiblings = input.maxSiblings ?? 60;
+  const timeoutMs = input.timeoutMs ?? 8000;
+  const objectIdB = input.objectIdB ?? extractObjectId(endpoint);
+  const findings = [];
+  const siblings = generateSiblings(endpoint, objectIdB ?? undefined).slice(0, maxSiblings);
+  let tested = 0;
+  const record = (f) => {
+    findings.push(f);
+    if (findings.length <= 200)
+      console.log(JSON.stringify(f));
+  };
+  for (const sib of siblings) {
+    for (const method of methods) {
+      tested++;
+      const url = `${base}${sib}`;
+      const noAuth = await httpReq(url, method, undefined, undefined, timeoutMs);
+      if (noAuth.status >= 200 && noAuth.status < 400) {
+        record({
+          endpoint: sib,
+          method,
+          test: "auth_matrix",
+          severity: "high",
+          verdict: `Missing authorization — ${method} ${sib} returns HTTP ${noAuth.status} with NO token`,
+          request: `${method} ${url} (no auth)`,
+          evidence: `HTTP ${noAuth.status}, ${noAuth.size}B body: ${noAuth.preview}`
+        });
+      }
+      if (input.tokenA && objectIdB) {
+        const victimUrl = `${base}${swapObjectId(sib, objectIdB)}`;
+        const victimBaseline = await httpReq(victimUrl, method, input.tokenB, undefined, timeoutMs);
+        const attackerOnVictim = await httpReq(victimUrl, method, input.tokenA, undefined, timeoutMs);
+        if (attackerOnVictim.status >= 200 && attackerOnVictim.status < 400) {
+          const sameAsVictim = victimBaseline.ok && Math.abs(victimBaseline.size - attackerOnVictim.size) <= Math.max(64, victimBaseline.size * 0.1);
+          record({
+            endpoint: victimUrl.replace(base, ""),
+            method,
+            test: "idor",
+            severity: "high",
+            verdict: `IDOR — attacker A reads victim B's object (HTTP ${attackerOnVictim.status} with A's token + B's id${sameAsVictim ? ", body matches B's baseline" : ""})`,
+            request: `${method} ${victimUrl} (token A, object id B)`,
+            evidence: `A=${attackerOnVictim.status}/${attackerOnVictim.size}B vs B=${victimBaseline.status}/${victimBaseline.size}B → ${attackerOnVictim.preview}`
+          });
+        }
+      }
+    }
+  }
+  if ((methods.includes("POST") || methods.includes("PUT")) && input.tokenA) {
+    const createLike = siblings.filter((s) => /register|create|signup|user|admin|member/i.test(s)).slice(0, 5);
+    if (createLike.length === 0)
+      createLike.push(endpoint);
+    for (const sib of createLike.slice(0, 3)) {
+      const url = `${base}${sib}`;
+      for (const field of MASS_ASSIGNMENT_FIELDS) {
+        const body = JSON.stringify({ [field]: "admin", email: "attacker@example.com", name: "attacker" });
+        const res = await httpReq(url, "POST", input.tokenA, body, timeoutMs);
+        tested++;
+        if (res.ok && /admin|"role"|is_admin/i.test(res.preview)) {
+          record({
+            endpoint: sib,
+            method: "POST",
+            test: "mass_assignment",
+            severity: "high",
+            verdict: `Mass assignment — injecting '${field}=admin' on ${sib} returns ${res.status} and reflects admin/role`,
+            request: `POST ${url} body={${field}:admin,...}`,
+            evidence: `HTTP ${res.status}, ${res.size}B: ${res.preview}`
+          });
+          break;
+        }
+      }
+    }
+  }
+  const sensitive = siblings.find((s) => /export|download|invoice|payment|user|admin|token|api_key/i.test(s)) ?? endpoint;
+  const url = `${base}${sensitive}`;
+  let allPassed = 0;
+  for (let i = 0;i < 15; i++) {
+    const res = await httpReq(url, "GET", input.tokenA, undefined, Math.min(timeoutMs, 4000));
+    tested++;
+    if (res.status >= 200 && res.status < 400)
+      allPassed++;
+  }
+  if (allPassed >= 15) {
+    record({
+      endpoint: sensitive,
+      method: "GET",
+      test: "rate_limit",
+      severity: "medium",
+      verdict: `Rate limit missing/weak — 15/15 rapid requests to ${sensitive} all succeeded (no 429)`,
+      request: `GET ${url} ×15 (token A)`,
+      evidence: `${allPassed}/15 requests returned non-denied status`
+    });
+  }
+  return {
+    base_url: base,
+    endpoint,
+    object_id_b: objectIdB,
+    siblings_enumerated: siblings.length,
+    requests_made: tested,
+    findings,
+    summary: {
+      total: findings.length,
+      idor: findings.filter((f) => f.test === "idor").length,
+      auth_matrix: findings.filter((f) => f.test === "auth_matrix").length,
+      mass_assignment: findings.filter((f) => f.test === "mass_assignment").length,
+      rate_limit: findings.filter((f) => f.test === "rate_limit").length
+    }
+  };
+}
+
 // src/enterprise-benchmark.ts
 import { existsSync as existsSync14, readFileSync as readFileSync25, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
 import { join as join23, resolve } from "node:path";
@@ -61182,7 +61401,7 @@ function createServer2() {
 ` + `- A hard block (Cloudflare/WAF/IP-block/captcha) is NOT the end: mark the finding blocked + note the required vantage (residential / authorized / correct-SNI / --resolve direct-to-origin), then CONTINUE to the next lead (origin bypass, non-prod cluster, mobile APK, subdomain).
 ` + `- Keep trying every lead AND every chain step until each is verified/executed or blocked, THEN generate_report. Never deliver a bare surface map, and never stop at 'found X' when X enables more.
 
-` + "TWO PATHS:\\n" + "- Source path on disk -> blitz_scan / taint_file / eagle_eye2 (static).\\n" + "- Live URL -> live_recon / active_scan / strike_verify (web-hunting).\\n\\n" + "DEEPEN A FINDING: attack_plan(target, tech, params) to get the prioritized vector plan (decide what to test next with data); list_chains (escalation), chain_links (compose), technique_lookup(cls), payload_lookup, bypass_lookup (blocked). Ground any detector hit empirically with pattern_lookup(id) — it returns the class's CWE, real-world signature, escalation chains, citable references, per-class bypass techniques, and the high-value assets (crown jewels) that class hits, so a raw hit becomes a class-aware finding. Resolve free-form terminology first with synonym_lookup(term) (IDOR/BOLA/SQLi/prompt-injection → canonical id). For an llm_injection hit, its pattern carries a validation discipline — the RUN-TWICE RULE (reproduce token-for-token across two fresh sessions), NON-GUESSABLE ANCHOR (must leak a real key/URL, not a plausible guess), and OOB PROOF (a verifiable callback log) — apply all three before reporting. BEFORE generating a report, run submission_gate(...) and only ship a finding that passes all 7 questions (reproducible, in-scope, real-impact, no-privileged-assumption, verified-live, evidence-redacted, severity-derived); one false = kill it. Calibrate severity with severity_calibrate(type, cvss) to get a P1–P5 tier + VRT-style category. Start each engagement with engagement_scaffold(target, scope) for the folder + scope.md structure, and check data_refresh() to confirm the data layers are consistent. Phase doctrine: read_skill(bs-orchestrate-engagement | bs-web-hunting | bs-source-audit | bs-verify-finding). Campaign plan: read_playbook(target-type). On any failure call retry_guidance(signal) / model_fallback(signal) before giving up. HUNTING DOCTRINE (maximize payout rate): (1) SIBLING RULE — if one endpoint requires auth, check every sibling (/export /delete /share); ~30% of paid IDOR/auth bugs come from siblings. (2) A→B SIGNAL — a confirmed bug signals a class of developer mistake; hunt B and C (20-min box) before reporting. (3) TWO-ACCOUNT IDOR — always test with attacker account A reading victim account B, and state it in the report. (4) PoC ESCALATION — IDOR shows victim data (not 200), XSS shows cookie exfil (not alert), SSRF shows internal response (not DNS), SQLi shows DB content (not error). (5) FOLLOW THE MONEY — billing/credits/refunds/wallet flows. (6) Kill weak findings with kill_list(type) BEFORE the gate — missing headers, self-XSS, open-redirect-alone, SSRF-DNS-only, GraphQL-introspection-alone are always N/A standalone. (7) CI/CD + SAML/SSO are critical attack surfaces (pull_request_target, expression injection, XML signature wrapping, comment injection). Full doctrine: hunting_doctrine().\n" + "KNOWLEDGE BASE (discover, don't guess): skillLookup(topic) / listSkills for the 40 attack-path + hunting skills (ap-*, hp-*, bs-*); list_attack_vectors / attack_vectors(cat) for the 34-category vector taxonomy; taxonomy(kind) for OWASP/CWE/ASVS/API-top-10; read_playbook(type) for the 17 campaign playbooks; list_manuals / read_tool_manual for 317 tool references; list_tools / run_catalog_tool for the 141-tool catalog. Every tool, skill, and data layer is reachable from these. CROSS-TARGET INTELLIGENCE: strike_resolve auto-records confirmed/false_positive verdicts into the empirical ledger; query it with intelligence(action=hit_rates/top_vectors/recall) so a new target on a known tech inherits historical hit-rates (attack_plan already blends them into success_probability). intelligence(action=recall, tech, target) is the per-engagement pattern recall — it returns which patterns historically CONFIRMED on that tech (prioritize them) versus which only ever produced false positives (avoid them), so a new engagement starts from the empirical playbook of past ones. LIVE PENTEST + TARGETING (black-box, WAF-safe): cache_gap(base_url, endpoint) fuzzes path-normalization + static-extension variants for cache deception/poisoning; blind_oracle(base_url, param, value) detects which SINK a param reaches (sql/ssti/xss) via benign arithmetic (id=1+0, test${7*7}) WITHOUT a malicious payload; param_precedence(base_url, param, A, B) maps duplicate-parameter precedence (first/last-wins) for WAF-bypass. OOB (out-of-band) PROOF for BLIND vulns: oob_start() spins an interactsh listener (unique *.oast.* domain, streams DNS/HTTP interactions — the standard for public targets) or a local HTTP listener for local labs; inject the canary, then oob_poll(id) until the hit arrives; oob_stop(id) to clean up. A blind SSRF/XXE/SQLi/command-injection is CONFIRMED only when the canary actually arrives — never from a guess. SOURCE TARGETING: action_surface(code) maps every wp_ajax_* action to its vuln class + DERIVED priority (what to look for WHERE); security_state(sanitizers, sink) gives a wrong-context sanitization verdict; framework_knowledge(framework) returns auth/nonce primitives for 9 frameworks; variant_scan(root, signature) mass-sweeps an install base for ONE bug family; patch_analyze(old, new) REVERSES a security patch into the 0-day, and its mine_signature feeds variant_scan to sweep unpatched copies. All of these are DETECTION HINTS — verify each live (strike_verify / browser_validate) before it enters the report. NEWEST DETECTORS — understand AND try them: variant_scan also emits priv_esc (privilege escalation — a role/capability/user change fed by request input, traced cross-file via reverse call-graph, e.g. set_role($id, sanitize_key($_POST['um-role'])) or update_user_meta(...,'wp_capabilities', $_POST[...])) and flags uploadAllow=>array('all') unrestricted-upload configs as file_upload (the file-manager/connector shape). TO TRY a priv_esc hit: submit the role field with 'administrator' (or send wp_capabilities meta) and confirm the account actually gains admin. TO TRY an unrestricted-upload hit: POST a .php/.phtml and confirm it lands web-reachable + executes. variant_scan also emits hardcoded_secret (CWE-798) in three tiers: a secret field (api_key/db_password/access_token/aws_*) assigned a literal (HIGH), a known secret FORMAT (JWT eyJ…/AWS AKIA…/GitHub ghp_…/Slack xoxb-…/…) regardless of name (HIGH), or a high-entropy suspect token (MEDIUM — verify before reporting). Verify a frontend/JS secret live via drive_devtools (inspect the JS bundle / network response and confirm the key is actually exposed), and for a backend secret confirm it is reachable/valid. A static hit is a HYPOTHESIS until verified live — never report unverified. For a repo, also scan_git_history(root) — secrets DELETED from HEAD still live in .git history (the removed-later-is-not-fixed trap), and it feeds every recovered pre-deletion blob through the same secret detector. Once you recover a credential, prove it is still ACTIVE with validate_leaked_key(apiBase, endpoints, key|blobUrl) — a READ-ONLY differential test (401-without-key vs 200-with-key = auth bypass PROVEN). Two supply-chain detectors: dependency_confusion (a manifest/build file resolving a package from a public registry — pypi.org/npmjs.org --extra-index-url, or a scoped @company/pkg with no private registry) and ml_supply_chain (torch.load without weights_only=True / joblib.load / np.load(allow_pickle=True) / keras load_model on an untrusted model → pickle RCE). Rust is supported end-to-end: the taint engine (blitz_scan / taint_file) maps Rust sinks (std::process::Command, sqlx/diesel, reqwest/hyper, std::fs, serde/bincode) to the classic classes, plus two Rust-specific detectors — rust_unsafe (transmute / assume_init / from_raw_parts / ptr::* — memory-unsafety surface, CWE-119) and rust_format_string (println!/format! with a variable as the format string — CWE-134). The sqlx query! compile-time macro is treated as safe (suppressed). Two more web-class detectors: jwt_alg_confusion (a JWT verifier that dispatches on the token's alg header and accepts BOTH RS256 and HS256, with the HS256 HMAC secret derived from public/shared key material — CWE-347; the attacker sets alg=HS256 and signs with the public key to forge admin tokens) and cache_deception (a reverse proxy caching static-extension URLs with a cache key that omits the session cookie, over a session-authenticated backend — CWE-525; the victim's cached private response is re-fetched anonymously). TO TRY a jwt_alg_confusion hit: fetch the public key (/.well-known/jwks.json), forge an HS256 token signed with that public key, and confirm admin access. TO TRY a cache_deception hit: request an authenticated path with a static extension appended (.css/.js) and re-fetch it anonymously. Three more detectors: cors_misconfiguration (Access-Control-Allow-Origin reflects the request Origin or is '*' while credentials are true — CWE-942; any site reads the victim's authenticated responses), xss (user input into a DOM sink — innerHTML / dangerouslySetInnerHTML / document.write / .html() / eval — CWE-79), and subdomain_takeover (a dangling CNAME/AliasTarget to a claimable service like *.github.io/*.herokuapp.com/*.amazonaws.com — CWE-404). TO TRY a cors hit: send an evil Origin + confirm the response echoes it with Allow-Credentials:true. TO TRY an xss hit: confirm the sink executes (drive_devtools). TO TRY a takeover hit: verify the CNAME target resolves to an unclaimed/not-found page. WEB3: for Solidity/EVM, call web3_audit(code|path) — a deterministic 13-class smart-contract audit (reentrancy incl. ERC721/ERC1155 callback reentrancy, unchecked return, unchecked arithmetic, tx.origin auth, signature replay, unprotected selfdestruct, delegatecall-to-user-input, missing access control, timestamp dependence, spot-price oracle manipulation incl. slot0/latestRoundData, unbounded loop, abi.encodePacked hash collision, missing address(0) validation) returning ranked findings (class/CWE/severity/line), then foundry_poc(class, contract) to generate an executable Foundry test that PROVES the bug. A web3 hit is a HYPOTHESIS until the Foundry PoC reproduces it.\n" + `PRECISION ANALYSIS — chrome-devtools MCP is MANDATORY, not optional:
+` + "TWO PATHS:\\n" + "- Source path on disk -> blitz_scan / taint_file / eagle_eye2 (static).\\n" + "- Live URL -> live_recon / active_scan / strike_verify (web-hunting).\\n\\n" + "DEEPEN A FINDING: attack_plan(target, tech, params) to get the prioritized vector plan (decide what to test next with data); list_chains (escalation), chain_links (compose), technique_lookup(cls), payload_lookup, bypass_lookup (blocked). Ground any detector hit empirically with pattern_lookup(id) — it returns the class's CWE, real-world signature, escalation chains, citable references, per-class bypass techniques, and the high-value assets (crown jewels) that class hits, so a raw hit becomes a class-aware finding. Resolve free-form terminology first with synonym_lookup(term) (IDOR/BOLA/SQLi/prompt-injection → canonical id). For an llm_injection hit, its pattern carries a validation discipline — the RUN-TWICE RULE (reproduce token-for-token across two fresh sessions), NON-GUESSABLE ANCHOR (must leak a real key/URL, not a plausible guess), and OOB PROOF (a verifiable callback log) — apply all three before reporting. BEFORE generating a report, run submission_gate(...) and only ship a finding that passes all 7 questions (reproducible, in-scope, real-impact, no-privileged-assumption, verified-live, evidence-redacted, severity-derived); one false = kill it. Calibrate severity with severity_calibrate(type, cvss) to get a P1–P5 tier + VRT-style category. Start each engagement with engagement_scaffold(target, scope) for the folder + scope.md structure, and check data_refresh() to confirm the data layers are consistent. Phase doctrine: read_skill(bs-orchestrate-engagement | bs-web-hunting | bs-source-audit | bs-verify-finding). Campaign plan: read_playbook(target-type). On any failure call retry_guidance(signal) / model_fallback(signal) before giving up. HUNTING DOCTRINE (maximize payout rate): (1) SIBLING RULE — if one endpoint requires auth, check every sibling (/export /delete /share); ~30% of paid IDOR/auth bugs come from siblings — AUTOMATE it with sibling_scan(base_url, endpoint, token_a, token_b), the deterministic live logic-bug prober (sibling enumeration + differential IDOR + auth matrix + mass assignment + rate limit, evidence-first). (2) A→B SIGNAL — a confirmed bug signals a class of developer mistake; hunt B and C (20-min box) before reporting. (3) TWO-ACCOUNT IDOR — always test with attacker account A reading victim account B, and state it in the report. (4) PoC ESCALATION — IDOR shows victim data (not 200), XSS shows cookie exfil (not alert), SSRF shows internal response (not DNS), SQLi shows DB content (not error). (5) FOLLOW THE MONEY — billing/credits/refunds/wallet flows. (6) Kill weak findings with kill_list(type) BEFORE the gate — missing headers, self-XSS, open-redirect-alone, SSRF-DNS-only, GraphQL-introspection-alone are always N/A standalone. (7) CI/CD + SAML/SSO are critical attack surfaces (pull_request_target, expression injection, XML signature wrapping, comment injection). Full doctrine: hunting_doctrine().\n" + "KNOWLEDGE BASE (discover, don't guess): skillLookup(topic) / listSkills for the 40 attack-path + hunting skills (ap-*, hp-*, bs-*); list_attack_vectors / attack_vectors(cat) for the 34-category vector taxonomy; taxonomy(kind) for OWASP/CWE/ASVS/API-top-10; read_playbook(type) for the 17 campaign playbooks; list_manuals / read_tool_manual for 317 tool references; list_tools / run_catalog_tool for the 141-tool catalog. Every tool, skill, and data layer is reachable from these. CROSS-TARGET INTELLIGENCE: strike_resolve auto-records confirmed/false_positive verdicts into the empirical ledger; query it with intelligence(action=hit_rates/top_vectors/recall) so a new target on a known tech inherits historical hit-rates (attack_plan already blends them into success_probability). intelligence(action=recall, tech, target) is the per-engagement pattern recall — it returns which patterns historically CONFIRMED on that tech (prioritize them) versus which only ever produced false positives (avoid them), so a new engagement starts from the empirical playbook of past ones. LIVE PENTEST + TARGETING (black-box, WAF-safe): cache_gap(base_url, endpoint) fuzzes path-normalization + static-extension variants for cache deception/poisoning; blind_oracle(base_url, param, value) detects which SINK a param reaches (sql/ssti/xss) via benign arithmetic (id=1+0, test${7*7}) WITHOUT a malicious payload; param_precedence(base_url, param, A, B) maps duplicate-parameter precedence (first/last-wins) for WAF-bypass. OOB (out-of-band) PROOF for BLIND vulns: oob_start() spins an interactsh listener (unique *.oast.* domain, streams DNS/HTTP interactions — the standard for public targets) or a local HTTP listener for local labs; inject the canary, then oob_poll(id) until the hit arrives; oob_stop(id) to clean up. A blind SSRF/XXE/SQLi/command-injection is CONFIRMED only when the canary actually arrives — never from a guess. SOURCE TARGETING: action_surface(code) maps every wp_ajax_* action to its vuln class + DERIVED priority (what to look for WHERE); security_state(sanitizers, sink) gives a wrong-context sanitization verdict; framework_knowledge(framework) returns auth/nonce primitives for 9 frameworks; variant_scan(root, signature) mass-sweeps an install base for ONE bug family; patch_analyze(old, new) REVERSES a security patch into the 0-day, and its mine_signature feeds variant_scan to sweep unpatched copies. All of these are DETECTION HINTS — verify each live (strike_verify / browser_validate) before it enters the report. NEWEST DETECTORS — understand AND try them: variant_scan also emits priv_esc (privilege escalation — a role/capability/user change fed by request input, traced cross-file via reverse call-graph, e.g. set_role($id, sanitize_key($_POST['um-role'])) or update_user_meta(...,'wp_capabilities', $_POST[...])) and flags uploadAllow=>array('all') unrestricted-upload configs as file_upload (the file-manager/connector shape). TO TRY a priv_esc hit: submit the role field with 'administrator' (or send wp_capabilities meta) and confirm the account actually gains admin. TO TRY an unrestricted-upload hit: POST a .php/.phtml and confirm it lands web-reachable + executes. variant_scan also emits hardcoded_secret (CWE-798) in three tiers: a secret field (api_key/db_password/access_token/aws_*) assigned a literal (HIGH), a known secret FORMAT (JWT eyJ…/AWS AKIA…/GitHub ghp_…/Slack xoxb-…/…) regardless of name (HIGH), or a high-entropy suspect token (MEDIUM — verify before reporting). Verify a frontend/JS secret live via drive_devtools (inspect the JS bundle / network response and confirm the key is actually exposed), and for a backend secret confirm it is reachable/valid. A static hit is a HYPOTHESIS until verified live — never report unverified. For a repo, also scan_git_history(root) — secrets DELETED from HEAD still live in .git history (the removed-later-is-not-fixed trap), and it feeds every recovered pre-deletion blob through the same secret detector. Once you recover a credential, prove it is still ACTIVE with validate_leaked_key(apiBase, endpoints, key|blobUrl) — a READ-ONLY differential test (401-without-key vs 200-with-key = auth bypass PROVEN). Two supply-chain detectors: dependency_confusion (a manifest/build file resolving a package from a public registry — pypi.org/npmjs.org --extra-index-url, or a scoped @company/pkg with no private registry) and ml_supply_chain (torch.load without weights_only=True / joblib.load / np.load(allow_pickle=True) / keras load_model on an untrusted model → pickle RCE). Rust is supported end-to-end: the taint engine (blitz_scan / taint_file) maps Rust sinks (std::process::Command, sqlx/diesel, reqwest/hyper, std::fs, serde/bincode) to the classic classes, plus two Rust-specific detectors — rust_unsafe (transmute / assume_init / from_raw_parts / ptr::* — memory-unsafety surface, CWE-119) and rust_format_string (println!/format! with a variable as the format string — CWE-134). The sqlx query! compile-time macro is treated as safe (suppressed). Two more web-class detectors: jwt_alg_confusion (a JWT verifier that dispatches on the token's alg header and accepts BOTH RS256 and HS256, with the HS256 HMAC secret derived from public/shared key material — CWE-347; the attacker sets alg=HS256 and signs with the public key to forge admin tokens) and cache_deception (a reverse proxy caching static-extension URLs with a cache key that omits the session cookie, over a session-authenticated backend — CWE-525; the victim's cached private response is re-fetched anonymously). TO TRY a jwt_alg_confusion hit: fetch the public key (/.well-known/jwks.json), forge an HS256 token signed with that public key, and confirm admin access. TO TRY a cache_deception hit: request an authenticated path with a static extension appended (.css/.js) and re-fetch it anonymously. Three more detectors: cors_misconfiguration (Access-Control-Allow-Origin reflects the request Origin or is '*' while credentials are true — CWE-942; any site reads the victim's authenticated responses), xss (user input into a DOM sink — innerHTML / dangerouslySetInnerHTML / document.write / .html() / eval — CWE-79), and subdomain_takeover (a dangling CNAME/AliasTarget to a claimable service like *.github.io/*.herokuapp.com/*.amazonaws.com — CWE-404). TO TRY a cors hit: send an evil Origin + confirm the response echoes it with Allow-Credentials:true. TO TRY an xss hit: confirm the sink executes (drive_devtools). TO TRY a takeover hit: verify the CNAME target resolves to an unclaimed/not-found page. WEB3: for Solidity/EVM, call web3_audit(code|path) — a deterministic 13-class smart-contract audit (reentrancy incl. ERC721/ERC1155 callback reentrancy, unchecked return, unchecked arithmetic, tx.origin auth, signature replay, unprotected selfdestruct, delegatecall-to-user-input, missing access control, timestamp dependence, spot-price oracle manipulation incl. slot0/latestRoundData, unbounded loop, abi.encodePacked hash collision, missing address(0) validation) returning ranked findings (class/CWE/severity/line), then foundry_poc(class, contract) to generate an executable Foundry test that PROVES the bug. A web3 hit is a HYPOTHESIS until the Foundry PoC reproduces it.\n" + `PRECISION ANALYSIS — chrome-devtools MCP is MANDATORY, not optional:
 ` + `- When a lead needs DOM/JS precision — DOM-XSS sink execution, AJAX endpoint + payload interception, JS runtime errors, redirect chains, SSO/token flow, or anything a static HTML glance cannot prove — call drive_devtools(target). It spawns chrome-devtools-mcp and drives a REAL headless browser (navigate -> list_network_requests -> list_console_messages -> evaluate_script), giving reproducible evidence instead of a guess.
 ` + `- Before calling it, check_mcp() to confirm the browser MCP is available; if not, blitzstrike install-tools or npm i -g chrome-devtools-mcp. Never substitute eyeballing minified JS or a static sink guess when a live browser can PROVE it. This is the precision + consistency layer.
 ` + "EXTERNAL MCP SERVERS (verified, connect them — NOT one-shot CLIs): chrome-devtools-mcp (29 tools: list_network_requests/get_network_request for raw HTTP interception, list_console_messages for JS errors + DOM-XSS, evaluate_script to run JS, take_screenshot) -> stdio chrome-devtools-mcp --headless --chromeArg=--no-sandbox --chromeArg=--disable-gpu (as root/container this is MANDATORY or the browser crashes; add --proxyServer http://127.0.0.1:8080 to route through Burp, --acceptInsecureCerts for bad TLS). burp-suite-mcp (proxy history + active scan + repeater) -> NOT npm: build the JAR (git clone https://github.com/PortSwigger/mcp-server.git && cd mcp-server && ./gradlew embedProxyJar), load it in Burp Extensions, then connect the client to http://127.0.0.1:9876 (SSE) or the stdio proxy java -jar mcp-proxy-all.jar --sse-url http://127.0.0.1:9876."
@@ -62180,6 +62399,27 @@ ${statusLine}` : statusLine },
   }, async () => {
     return { content: [{ type: "text", text: JSON.stringify(huntingDoctrine()) }] };
   });
+  server.registerTool("sibling_scan", {
+    title: "Sibling Rule Engine — deterministic live logic-bug prober",
+    description: "LIVE (black-box): deterministic logic-bug prober that closes the gap static detectors can't cover (IDOR / broken authz / mass assignment / rate limit). From a base endpoint it (1) enumerates sibling paths (/export /delete /share /{id} /list /settings …), (2) differential-tests IDOR — the victim's object fetched with the ATTACKER's token (A's token + B's id returning 200 = IDOR proven), (3) probes each sibling with NO token for missing auth, (4) injects role/admin fields on POST/PUT for mass assignment, and (5) fires 15 rapid requests to check rate limiting. Every hit is a DIFFERENTIAL (status + body), never a guess; hits-only output. Provide base_url, endpoint, and (for IDOR) the attacker + victim tokens + the victim's object id.",
+    inputSchema: {
+      base_url: string2().describe("Target base URL (e.g. https://target.com)"),
+      endpoint: string2().describe("Authenticated endpoint to expand (e.g. /api/user/123/orders)"),
+      token_a: string2().optional().describe("Attacker's bearer token (for IDOR + mass assignment + rate limit)"),
+      token_b: string2().optional().describe("Victim's bearer token (baseline for IDOR differential)"),
+      object_id_b: string2().optional().describe("Victim's object id (defaults to the id extracted from endpoint)"),
+      methods: string2().optional().describe('JSON array of methods to test (default ["GET"])'),
+      max_siblings: number2().optional().describe("Max sibling endpoints to enumerate (default 60)")
+    }
+  }, async ({ base_url, endpoint, token_a, token_b, object_id_b, methods, max_siblings }) => {
+    let m;
+    try {
+      m = methods ? JSON.parse(methods) : undefined;
+    } catch {
+      return { content: [{ type: "text", text: JSON.stringify({ error: "invalid methods JSON" }) }] };
+    }
+    return { content: [{ type: "text", text: JSON.stringify(await siblingScan({ baseUrl: base_url, endpoint, tokenA: token_a, tokenB: token_b, objectIdB: object_id_b, methods: m, maxSiblings: max_siblings })) }] };
+  });
   server.registerTool("param_precedence", {
     title: "Duplicate parameter precedence fuzzer (WAF-bypass oracle)",
     description: "LIVE (black-box): determine how the app resolves duplicate parameters + alternate delimiters (; , %26 %3b | [] %00 + #). Reveals the WAF-bypass vector — if the WAF validates one value and the app binds another, inject via the disagreement. Deterministic: baseline A/B + differential per variant.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.88",
+  "version": "2.4.89",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {