blitzstrike 2.4.90 → 2.4.92

package/CHANGELOG.md

@@ -5,6 +5,38 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.92] — 2026-09-17
+
+### Fixed — interconnection audit (grounding gaps + reversed PoC semantics)
+
+- `command_injection` was UNGROUNDED: emitted by the taint engine + used in auto-poc
+  and attack_plan, but had no pattern/CWE/severity/alias. Added the full pattern
+  (CWE-78, chain `command_injection_os_cmd`, payout $1K–$15K, bypass + crown-jewels),
+  a severity VRT entry (P1/critical), and synonyms (command injection / os command
+  injection / command execution / cmd injection / rce / code execution / code
+  injection / eval injection).
+- Foundry PoC templates now use consistent POSITIVE semantics (a passing PoC = the
+  bug is PRESENT): `missing_access_control` asserted the secure outcome (backwards) —
+  now `assertGt(balanceOf(attacker), 0)`; `address_zero_check` now asserts the zero
+  address IS accepted; `signature_replay` / `delegatecall_user_input` /
+  `unchecked_arithmetic` / `timestamp_dependence` flipped from `vm.expectRevert()`
+  (secure-behavior) to asserting the exploit outcome.
+- verify.ts: pattern-grounding check changed from exact count equality (patterns ==
+  detector types) to a subset invariant (every detector type grounded), so extra
+  classes like command_injection don't fail it.
+
+## [2.4.91] — 2026-09-17
+
+### Added — Foundry runner (execute Web3 PoC to PROVE a finding)
+
+- New `foundry_run(contract_code, poc_code|class_, contract_name)` tool — actually
+  executes a Foundry PoC test against a vulnerable contract: scaffolds a temp
+  Foundry project (forge init → forge-std), runs `forge test`, and reports the
+  verdict from forge's own test result. A PASSING PoC test = the exploit reproduced
+  = the finding PROVEN; a failing PoC = not reproduced; a compile error = error.
+  Deterministic differential (passes on the vulnerable contract, fails on the fixed
+  one). Requires forge installed.
+
 ## [2.4.90] — 2026-09-17
 
 ### Added — Auto-PoC (reproduction recipe generator)

package/dist/index.js

@@ -17349,8 +17349,8 @@ var init_variants = __esm(() => {
 });
 
 // src/sync.ts
-import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync8, readFileSync as readFileSync26, readdirSync as readdirSync7, statSync as statSync4, rmSync as rmSync4 } from "node:fs";
-import { join as join24 } from "node:path";
+import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync9, readFileSync as readFileSync26, readdirSync as readdirSync7, statSync as statSync4, rmSync as rmSync5 } from "node:fs";
+import { join as join25 } from "node:path";
 import { homedir as homedir10 } from "node:os";
 import { fileURLToPath as fileURLToPath13 } from "node:url";
 import { spawnSync as spawnSync4 } from "node:child_process";
@@ -17367,7 +17367,7 @@ function countFiles(dir) {
     const walk = (d) => {
       for (const e of readdirSync7(d, { withFileTypes: true })) {
         if (e.isDirectory())
-          walk(join24(d, e.name));
+          walk(join25(d, e.name));
         else
           n++;
       }
@@ -17380,9 +17380,9 @@ function countFiles(dir) {
 }
 function syncData() {
   if (!dirExists(DATA_ROOT2))
-    mkdirSync9(DATA_ROOT2, { recursive: true });
-  const payloadsPath = join24(DATA_ROOT2, "payloads");
-  const templatesPath = join24(DATA_ROOT2, "templates");
+    mkdirSync10(DATA_ROOT2, { recursive: true });
+  const payloadsPath = join25(DATA_ROOT2, "payloads");
+  const templatesPath = join25(DATA_ROOT2, "templates");
   const hasPayloads = dirExists(payloadsPath) && countFiles(payloadsPath) > 0;
   const hasTemplates = dirExists(templatesPath) && countFiles(templatesPath) > 0;
   if (hasPayloads && hasTemplates) {
@@ -17392,8 +17392,8 @@ function syncData() {
       data_root: DATA_ROOT2
     };
   }
-  const localPayloads = join24(ROOT7, "payloads");
-  const localTemplates = join24(ROOT7, "templates");
+  const localPayloads = join25(ROOT7, "payloads");
+  const localTemplates = join25(ROOT7, "templates");
   let payloadsSynced = false;
   let templatesSynced = false;
   if (!hasPayloads && dirExists(localPayloads)) {
@@ -17406,23 +17406,23 @@ function syncData() {
   }
   const gitOk = spawnSync4("git", ["--version"]).status === 0;
   if (gitOk && (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0 || !dirExists(templatesPath) || countFiles(templatesPath) === 0)) {
-    const tmp = join24(DATA_ROOT2, ".tmp-clone");
+    const tmp = join25(DATA_ROOT2, ".tmp-clone");
     if (dirExists(tmp))
-      rmSync4(tmp, { recursive: true, force: true });
+      rmSync5(tmp, { recursive: true, force: true });
     const r = spawnSync4("git", ["clone", "--depth", "1", "--filter=blob:none", "--sparse", GITHUB_REPO, tmp], { timeout: 120000 });
     if (r.status === 0) {
       const sparse = spawnSync4("git", ["-C", tmp, "sparse-checkout", "set", "payloads", "templates"], { timeout: 120000 });
       if (sparse.status === 0) {
         if (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0) {
-          copyDir(join24(tmp, "payloads"), payloadsPath);
+          copyDir(join25(tmp, "payloads"), payloadsPath);
           payloadsSynced = true;
         }
         if (!dirExists(templatesPath) || countFiles(templatesPath) === 0) {
-          copyDir(join24(tmp, "templates"), templatesPath);
+          copyDir(join25(tmp, "templates"), templatesPath);
           templatesSynced = true;
         }
       }
-      rmSync4(tmp, { recursive: true, force: true });
+      rmSync5(tmp, { recursive: true, force: true });
     }
   }
   return {
@@ -17438,20 +17438,20 @@ function copyDir(src, dst) {
   }
 }
 function manualCopy(src, dst) {
-  mkdirSync9(dst, { recursive: true });
+  mkdirSync10(dst, { recursive: true });
   for (const e of readdirSync7(src, { withFileTypes: true })) {
-    const s = join24(src, e.name);
-    const d = join24(dst, e.name);
+    const s = join25(src, e.name);
+    const d = join25(dst, e.name);
     if (e.isDirectory())
       manualCopy(s, d);
     else
-      writeFileSync8(d, readFileSync26(s));
+      writeFileSync9(d, readFileSync26(s));
   }
 }
 var ROOT7, DATA_ROOT2, GITHUB_REPO = "https://github.com/shinthink/blitzstrike.git";
 var init_sync = __esm(() => {
-  ROOT7 = join24(fileURLToPath13(new URL(".", import.meta.url)), "..");
-  DATA_ROOT2 = process.env.BLITZSTRIKE_DATA ?? join24(homedir10(), ".blitzstrike", "data");
+  ROOT7 = join25(fileURLToPath13(new URL(".", import.meta.url)), "..");
+  DATA_ROOT2 = process.env.BLITZSTRIKE_DATA ?? join25(homedir10(), ".blitzstrike", "data");
 });
 
 // src/update.ts
@@ -17496,15 +17496,15 @@ var init_update = __esm(() => {
 });
 
 // src/release.ts
-import { readFileSync as readFileSync28, existsSync as existsSync15 } from "node:fs";
-import { join as join25 } from "node:path";
+import { readFileSync as readFileSync28, existsSync as existsSync16 } from "node:fs";
+import { join as join26 } from "node:path";
 import { fileURLToPath as fileURLToPath14 } from "node:url";
-import { execSync as execSync3 } from "node:child_process";
+import { execSync as execSync4 } from "node:child_process";
 function validateRelease() {
   const checks = [];
   checks.push({ name: "package.json version", ok: true, detail: VERSION });
   try {
-    const changelog = readFileSync28(join25(ROOT8, "CHANGELOG.md"), "utf8");
+    const changelog = readFileSync28(join26(ROOT8, "CHANGELOG.md"), "utf8");
     const m = changelog.match(/^##\s+\[([0-9]+\.[0-9]+\.[0-9]+)\]/m);
     const changelogVersion = m?.[1] ?? null;
     checks.push({
@@ -17516,13 +17516,13 @@ function validateRelease() {
     checks.push({ name: "CHANGELOG version", ok: false, detail: "CHANGELOG.md not found" });
   }
   try {
-    const tag = execSync3("git describe --tags --abbrev=0", { cwd: ROOT8, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    const tag = execSync4("git describe --tags --abbrev=0", { cwd: ROOT8, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
     checks.push({ name: "Git tag", ok: tag === `v${VERSION}`, detail: tag, soft: true });
   } catch {
     checks.push({ name: "Git tag", ok: true, detail: "unavailable (no git/tags)", soft: true });
   }
   try {
-    const published = execSync3("npm view blitzstrike version", { encoding: "utf8", timeout: 8000, stdio: ["ignore", "pipe", "ignore"] }).trim();
+    const published = execSync4("npm view blitzstrike version", { encoding: "utf8", timeout: 8000, stdio: ["ignore", "pipe", "ignore"] }).trim();
     checks.push({ name: "npm registry version", ok: published === VERSION, detail: published, soft: true });
   } catch {
     checks.push({ name: "npm registry version", ok: true, detail: "unavailable (offline)", soft: true });
@@ -17536,22 +17536,22 @@ function validateRelease() {
   return { version: VERSION, checks, consistent: checks.filter((c) => !c.soft).every((c) => c.ok) };
 }
 function lockfilePresent() {
-  return existsSync15(join25(ROOT8, "package-lock.json")) || existsSync15(join25(ROOT8, "bun.lock")) || existsSync15(join25(ROOT8, "bun.lockb"));
+  return existsSync16(join26(ROOT8, "package-lock.json")) || existsSync16(join26(ROOT8, "bun.lock")) || existsSync16(join26(ROOT8, "bun.lockb"));
 }
 var ROOT8;
 var init_release = __esm(() => {
   init_version();
-  ROOT8 = join25(fileURLToPath14(new URL(".", import.meta.url)), "..");
+  ROOT8 = join26(fileURLToPath14(new URL(".", import.meta.url)), "..");
 });
 
 // src/dependency.ts
 import { readFileSync as readFileSync29 } from "node:fs";
-import { join as join26 } from "node:path";
+import { join as join27 } from "node:path";
 import { fileURLToPath as fileURLToPath15 } from "node:url";
 function checkDependencies() {
   let pkg = {};
   try {
-    pkg = JSON.parse(readFileSync29(join26(ROOT9, "package.json"), "utf8"));
+    pkg = JSON.parse(readFileSync29(join27(ROOT9, "package.json"), "utf8"));
   } catch {
     return { install_scripts: [], git_dependencies: [], total_dependencies: 0, safe: false };
   }
@@ -17574,12 +17574,12 @@ function checkDependencies() {
 }
 var ROOT9;
 var init_dependency = __esm(() => {
-  ROOT9 = join26(fileURLToPath15(new URL(".", import.meta.url)), "..");
+  ROOT9 = join27(fileURLToPath15(new URL(".", import.meta.url)), "..");
 });
 
 // src/cli.ts
-import { readFileSync as readFileSync30, existsSync as existsSync16, writeFileSync as writeFileSync9, mkdirSync as mkdirSync10 } from "node:fs";
-import { join as join27, dirname as dirname6 } from "node:path";
+import { readFileSync as readFileSync30, existsSync as existsSync17, writeFileSync as writeFileSync10, mkdirSync as mkdirSync11 } from "node:fs";
+import { join as join28, dirname as dirname6 } from "node:path";
 import { homedir as homedir11 } from "node:os";
 import { fileURLToPath as fileURLToPath16 } from "node:url";
 import { spawnSync as spawnSync5 } from "node:child_process";
@@ -17624,7 +17624,7 @@ async function runDoctor() {
     detail: h1 ? `X-HackerOne-Research: ${h1}` : "H1_USERNAME not set",
     fix: h1 ? undefined : "export H1_USERNAME=<your-hackerone-username> (adds X-HackerOne-Research to outbound requests)"
   });
-  const dataOk = existsSync16(join27(ROOT10, "chains.json")) && existsSync16(join27(ROOT10, "tools-catalog.json"));
+  const dataOk = existsSync17(join28(ROOT10, "chains.json")) && existsSync17(join28(ROOT10, "tools-catalog.json"));
   issues.push({
     name: "Data layers (chains + tools-catalog)",
     status: dataOk ? "ok" : "fail",
@@ -17675,15 +17675,15 @@ BlitzStrike — ${verdict}`);
 function resolveCommand() {
   if (which("blitzstrike"))
     return { command: "blitzstrike", args: ["serve", "--mcp"] };
-  const src = join27(ROOT10, "src", "index.ts");
-  if (which("bun") && existsSync16(src))
+  const src = join28(ROOT10, "src", "index.ts");
+  if (which("bun") && existsSync17(src))
     return { command: "bun", args: ["run", src, "serve", "--mcp"] };
   if (which("npx"))
     return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
   if (which("bunx"))
     return { command: "bunx", args: ["blitzstrike", "serve", "--mcp"] };
-  const dist = join27(ROOT10, "dist", "index.js");
-  if (existsSync16(dist))
+  const dist = join28(ROOT10, "dist", "index.js");
+  if (existsSync17(dist))
     return { command: "bun", args: [dist, "serve", "--mcp"] };
   return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
 }
@@ -17697,51 +17697,51 @@ function readJson(p) {
 function jsonMcpServersWrite(p) {
   return (command, args) => {
     const dir = dirname6(p);
-    if (!existsSync16(dir))
-      mkdirSync10(dir, { recursive: true });
+    if (!existsSync17(dir))
+      mkdirSync11(dir, { recursive: true });
     const existing = readJson(p) ?? {};
     existing.mcpServers = {
       ...existing.mcpServers ?? {},
       blitzstrike: { command, args }
     };
-    writeFileSync9(p, JSON.stringify(existing, null, 2));
+    writeFileSync10(p, JSON.stringify(existing, null, 2));
   };
 }
 function opencodeWrite(p) {
   return (command, args) => {
     const dir = dirname6(p);
-    if (!existsSync16(dir))
-      mkdirSync10(dir, { recursive: true });
+    if (!existsSync17(dir))
+      mkdirSync11(dir, { recursive: true });
     const existing = readJson(p) ?? {};
     existing.mcp = {
       ...existing.mcp ?? {},
       blitzstrike: { type: "local", command: [command, ...args], enabled: true }
     };
-    writeFileSync9(p, JSON.stringify(existing, null, 2));
+    writeFileSync10(p, JSON.stringify(existing, null, 2));
     copyOpenCodeAgents();
   };
 }
 function copyOpenCodeAgents() {
-  const srcDir = join27(ROOT10, "opencode-agents");
-  const dstDir = join27(homedir11(), ".config", "opencode", "agents");
-  if (!existsSync16(srcDir))
+  const srcDir = join28(ROOT10, "opencode-agents");
+  const dstDir = join28(homedir11(), ".config", "opencode", "agents");
+  if (!existsSync17(srcDir))
     return;
-  if (!existsSync16(dstDir))
-    mkdirSync10(dstDir, { recursive: true });
+  if (!existsSync17(dstDir))
+    mkdirSync11(dstDir, { recursive: true });
   for (const f of ["Blitz Strike.md", "Blitz.md", "Eagle Eye.md", "Strike.md"]) {
-    const src = join27(srcDir, f);
-    const dst = join27(dstDir, f);
-    if (existsSync16(src)) {
-      writeFileSync9(dst, readFileSync30(src, "utf8"));
+    const src = join28(srcDir, f);
+    const dst = join28(dstDir, f);
+    if (existsSync17(src)) {
+      writeFileSync10(dst, readFileSync30(src, "utf8"));
     }
   }
 }
 function codexWrite(p) {
   return (command, args) => {
     const dir = dirname6(p);
-    if (!existsSync16(dir))
-      mkdirSync10(dir, { recursive: true });
-    let existing = existsSync16(p) ? readFileSync30(p, "utf8") : "";
+    if (!existsSync17(dir))
+      mkdirSync11(dir, { recursive: true });
+    let existing = existsSync17(p) ? readFileSync30(p, "utf8") : "";
     if (!existing.trimEnd().endsWith(`
 `))
       existing += `
@@ -17752,15 +17752,15 @@ function codexWrite(p) {
 command = "${command}"
 args = ${JSON.stringify(args)}
 `;
-    writeFileSync9(p, existing);
+    writeFileSync10(p, existing);
   };
 }
 function hermesWrite(p) {
   return (command, args) => {
     const dir = dirname6(p);
-    if (!existsSync16(dir))
-      mkdirSync10(dir, { recursive: true });
-    let existing = existsSync16(p) ? readFileSync30(p, "utf8") : "";
+    if (!existsSync17(dir))
+      mkdirSync11(dir, { recursive: true });
+    let existing = existsSync17(p) ? readFileSync30(p, "utf8") : "";
     existing = existing.replace(/^  blitzstrike:\n(?:    .*\n?)*/m, "");
     if (!existing.trimEnd().endsWith(`
 `))
@@ -17781,80 +17781,80 @@ mcp_servers:
     args: ${JSON.stringify(args)}
 `;
     }
-    writeFileSync9(p, existing);
+    writeFileSync10(p, existing);
   };
 }
 function detectAgents() {
   const home = homedir11();
   const agents = [];
-  const claudeJson = join27(home, ".claude.json");
+  const claudeJson = join28(home, ".claude.json");
   agents.push({
     name: "Claude Code",
     detectPath: claudeJson,
-    installed: () => existsSync16(claudeJson) || which("claude"),
+    installed: () => existsSync17(claudeJson) || which("claude"),
     write: jsonMcpServersWrite(claudeJson)
   });
-  const claudeDesktop = join27(home, ".config", "Claude", "claude_desktop_config.json");
+  const claudeDesktop = join28(home, ".config", "Claude", "claude_desktop_config.json");
   agents.push({
     name: "Claude Desktop",
     detectPath: claudeDesktop,
-    installed: () => existsSync16(claudeDesktop),
+    installed: () => existsSync17(claudeDesktop),
     write: jsonMcpServersWrite(claudeDesktop)
   });
-  const cursor = join27(home, ".cursor", "mcp.json");
+  const cursor = join28(home, ".cursor", "mcp.json");
   agents.push({
     name: "Cursor",
     detectPath: cursor,
-    installed: () => existsSync16(join27(home, ".cursor")) || which("cursor"),
+    installed: () => existsSync17(join28(home, ".cursor")) || which("cursor"),
     write: jsonMcpServersWrite(cursor)
   });
-  const opencode = join27(home, ".config", "opencode", "opencode.jsonc");
+  const opencode = join28(home, ".config", "opencode", "opencode.jsonc");
   agents.push({
     name: "OpenCode",
     detectPath: opencode,
-    installed: () => existsSync16(join27(home, ".config", "opencode")) || which("opencode"),
+    installed: () => existsSync17(join28(home, ".config", "opencode")) || which("opencode"),
     write: opencodeWrite(opencode)
   });
-  const codex = join27(home, ".codex", "config.toml");
+  const codex = join28(home, ".codex", "config.toml");
   agents.push({
     name: "Codex",
     detectPath: codex,
-    installed: () => existsSync16(join27(home, ".codex")) || which("codex"),
+    installed: () => existsSync17(join28(home, ".codex")) || which("codex"),
     write: codexWrite(codex)
   });
-  const hermes = join27(home, ".hermes", "config.yaml");
+  const hermes = join28(home, ".hermes", "config.yaml");
   agents.push({
     name: "Hermes",
     detectPath: hermes,
-    installed: () => existsSync16(join27(home, ".hermes")) || which("hermes"),
+    installed: () => existsSync17(join28(home, ".hermes")) || which("hermes"),
     write: hermesWrite(hermes)
   });
-  const gemini = join27(home, ".gemini", "settings.json");
+  const gemini = join28(home, ".gemini", "settings.json");
   agents.push({
     name: "Gemini CLI",
     detectPath: gemini,
-    installed: () => existsSync16(join27(home, ".gemini")) || which("gemini"),
+    installed: () => existsSync17(join28(home, ".gemini")) || which("gemini"),
     write: jsonMcpServersWrite(gemini)
   });
-  const windsurf = join27(home, ".codeium", "windsurf", "mcp_config.json");
+  const windsurf = join28(home, ".codeium", "windsurf", "mcp_config.json");
   agents.push({
     name: "Windsurf",
     detectPath: windsurf,
-    installed: () => existsSync16(join27(home, ".codeium")) || which("windsurf"),
+    installed: () => existsSync17(join28(home, ".codeium")) || which("windsurf"),
     write: jsonMcpServersWrite(windsurf)
   });
-  const copilot = join27(home, ".copilot", "mcp.json");
+  const copilot = join28(home, ".copilot", "mcp.json");
   agents.push({
     name: "Copilot",
     detectPath: copilot,
-    installed: () => existsSync16(join27(home, ".copilot")),
+    installed: () => existsSync17(join28(home, ".copilot")),
     write: jsonMcpServersWrite(copilot)
   });
-  const cline = join27(home, ".cline", "mcp_settings.json");
+  const cline = join28(home, ".cline", "mcp_settings.json");
   agents.push({
     name: "Cline",
     detectPath: cline,
-    installed: () => existsSync16(join27(home, ".cline")),
+    installed: () => existsSync17(join28(home, ".cline")),
     write: jsonMcpServersWrite(cline)
   });
   return agents;
@@ -17972,7 +17972,7 @@ var init_cli = __esm(() => {
   init_release();
   init_dependency();
   init_mcp_status();
-  ROOT10 = join27(fileURLToPath16(new URL(".", import.meta.url)), "..");
+  ROOT10 = join28(fileURLToPath16(new URL(".", import.meta.url)), "..");
 });
 
 // node_modules/zod/v3/helpers/util.js
@@ -34453,6 +34453,16 @@ var ALIASES = {
   ssti: "ssti",
   "template injection": "ssti",
   "server side template injection": "ssti",
+  "command injection": "command_injection",
+  "os command injection": "command_injection",
+  "command execution": "command_injection",
+  "cmd injection": "command_injection",
+  rce: "command_injection",
+  "remote code execution": "command_injection",
+  "code execution": "command_injection",
+  "code injection": "command_injection",
+  "eval injection": "command_injection",
+  "arbitrary code execution": "command_injection",
   xxe: "xxe",
   "xml external entity": "xxe",
   "xxe injection": "xxe",
@@ -59026,6 +59036,7 @@ function hackbotArenaCoverage() {
 var VRT_MAP = {
   sql_injection: { vrt: "injection > sql_injection", priority: "P1", severity: "critical", rationale: "SQL injection reaches sensitive data or enables admin takeover." },
   ssti: { vrt: "injection > server_side_template_injection", priority: "P1", severity: "critical", rationale: "SSTI evaluates expressions server-side → code execution." },
+  command_injection: { vrt: "injection > os_command_injection", priority: "P1", severity: "critical", rationale: "User input reaches a shell (system/exec/popen) → arbitrary command execution, full host takeover." },
   deserialization: { vrt: "injection > insecure_deserialization", priority: "P1", severity: "critical", rationale: "Deserialization escalated via a gadget chain → code execution." },
   xxe: { vrt: "injection > xml_external_entity", priority: "P1", severity: "critical", rationale: "XXE reads local files or reaches internal services." },
   file_upload: { vrt: "insecure_design > unrestricted_file_upload", priority: "P1", severity: "critical", rationale: "A web-reachable uploaded file of an executable type → code execution." },
@@ -60748,9 +60759,11 @@ contract ReentrantAttacker {
         assertFalse(ok, "call should fail");
     }`,
     unchecked_arithmetic: `    function testUncheckedArithmetic() public {
+        uint256 before = target.counter();
         // trigger the wrap that the unchecked block allowed
-        vm.expectRevert(); // replace with a concrete overflow/underflow assertion
         target.triggerOverflow();
+        // the bug is PRESENT when the value wrapped (became smaller):
+        assertLt(target.counter(), before, "unchecked arithmetic wrapped");
     }`,
     tx_origin_auth: `    function testTxOriginAuth() public {
         // a malicious intermediary makes the victim (tx.origin) call the target
@@ -60769,13 +60782,13 @@ contract Phisher {
         // replay the same signature on a second chain / a second time
         (uint8 v, bytes32 r, bytes32 s) = vm.sign(attackerPk, digest);
         target.claim(attacker, 1 ether, deadline, v, r, s);
-        // replay it — should revert if nonce/chainId bound
-        vm.expectRevert();
+        // the bug is PRESENT when the SAME signature replays (no nonce/chainId binding):
         target.claim(attacker, 1 ether, deadline, v, r, s);
+        assertGt(target.balanceOf(attacker), 1 ether, "signature replayed");
     }`,
     unprotected_selfdestruct: `    function testUnprotectedSelfdestruct() public {
         vm.prank(attacker);
-        target.kill(); // should revert — only owner may selfdestruct
+        target.kill(); // the bug is PRESENT when a non-owner can destroy it
         assertEq(address(target).code.length, 0, "contract destroyed by non-owner");
     }`,
     delegatecall_user_input: `    function testDelegatecallUserInput() public {
@@ -60783,8 +60796,9 @@ contract Phisher {
         Evil impl = new Evil();
         vm.prank(attacker);
         target.setImplementation(address(impl));
-        vm.expectRevert();
+        // the bug is PRESENT when the attacker-supplied implementation actually ran:
         target.exec();
+        assertEq(address(target).code.length, 0, "attacker implementation executed");
     }
 }
 
@@ -60793,13 +60807,16 @@ contract Evil {
 }`,
     missing_access_control: `    function testMissingAccessControl() public {
         vm.prank(attacker);
-        target.mint(attacker, 1_000_000 ether); // should require owner
-        assertEq(target.balanceOf(attacker), 0, "attacker minted without auth");
+        target.mint(attacker, 1_000_000 ether); // no owner check
+        // the bug is PRESENT when the attacker's mint actually lands:
+        assertGt(target.balanceOf(attacker), 0, "attacker minted without auth");
     }`,
     timestamp_dependence: `    function testTimestampDependence() public {
         // warp the timestamp to a favorable value and observe the payout/randomness
         vm.warp(block.timestamp + 1000);
         target.resolve();
+        // the bug is PRESENT when the timestamp change altered the outcome:
+        assertTrue(/* favorable outcome observed */, "timestamp dependence exploited");
     }`,
     oracle_manipulation: `    function testOracleManipulation() public {
         // swap a large amount to move the spot price, then exploit the target
@@ -60820,10 +60837,9 @@ contract Evil {
         assertEq(a, b, "abi.encodePacked collision");
     }`,
     address_zero_check: `    function testAddressZeroCheck() public {
-        // assign the zero address as owner — should revert
-        vm.expectRevert();
+        // the bug is PRESENT when the zero address is accepted as owner:
         target.setOwner(address(0));
-        assertTrue(target.owner() != address(0), "zero address became owner");
+        assertEq(target.owner(), address(0), "zero address became owner");
     }`
   };
   return base + (exploit[cls] ?? exploit.missing_access_control) + `
@@ -61340,18 +61356,109 @@ function listPocTypes() {
   return Object.keys(POC_TEMPLATES).sort();
 }
 
+// src/foundry-run.ts
+import { execSync as execSync3 } from "node:child_process";
+import { mkdtempSync as mkdtempSync3, mkdirSync as mkdirSync9, writeFileSync as writeFileSync8, rmSync as rmSync4, existsSync as existsSync14 } from "node:fs";
+import { tmpdir as tmpdir4 } from "node:os";
+import { join as join23 } from "node:path";
+function findForge() {
+  try {
+    const p = execSync3("which forge 2>/dev/null", { encoding: "utf8", timeout: 3000 }).trim();
+    if (p)
+      return p;
+  } catch {}
+  const home = process.env.HOME ?? "/root";
+  const candidates = [`${home}/.foundry/bin/forge`, "/usr/local/bin/forge", "/usr/bin/forge"];
+  for (const c of candidates)
+    if (existsSync14(c))
+      return c;
+  return null;
+}
+function runForge(forge, dir, timeoutMs) {
+  try {
+    const out = execSync3(`${forge} test -vv`, { cwd: dir, encoding: "utf8", timeout: timeoutMs, env: { ...process.env } });
+    return { exit: 0, out };
+  } catch (e) {
+    return { exit: e.status ?? 1, out: (e.stdout ?? "") + (e.stderr ?? "") };
+  }
+}
+function parseTestResults(out) {
+  const results = [];
+  for (const line of out.split(`
+`)) {
+    const pass = line.match(/\[PASS\]\s+(\S+)/);
+    const fail = line.match(/\[FAIL[^\]]*\]\s+(\S+)/);
+    if (pass)
+      results.push({ name: pass[1], status: "pass" });
+    else if (fail)
+      results.push({ name: fail[1], status: "fail" });
+  }
+  return results;
+}
+async function foundryRun(input) {
+  const forge = findForge();
+  const name = input.contract_name ?? "Vulnerable";
+  if (!forge) {
+    return {
+      forge: null,
+      result: "error",
+      verdict: "forge not installed — run: curl -L https://foundry.paradigm.xyz | bash && foundryup",
+      test_results: [],
+      output: "forge binary not found on PATH or ~/.foundry/bin"
+    };
+  }
+  const poc = input.poc_code ?? foundryPoc(input.class_ ?? "missing_access_control", name);
+  const dir = mkdtempSync3(join23(tmpdir4(), "blitzstrike-foundry-"));
+  try {
+    try {
+      execSync3(`${forge} init --force --no-git ${dir}`, { stdio: "ignore", timeout: 60000 });
+    } catch {
+      mkdirSync9(join23(dir, "src"), { recursive: true });
+      mkdirSync9(join23(dir, "test"), { recursive: true });
+      writeFileSync8(join23(dir, "foundry.toml"), `[profile.default]
+src = "src"
+out = "out"
+libs = ["lib"]
+solc = "0.8.20"
+`);
+    }
+    for (const f of ["Counter.sol", "Counter.t.sol", "Counter.s.sol"]) {
+      for (const sub of ["src", "test", "script"]) {
+        try {
+          rmSync4(join23(dir, sub, f), { force: true });
+        } catch {}
+      }
+    }
+    writeFileSync8(join23(dir, "src", `${name}.sol`), input.contract_code);
+    writeFileSync8(join23(dir, "test", `${name}.t.sol`), poc);
+    const { out } = runForge(forge, dir, input.timeout_ms ?? 60000);
+    const tests = parseTestResults(out);
+    const anyFail = tests.some((t) => t.status === "fail");
+    const result = tests.length === 0 ? "error" : !anyFail ? "pass" : "fail";
+    return {
+      forge,
+      result,
+      verdict: result === "pass" ? "PoC test PASSED — the exploit reproduced, the finding is PROVEN" : result === "fail" ? "PoC test did not fully pass — the exploit did NOT reproduce cleanly (review the test/fixture)" : "forge test errored — the project did not compile/run (see output)",
+      test_results: tests,
+      output: out.slice(-3000)
+    };
+  } finally {
+    rmSync4(dir, { recursive: true, force: true });
+  }
+}
+
 // src/enterprise-benchmark.ts
-import { existsSync as existsSync14, readFileSync as readFileSync25, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
-import { join as join23, resolve } from "node:path";
+import { existsSync as existsSync15, readFileSync as readFileSync25, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
+import { join as join24, resolve } from "node:path";
 init_complex_bugs();
 var ROOT6 = resolve(process.cwd(), "bench", "enterprise");
 var ENTERPRISE_FIXTURES = [
-  { id: "php-laravel", dir: join23(ROOT6, "php-laravel"), expected_vulns: 4 },
-  { id: "js-express", dir: join23(ROOT6, "js-express"), expected_vulns: 2 },
-  { id: "py-django", dir: join23(ROOT6, "py-django"), expected_vulns: 2 },
-  { id: "java-spring", dir: join23(ROOT6, "java-spring"), expected_vulns: 2 },
-  { id: "wp-batch-route", dir: join23(ROOT6, "wp-batch-route"), expected_vulns: 3 },
-  { id: "php-complex", dir: join23(ROOT6, "php-complex"), expected_vulns: 4 }
+  { id: "php-laravel", dir: join24(ROOT6, "php-laravel"), expected_vulns: 4 },
+  { id: "js-express", dir: join24(ROOT6, "js-express"), expected_vulns: 2 },
+  { id: "py-django", dir: join24(ROOT6, "py-django"), expected_vulns: 2 },
+  { id: "java-spring", dir: join24(ROOT6, "java-spring"), expected_vulns: 2 },
+  { id: "wp-batch-route", dir: join24(ROOT6, "wp-batch-route"), expected_vulns: 3 },
+  { id: "php-complex", dir: join24(ROOT6, "php-complex"), expected_vulns: 4 }
 ];
 function sourceFiles(root) {
   const out = [];
@@ -61363,7 +61470,7 @@ function sourceFiles(root) {
       return;
     }
     for (const e of entries) {
-      const p = join23(dir, e);
+      const p = join24(dir, e);
       let st;
       try {
         st = statSync3(p);
@@ -61402,7 +61509,7 @@ function detectFixture(dir) {
 function runEnterpriseBenchmark() {
   const fixtures = [];
   for (const fx of ENTERPRISE_FIXTURES) {
-    if (!existsSync14(fx.dir)) {
+    if (!existsSync15(fx.dir)) {
       fixtures.push({ id: fx.id, available: false, detected: 0, expected: fx.expected_vulns, recall: 0 });
       continue;
     }
@@ -61597,7 +61704,7 @@ function createServer2() {
 ` + `- A hard block (Cloudflare/WAF/IP-block/captcha) is NOT the end: mark the finding blocked + note the required vantage (residential / authorized / correct-SNI / --resolve direct-to-origin), then CONTINUE to the next lead (origin bypass, non-prod cluster, mobile APK, subdomain).
 ` + `- Keep trying every lead AND every chain step until each is verified/executed or blocked, THEN generate_report. Never deliver a bare surface map, and never stop at 'found X' when X enables more.
 
-` + "TWO PATHS:\\n" + "- Source path on disk -> blitz_scan / taint_file / eagle_eye2 (static).\\n" + "- Live URL -> live_recon / active_scan / strike_verify (web-hunting).\\n\\n" + "DEEPEN A FINDING: attack_plan(target, tech, params) to get the prioritized vector plan (decide what to test next with data); list_chains (escalation), chain_links (compose), technique_lookup(cls), payload_lookup, bypass_lookup (blocked). Ground any detector hit empirically with pattern_lookup(id) — it returns the class's CWE, real-world signature, escalation chains, citable references, per-class bypass techniques, and the high-value assets (crown jewels) that class hits, so a raw hit becomes a class-aware finding. Resolve free-form terminology first with synonym_lookup(term) (IDOR/BOLA/SQLi/prompt-injection → canonical id). For an llm_injection hit, its pattern carries a validation discipline — the RUN-TWICE RULE (reproduce token-for-token across two fresh sessions), NON-GUESSABLE ANCHOR (must leak a real key/URL, not a plausible guess), and OOB PROOF (a verifiable callback log) — apply all three before reporting. BEFORE generating a report, run submission_gate(...) and only ship a finding that passes all 7 questions (reproducible, in-scope, real-impact, no-privileged-assumption, verified-live, evidence-redacted, severity-derived); one false = kill it. Generate the concrete reproduction recipe with auto_poc(type, base_url, endpoint, param) — it emits the exact marker request + negative control + expected differential + Patchstack-style title, so 'reproducible' is executable, not abstract. Calibrate severity with severity_calibrate(type, cvss) to get a P1–P5 tier + VRT-style category. Start each engagement with engagement_scaffold(target, scope) for the folder + scope.md structure, and check data_refresh() to confirm the data layers are consistent. Phase doctrine: read_skill(bs-orchestrate-engagement | bs-web-hunting | bs-source-audit | bs-verify-finding). Campaign plan: read_playbook(target-type). On any failure call retry_guidance(signal) / model_fallback(signal) before giving up. HUNTING DOCTRINE (maximize payout rate): (1) SIBLING RULE — if one endpoint requires auth, check every sibling (/export /delete /share); ~30% of paid IDOR/auth bugs come from siblings — AUTOMATE it with sibling_scan(base_url, endpoint, token_a, token_b), the deterministic live logic-bug prober (sibling enumeration + differential IDOR + auth matrix + mass assignment + rate limit, evidence-first). (2) A→B SIGNAL — a confirmed bug signals a class of developer mistake; hunt B and C (20-min box) before reporting. (3) TWO-ACCOUNT IDOR — always test with attacker account A reading victim account B, and state it in the report. (4) PoC ESCALATION — IDOR shows victim data (not 200), XSS shows cookie exfil (not alert), SSRF shows internal response (not DNS), SQLi shows DB content (not error). (5) FOLLOW THE MONEY — billing/credits/refunds/wallet flows. (6) Kill weak findings with kill_list(type) BEFORE the gate — missing headers, self-XSS, open-redirect-alone, SSRF-DNS-only, GraphQL-introspection-alone are always N/A standalone. (7) CI/CD + SAML/SSO are critical attack surfaces (pull_request_target, expression injection, XML signature wrapping, comment injection). Full doctrine: hunting_doctrine().\n" + "KNOWLEDGE BASE (discover, don't guess): skillLookup(topic) / listSkills for the 40 attack-path + hunting skills (ap-*, hp-*, bs-*); list_attack_vectors / attack_vectors(cat) for the 34-category vector taxonomy; taxonomy(kind) for OWASP/CWE/ASVS/API-top-10; read_playbook(type) for the 17 campaign playbooks; list_manuals / read_tool_manual for 317 tool references; list_tools / run_catalog_tool for the 141-tool catalog. Every tool, skill, and data layer is reachable from these. CROSS-TARGET INTELLIGENCE: strike_resolve auto-records confirmed/false_positive verdicts into the empirical ledger; query it with intelligence(action=hit_rates/top_vectors/recall) so a new target on a known tech inherits historical hit-rates (attack_plan already blends them into success_probability). intelligence(action=recall, tech, target) is the per-engagement pattern recall — it returns which patterns historically CONFIRMED on that tech (prioritize them) versus which only ever produced false positives (avoid them), so a new engagement starts from the empirical playbook of past ones. LIVE PENTEST + TARGETING (black-box, WAF-safe): cache_gap(base_url, endpoint) fuzzes path-normalization + static-extension variants for cache deception/poisoning; blind_oracle(base_url, param, value) detects which SINK a param reaches (sql/ssti/xss) via benign arithmetic (id=1+0, test${7*7}) WITHOUT a malicious payload; param_precedence(base_url, param, A, B) maps duplicate-parameter precedence (first/last-wins) for WAF-bypass. OOB (out-of-band) PROOF for BLIND vulns: oob_start() spins an interactsh listener (unique *.oast.* domain, streams DNS/HTTP interactions — the standard for public targets) or a local HTTP listener for local labs; inject the canary, then oob_poll(id) until the hit arrives; oob_stop(id) to clean up. A blind SSRF/XXE/SQLi/command-injection is CONFIRMED only when the canary actually arrives — never from a guess. SOURCE TARGETING: action_surface(code) maps every wp_ajax_* action to its vuln class + DERIVED priority (what to look for WHERE); security_state(sanitizers, sink) gives a wrong-context sanitization verdict; framework_knowledge(framework) returns auth/nonce primitives for 9 frameworks; variant_scan(root, signature) mass-sweeps an install base for ONE bug family; patch_analyze(old, new) REVERSES a security patch into the 0-day, and its mine_signature feeds variant_scan to sweep unpatched copies. All of these are DETECTION HINTS — verify each live (strike_verify / browser_validate) before it enters the report. NEWEST DETECTORS — understand AND try them: variant_scan also emits priv_esc (privilege escalation — a role/capability/user change fed by request input, traced cross-file via reverse call-graph, e.g. set_role($id, sanitize_key($_POST['um-role'])) or update_user_meta(...,'wp_capabilities', $_POST[...])) and flags uploadAllow=>array('all') unrestricted-upload configs as file_upload (the file-manager/connector shape). TO TRY a priv_esc hit: submit the role field with 'administrator' (or send wp_capabilities meta) and confirm the account actually gains admin. TO TRY an unrestricted-upload hit: POST a .php/.phtml and confirm it lands web-reachable + executes. variant_scan also emits hardcoded_secret (CWE-798) in three tiers: a secret field (api_key/db_password/access_token/aws_*) assigned a literal (HIGH), a known secret FORMAT (JWT eyJ…/AWS AKIA…/GitHub ghp_…/Slack xoxb-…/…) regardless of name (HIGH), or a high-entropy suspect token (MEDIUM — verify before reporting). Verify a frontend/JS secret live via drive_devtools (inspect the JS bundle / network response and confirm the key is actually exposed), and for a backend secret confirm it is reachable/valid. A static hit is a HYPOTHESIS until verified live — never report unverified. For a repo, also scan_git_history(root) — secrets DELETED from HEAD still live in .git history (the removed-later-is-not-fixed trap), and it feeds every recovered pre-deletion blob through the same secret detector. Once you recover a credential, prove it is still ACTIVE with validate_leaked_key(apiBase, endpoints, key|blobUrl) — a READ-ONLY differential test (401-without-key vs 200-with-key = auth bypass PROVEN). Two supply-chain detectors: dependency_confusion (a manifest/build file resolving a package from a public registry — pypi.org/npmjs.org --extra-index-url, or a scoped @company/pkg with no private registry) and ml_supply_chain (torch.load without weights_only=True / joblib.load / np.load(allow_pickle=True) / keras load_model on an untrusted model → pickle RCE). Rust is supported end-to-end: the taint engine (blitz_scan / taint_file) maps Rust sinks (std::process::Command, sqlx/diesel, reqwest/hyper, std::fs, serde/bincode) to the classic classes, plus two Rust-specific detectors — rust_unsafe (transmute / assume_init / from_raw_parts / ptr::* — memory-unsafety surface, CWE-119) and rust_format_string (println!/format! with a variable as the format string — CWE-134). The sqlx query! compile-time macro is treated as safe (suppressed). Two more web-class detectors: jwt_alg_confusion (a JWT verifier that dispatches on the token's alg header and accepts BOTH RS256 and HS256, with the HS256 HMAC secret derived from public/shared key material — CWE-347; the attacker sets alg=HS256 and signs with the public key to forge admin tokens) and cache_deception (a reverse proxy caching static-extension URLs with a cache key that omits the session cookie, over a session-authenticated backend — CWE-525; the victim's cached private response is re-fetched anonymously). TO TRY a jwt_alg_confusion hit: fetch the public key (/.well-known/jwks.json), forge an HS256 token signed with that public key, and confirm admin access. TO TRY a cache_deception hit: request an authenticated path with a static extension appended (.css/.js) and re-fetch it anonymously. Three more detectors: cors_misconfiguration (Access-Control-Allow-Origin reflects the request Origin or is '*' while credentials are true — CWE-942; any site reads the victim's authenticated responses), xss (user input into a DOM sink — innerHTML / dangerouslySetInnerHTML / document.write / .html() / eval — CWE-79), and subdomain_takeover (a dangling CNAME/AliasTarget to a claimable service like *.github.io/*.herokuapp.com/*.amazonaws.com — CWE-404). TO TRY a cors hit: send an evil Origin + confirm the response echoes it with Allow-Credentials:true. TO TRY an xss hit: confirm the sink executes (drive_devtools). TO TRY a takeover hit: verify the CNAME target resolves to an unclaimed/not-found page. WEB3: for Solidity/EVM, call web3_audit(code|path) — a deterministic 13-class smart-contract audit (reentrancy incl. ERC721/ERC1155 callback reentrancy, unchecked return, unchecked arithmetic, tx.origin auth, signature replay, unprotected selfdestruct, delegatecall-to-user-input, missing access control, timestamp dependence, spot-price oracle manipulation incl. slot0/latestRoundData, unbounded loop, abi.encodePacked hash collision, missing address(0) validation) returning ranked findings (class/CWE/severity/line), then foundry_poc(class, contract) to generate an executable Foundry test that PROVES the bug. A web3 hit is a HYPOTHESIS until the Foundry PoC reproduces it.\n" + `PRECISION ANALYSIS — chrome-devtools MCP is MANDATORY, not optional:
+` + "TWO PATHS:\\n" + "- Source path on disk -> blitz_scan / taint_file / eagle_eye2 (static).\\n" + "- Live URL -> live_recon / active_scan / strike_verify (web-hunting).\\n\\n" + "DEEPEN A FINDING: attack_plan(target, tech, params) to get the prioritized vector plan (decide what to test next with data); list_chains (escalation), chain_links (compose), technique_lookup(cls), payload_lookup, bypass_lookup (blocked). Ground any detector hit empirically with pattern_lookup(id) — it returns the class's CWE, real-world signature, escalation chains, citable references, per-class bypass techniques, and the high-value assets (crown jewels) that class hits, so a raw hit becomes a class-aware finding. Resolve free-form terminology first with synonym_lookup(term) (IDOR/BOLA/SQLi/prompt-injection → canonical id). For an llm_injection hit, its pattern carries a validation discipline — the RUN-TWICE RULE (reproduce token-for-token across two fresh sessions), NON-GUESSABLE ANCHOR (must leak a real key/URL, not a plausible guess), and OOB PROOF (a verifiable callback log) — apply all three before reporting. BEFORE generating a report, run submission_gate(...) and only ship a finding that passes all 7 questions (reproducible, in-scope, real-impact, no-privileged-assumption, verified-live, evidence-redacted, severity-derived); one false = kill it. Generate the concrete reproduction recipe with auto_poc(type, base_url, endpoint, param) — it emits the exact marker request + negative control + expected differential + Patchstack-style title, so 'reproducible' is executable, not abstract. Calibrate severity with severity_calibrate(type, cvss) to get a P1–P5 tier + VRT-style category. Start each engagement with engagement_scaffold(target, scope) for the folder + scope.md structure, and check data_refresh() to confirm the data layers are consistent. Phase doctrine: read_skill(bs-orchestrate-engagement | bs-web-hunting | bs-source-audit | bs-verify-finding). Campaign plan: read_playbook(target-type). On any failure call retry_guidance(signal) / model_fallback(signal) before giving up. HUNTING DOCTRINE (maximize payout rate): (1) SIBLING RULE — if one endpoint requires auth, check every sibling (/export /delete /share); ~30% of paid IDOR/auth bugs come from siblings — AUTOMATE it with sibling_scan(base_url, endpoint, token_a, token_b), the deterministic live logic-bug prober (sibling enumeration + differential IDOR + auth matrix + mass assignment + rate limit, evidence-first). (2) A→B SIGNAL — a confirmed bug signals a class of developer mistake; hunt B and C (20-min box) before reporting. (3) TWO-ACCOUNT IDOR — always test with attacker account A reading victim account B, and state it in the report. (4) PoC ESCALATION — IDOR shows victim data (not 200), XSS shows cookie exfil (not alert), SSRF shows internal response (not DNS), SQLi shows DB content (not error). (5) FOLLOW THE MONEY — billing/credits/refunds/wallet flows. (6) Kill weak findings with kill_list(type) BEFORE the gate — missing headers, self-XSS, open-redirect-alone, SSRF-DNS-only, GraphQL-introspection-alone are always N/A standalone. (7) CI/CD + SAML/SSO are critical attack surfaces (pull_request_target, expression injection, XML signature wrapping, comment injection). Full doctrine: hunting_doctrine().\n" + "KNOWLEDGE BASE (discover, don't guess): skillLookup(topic) / listSkills for the 40 attack-path + hunting skills (ap-*, hp-*, bs-*); list_attack_vectors / attack_vectors(cat) for the 34-category vector taxonomy; taxonomy(kind) for OWASP/CWE/ASVS/API-top-10; read_playbook(type) for the 17 campaign playbooks; list_manuals / read_tool_manual for 317 tool references; list_tools / run_catalog_tool for the 141-tool catalog. Every tool, skill, and data layer is reachable from these. CROSS-TARGET INTELLIGENCE: strike_resolve auto-records confirmed/false_positive verdicts into the empirical ledger; query it with intelligence(action=hit_rates/top_vectors/recall) so a new target on a known tech inherits historical hit-rates (attack_plan already blends them into success_probability). intelligence(action=recall, tech, target) is the per-engagement pattern recall — it returns which patterns historically CONFIRMED on that tech (prioritize them) versus which only ever produced false positives (avoid them), so a new engagement starts from the empirical playbook of past ones. LIVE PENTEST + TARGETING (black-box, WAF-safe): cache_gap(base_url, endpoint) fuzzes path-normalization + static-extension variants for cache deception/poisoning; blind_oracle(base_url, param, value) detects which SINK a param reaches (sql/ssti/xss) via benign arithmetic (id=1+0, test${7*7}) WITHOUT a malicious payload; param_precedence(base_url, param, A, B) maps duplicate-parameter precedence (first/last-wins) for WAF-bypass. OOB (out-of-band) PROOF for BLIND vulns: oob_start() spins an interactsh listener (unique *.oast.* domain, streams DNS/HTTP interactions — the standard for public targets) or a local HTTP listener for local labs; inject the canary, then oob_poll(id) until the hit arrives; oob_stop(id) to clean up. A blind SSRF/XXE/SQLi/command-injection is CONFIRMED only when the canary actually arrives — never from a guess. SOURCE TARGETING: action_surface(code) maps every wp_ajax_* action to its vuln class + DERIVED priority (what to look for WHERE); security_state(sanitizers, sink) gives a wrong-context sanitization verdict; framework_knowledge(framework) returns auth/nonce primitives for 9 frameworks; variant_scan(root, signature) mass-sweeps an install base for ONE bug family; patch_analyze(old, new) REVERSES a security patch into the 0-day, and its mine_signature feeds variant_scan to sweep unpatched copies. All of these are DETECTION HINTS — verify each live (strike_verify / browser_validate) before it enters the report. NEWEST DETECTORS — understand AND try them: variant_scan also emits priv_esc (privilege escalation — a role/capability/user change fed by request input, traced cross-file via reverse call-graph, e.g. set_role($id, sanitize_key($_POST['um-role'])) or update_user_meta(...,'wp_capabilities', $_POST[...])) and flags uploadAllow=>array('all') unrestricted-upload configs as file_upload (the file-manager/connector shape). TO TRY a priv_esc hit: submit the role field with 'administrator' (or send wp_capabilities meta) and confirm the account actually gains admin. TO TRY an unrestricted-upload hit: POST a .php/.phtml and confirm it lands web-reachable + executes. variant_scan also emits hardcoded_secret (CWE-798) in three tiers: a secret field (api_key/db_password/access_token/aws_*) assigned a literal (HIGH), a known secret FORMAT (JWT eyJ…/AWS AKIA…/GitHub ghp_…/Slack xoxb-…/…) regardless of name (HIGH), or a high-entropy suspect token (MEDIUM — verify before reporting). Verify a frontend/JS secret live via drive_devtools (inspect the JS bundle / network response and confirm the key is actually exposed), and for a backend secret confirm it is reachable/valid. A static hit is a HYPOTHESIS until verified live — never report unverified. For a repo, also scan_git_history(root) — secrets DELETED from HEAD still live in .git history (the removed-later-is-not-fixed trap), and it feeds every recovered pre-deletion blob through the same secret detector. Once you recover a credential, prove it is still ACTIVE with validate_leaked_key(apiBase, endpoints, key|blobUrl) — a READ-ONLY differential test (401-without-key vs 200-with-key = auth bypass PROVEN). Two supply-chain detectors: dependency_confusion (a manifest/build file resolving a package from a public registry — pypi.org/npmjs.org --extra-index-url, or a scoped @company/pkg with no private registry) and ml_supply_chain (torch.load without weights_only=True / joblib.load / np.load(allow_pickle=True) / keras load_model on an untrusted model → pickle RCE). Rust is supported end-to-end: the taint engine (blitz_scan / taint_file) maps Rust sinks (std::process::Command, sqlx/diesel, reqwest/hyper, std::fs, serde/bincode) to the classic classes, plus two Rust-specific detectors — rust_unsafe (transmute / assume_init / from_raw_parts / ptr::* — memory-unsafety surface, CWE-119) and rust_format_string (println!/format! with a variable as the format string — CWE-134). The sqlx query! compile-time macro is treated as safe (suppressed). Two more web-class detectors: jwt_alg_confusion (a JWT verifier that dispatches on the token's alg header and accepts BOTH RS256 and HS256, with the HS256 HMAC secret derived from public/shared key material — CWE-347; the attacker sets alg=HS256 and signs with the public key to forge admin tokens) and cache_deception (a reverse proxy caching static-extension URLs with a cache key that omits the session cookie, over a session-authenticated backend — CWE-525; the victim's cached private response is re-fetched anonymously). TO TRY a jwt_alg_confusion hit: fetch the public key (/.well-known/jwks.json), forge an HS256 token signed with that public key, and confirm admin access. TO TRY a cache_deception hit: request an authenticated path with a static extension appended (.css/.js) and re-fetch it anonymously. Three more detectors: cors_misconfiguration (Access-Control-Allow-Origin reflects the request Origin or is '*' while credentials are true — CWE-942; any site reads the victim's authenticated responses), xss (user input into a DOM sink — innerHTML / dangerouslySetInnerHTML / document.write / .html() / eval — CWE-79), and subdomain_takeover (a dangling CNAME/AliasTarget to a claimable service like *.github.io/*.herokuapp.com/*.amazonaws.com — CWE-404). TO TRY a cors hit: send an evil Origin + confirm the response echoes it with Allow-Credentials:true. TO TRY an xss hit: confirm the sink executes (drive_devtools). TO TRY a takeover hit: verify the CNAME target resolves to an unclaimed/not-found page. WEB3: for Solidity/EVM, call web3_audit(code|path) — a deterministic 13-class smart-contract audit (reentrancy incl. ERC721/ERC1155 callback reentrancy, unchecked return, unchecked arithmetic, tx.origin auth, signature replay, unprotected selfdestruct, delegatecall-to-user-input, missing access control, timestamp dependence, spot-price oracle manipulation incl. slot0/latestRoundData, unbounded loop, abi.encodePacked hash collision, missing address(0) validation) returning ranked findings (class/CWE/severity/line), then foundry_poc(class, contract) to generate an executable Foundry test, and foundry_run(contract_code, poc_code|class_) to actually EXECUTE it — a PASSING PoC test is the proof that the exploit reproduces (deterministic: forge's own test verdict). A web3 hit is a HYPOTHESIS until the Foundry PoC reproduces it.\n" + `PRECISION ANALYSIS — chrome-devtools MCP is MANDATORY, not optional:
 ` + `- When a lead needs DOM/JS precision — DOM-XSS sink execution, AJAX endpoint + payload interception, JS runtime errors, redirect chains, SSO/token flow, or anything a static HTML glance cannot prove — call drive_devtools(target). It spawns chrome-devtools-mcp and drives a REAL headless browser (navigate -> list_network_requests -> list_console_messages -> evaluate_script), giving reproducible evidence instead of a guess.
 ` + `- Before calling it, check_mcp() to confirm the browser MCP is available; if not, blitzstrike install-tools or npm i -g chrome-devtools-mcp. Never substitute eyeballing minified JS or a static sink guess when a live browser can PROVE it. This is the precision + consistency layer.
 ` + "EXTERNAL MCP SERVERS (verified, connect them — NOT one-shot CLIs): chrome-devtools-mcp (29 tools: list_network_requests/get_network_request for raw HTTP interception, list_console_messages for JS errors + DOM-XSS, evaluate_script to run JS, take_screenshot) -> stdio chrome-devtools-mcp --headless --chromeArg=--no-sandbox --chromeArg=--disable-gpu (as root/container this is MANDATORY or the browser crashes; add --proxyServer http://127.0.0.1:8080 to route through Burp, --acceptInsecureCerts for bad TLS). burp-suite-mcp (proxy history + active scan + repeater) -> NOT npm: build the JAR (git clone https://github.com/PortSwigger/mcp-server.git && cd mcp-server && ./gradlew embedProxyJar), load it in Burp Extensions, then connect the client to http://127.0.0.1:9876 (SSE) or the stdio proxy java -jar mcp-proxy-all.jar --sse-url http://127.0.0.1:9876."
@@ -62579,6 +62686,18 @@ ${statusLine}` : statusLine },
   }, async ({ class_, contract }) => {
     return { content: [{ type: "text", text: foundryPoc(class_, contract ?? "Vulnerable") }] };
   });
+  server.registerTool("foundry_run", {
+    title: "Run a Foundry PoC test to PROVE a Web3 finding",
+    description: "WEB3: actually execute a Foundry PoC test against a vulnerable contract. Pass the contract source + a PoC test (or a class to auto-generate it), and it scaffolds a temp Foundry project and runs `forge test`. A PASSING PoC test = the exploit reproduced = the finding is PROVEN (deterministic — the verdict is forge's own test result). Requires forge installed (curl -L https://foundry.paradigm.xyz | bash && foundryup).",
+    inputSchema: {
+      contract_code: string2().describe("The vulnerable Solidity contract source"),
+      poc_code: string2().optional().describe("The Foundry PoC test (.t.sol); omit to auto-generate from class_"),
+      class_: string2().optional().describe("Web3 finding class to auto-generate the PoC from (reentrancy, missing_access_control, …)"),
+      contract_name: string2().optional().describe("Contract name for file naming (default 'Vulnerable')")
+    }
+  }, async ({ contract_code, poc_code, class_, contract_name }) => {
+    return { content: [{ type: "text", text: JSON.stringify(await foundryRun({ contract_code, poc_code, class_, contract_name })) }] };
+  });
   server.registerTool("kill_list", {
     title: "Always-rejected finding kill-list (pre-gate)",
     description: "Deterministic always-rejected check: pass a finding type (open_redirect, missing_headers, self_xss, graphql_introspection, ssrf_dns_only, …) to get rejected:true when it is a known weak class that must NOT be submitted standalone (chain it to real impact first). Omit the type to enumerate the full kill-list. Run this BEFORE submission_gate — it takes 30 seconds to kill a bad lead.",
@@ -63563,14 +63682,14 @@ async function serve() {
 
 // src/index.ts
 init_cli();
-import { readFileSync as readFileSync31, existsSync as existsSync17 } from "node:fs";
-import { join as join28 } from "node:path";
+import { readFileSync as readFileSync31, existsSync as existsSync18 } from "node:fs";
+import { join as join29 } from "node:path";
 import { fileURLToPath as fileURLToPath17 } from "node:url";
-var ROOT11 = join28(fileURLToPath17(new URL(".", import.meta.url)), "..");
+var ROOT11 = join29(fileURLToPath17(new URL(".", import.meta.url)), "..");
 function readVersion() {
   try {
-    const p = join28(ROOT11, "package.json");
-    if (existsSync17(p))
+    const p = join29(ROOT11, "package.json");
+    if (existsSync18(p))
       return JSON.parse(readFileSync31(p, "utf8")).version ?? "1.0.0";
   } catch {}
   return "1.0.0";

package/intelligence/patterns.json

@@ -1,7 +1,7 @@
 {
   "$schema": "blitzstrike-patterns-v1",
   "version": "1.1.0",
-  "_comment": "Empirical grounding layer. Every detector type is traced to its real-world bug class (CWE), its real-world signature, the chains it composes into (cross-ref chains.json), citable references, per-class bypass techniques, and the high-value assets (crown jewels) that class typically hits. Detection is derived from this data, never hardcoded. References are public standards (CWE/OWASP) and disclosed-report classes — no vendor/product framing.",
+  "_comment": "Empirical grounding layer. Every detector type is traced to its real-world bug class (CWE), its real-world signature, the chains it composes into (cross-ref chains.json), citable references, per-class bypass techniques, and the high-value assets (crown jewels) that class typically hits. Detection is derived from this data, never hardcoded. References are public standards (CWE/OWASP) and disclosed-report classes \u2014 no vendor/product framing.",
   "patterns": [
     {
       "id": "sql_injection",
@@ -38,7 +38,7 @@
       ],
       "payout_min": 1000,
       "payout_max": 15000,
-      "typical_payout": "$1K–$15K"
+      "typical_payout": "$1K\u2013$15K"
     },
     {
       "id": "ssrf",
@@ -73,13 +73,13 @@
       ],
       "payout_min": 1000,
       "payout_max": 15000,
-      "typical_payout": "$1K–$15K"
+      "typical_payout": "$1K\u2013$15K"
     },
     {
       "id": "ssti",
       "name": "Server-Side Template Injection",
       "cwe": "CWE-1336",
-      "real_world": "User input reaches a template engine (Jinja2, Twig, Freemarker, ERB, …) that evaluates expressions, yielding code execution via template syntax like {{7*7}}.",
+      "real_world": "User input reaches a template engine (Jinja2, Twig, Freemarker, ERB, \u2026) that evaluates expressions, yielding code execution via template syntax like {{7*7}}.",
       "detection_signatures": [
         "template render of request input",
         "expression evaluation in a template engine"
@@ -96,7 +96,7 @@
         "sandbox escape via attribute/object introspection",
         "unicode/alternate delimiter to dodge input filters",
         "chaining globals/locals to reach builtins",
-        "engine-specific escapes (Jinja2 → Python, Twig → PHP)"
+        "engine-specific escapes (Jinja2 \u2192 Python, Twig \u2192 PHP)"
       ],
       "crown_jewels": [
         "direct RCE",
@@ -105,7 +105,7 @@
       ],
       "payout_min": 2000,
       "payout_max": 10000,
-      "typical_payout": "$2K–$10K"
+      "typical_payout": "$2K\u2013$10K"
     },
     {
       "id": "xxe",
@@ -136,7 +136,7 @@
       ],
       "payout_min": 1000,
       "payout_max": 10000,
-      "typical_payout": "$1K–$10K"
+      "typical_payout": "$1K\u2013$10K"
     },
     {
       "id": "deserialization",
@@ -169,7 +169,7 @@
       ],
       "payout_min": 5000,
       "payout_max": 30000,
-      "typical_payout": "$5K–$30K"
+      "typical_payout": "$5K\u2013$30K"
     },
     {
       "id": "type_juggling",
@@ -188,7 +188,7 @@
         "OWASP A07:2021 Identification and Authentication Failures"
       ],
       "bypass_techniques": [
-        "0e magic hashes (0e1234… == 0e5678…)",
+        "0e magic hashes (0e1234\u2026 == 0e5678\u2026)",
         "numeric-string coercion (\"1admin\" == 1)",
         "array comparison (array() == false)",
         "null/empty-string coercion"
@@ -200,7 +200,7 @@
       ],
       "payout_min": 500,
       "payout_max": 5000,
-      "typical_payout": "$500–$5K"
+      "typical_payout": "$500\u2013$5K"
     },
     {
       "id": "mass_assignment",
@@ -232,7 +232,7 @@
       ],
       "payout_min": 500,
       "payout_max": 5000,
-      "typical_payout": "$500–$5K"
+      "typical_payout": "$500\u2013$5K"
     },
     {
       "id": "prototype_pollution",
@@ -262,7 +262,7 @@
       ],
       "payout_min": 1000,
       "payout_max": 10000,
-      "typical_payout": "$1K–$10K"
+      "typical_payout": "$1K\u2013$10K"
     },
     {
       "id": "crlf_injection",
@@ -286,13 +286,13 @@
         "header smuggling via folded headers"
       ],
       "crown_jewels": [
-        "Set-Cookie injection → session fixation",
-        "response splitting → XSS",
-        "cache poisoning → stored XSS"
+        "Set-Cookie injection \u2192 session fixation",
+        "response splitting \u2192 XSS",
+        "cache poisoning \u2192 stored XSS"
       ],
       "payout_min": 300,
       "payout_max": 3000,
-      "typical_payout": "$300–$3K"
+      "typical_payout": "$300\u2013$3K"
     },
     {
       "id": "path_confusion",
@@ -327,7 +327,7 @@
       ],
       "payout_min": 1000,
       "payout_max": 10000,
-      "typical_payout": "$1K–$10K"
+      "typical_payout": "$1K\u2013$10K"
     },
     {
       "id": "wrong_sanitizer",
@@ -355,7 +355,7 @@
       ],
       "payout_min": 300,
       "payout_max": 3000,
-      "typical_payout": "$300–$3K"
+      "typical_payout": "$300\u2013$3K"
     },
     {
       "id": "missing_authz",
@@ -388,7 +388,7 @@
       ],
       "payout_min": 1000,
       "payout_max": 10000,
-      "typical_payout": "$1K–$10K",
+      "typical_payout": "$1K\u2013$10K",
       "validation": [
         "Two-account test: attacker account A reads victim account B's object (A's token + B's id -> B's data). A single self-account test does not prove IDOR."
       ]
@@ -421,7 +421,7 @@
       ],
       "payout_min": 300,
       "payout_max": 3000,
-      "typical_payout": "$300–$3K"
+      "typical_payout": "$300\u2013$3K"
     },
     {
       "id": "file_upload",
@@ -455,7 +455,7 @@
       ],
       "payout_min": 500,
       "payout_max": 10000,
-      "typical_payout": "$500–$10K"
+      "typical_payout": "$500\u2013$10K"
     },
     {
       "id": "priv_esc",
@@ -487,7 +487,7 @@
       ],
       "payout_min": 1000,
       "payout_max": 10000,
-      "typical_payout": "$1K–$10K"
+      "typical_payout": "$1K\u2013$10K"
     },
     {
       "id": "hardcoded_secret",
@@ -496,7 +496,7 @@
       "real_world": "A secret (API key, database password, access token, private key) is committed in source, exposing it to anyone with repo access. Real disclosures regularly turn a leaked key into account takeover or cloud compromise.",
       "detection_signatures": [
         "secret field assigned a literal",
-        "known secret format (JWT/AWS/GitHub/Slack/…) in source",
+        "known secret format (JWT/AWS/GitHub/Slack/\u2026) in source",
         "high-entropy token under a non-obvious name"
       ],
       "chain_templates": [
@@ -522,7 +522,7 @@
       ],
       "payout_min": 500,
       "payout_max": 10000,
-      "typical_payout": "$500–$10K"
+      "typical_payout": "$500\u2013$10K"
     },
     {
       "id": "llm_injection",
@@ -551,13 +551,13 @@
         "privileged actions (email/send/pay) gated on model output"
       ],
       "validation": [
-        "RUN-TWICE RULE — the extraction/injection must reproduce token-for-token across two fresh sessions (filter out model confabulation)",
-        "NON-GUESSABLE ANCHOR — it must leak an actual verifiable internal key, endpoint URL, or cross-tenant data, not a plausible guess",
-        "OOB PROOF — tool-use or markdown exfiltration must produce a verifiable callback log on your listener"
+        "RUN-TWICE RULE \u2014 the extraction/injection must reproduce token-for-token across two fresh sessions (filter out model confabulation)",
+        "NON-GUESSABLE ANCHOR \u2014 it must leak an actual verifiable internal key, endpoint URL, or cross-tenant data, not a plausible guess",
+        "OOB PROOF \u2014 tool-use or markdown exfiltration must produce a verifiable callback log on your listener"
       ],
       "payout_min": 500,
       "payout_max": 10000,
-      "typical_payout": "$500–$10K"
+      "typical_payout": "$500\u2013$10K"
     },
     {
       "id": "graphql_exposure",
@@ -587,7 +587,7 @@
       ],
       "payout_min": 500,
       "payout_max": 5000,
-      "typical_payout": "$500–$5K"
+      "typical_payout": "$500\u2013$5K"
     },
     {
       "id": "oauth_misconfig",
@@ -619,7 +619,7 @@
       ],
       "payout_min": 500,
       "payout_max": 5000,
-      "typical_payout": "$500–$5K"
+      "typical_payout": "$500\u2013$5K"
     },
     {
       "id": "grpc_reflection",
@@ -645,7 +645,7 @@
       ],
       "payout_min": 200,
       "payout_max": 2000,
-      "typical_payout": "$200–$2K"
+      "typical_payout": "$200\u2013$2K"
     },
     {
       "id": "dependency_confusion",
@@ -674,12 +674,12 @@
       ],
       "payout_min": 1000,
       "payout_max": 20000,
-      "typical_payout": "$1K–$20K"
+      "typical_payout": "$1K\u2013$20K"
     },
     {
       "id": "ml_supply_chain",
       "cwe": "CWE-502",
-      "real_world": "A poisoned model file (pickle) hosted at a URL or uploaded by a user is loaded via torch.load/joblib.load without the safe flag → arbitrary code execution on load.",
+      "real_world": "A poisoned model file (pickle) hosted at a URL or uploaded by a user is loaded via torch.load/joblib.load without the safe flag \u2192 arbitrary code execution on load.",
       "detection_signatures": [
         "torch.load(...) without weights_only=True",
         "joblib.load(...) / keras.models.load_model(...) / np.load(...allow_pickle=True) on an untrusted path/URL"
@@ -702,7 +702,7 @@
       ],
       "payout_min": 1000,
       "payout_max": 20000,
-      "typical_payout": "$1K–$20K"
+      "typical_payout": "$1K\u2013$20K"
     },
     {
       "id": "rust_unsafe",
@@ -720,7 +720,7 @@
         "CWE-119",
         "CWE-787",
         "CWE-416",
-        "Rust Foundation — Unsafe Rust in the Wild",
+        "Rust Foundation \u2014 Unsafe Rust in the Wild",
         "guardsarm/rust-memory-safety-examples",
         "doc.rust-lang.org/rustc/exploit-mitigations.html"
       ],
@@ -737,12 +737,12 @@
       ],
       "payout_min": 500,
       "payout_max": 10000,
-      "typical_payout": "$500–$10K"
+      "typical_payout": "$500\u2013$10K"
     },
     {
       "id": "rust_format_string",
       "cwe": "CWE-134",
-      "real_world": "A server logs or prints a user-supplied string as the format argument — println!(user_input) — so the attacker's format specifiers (positional args, width/precision) read or corrupt memory.",
+      "real_world": "A server logs or prints a user-supplied string as the format argument \u2014 println!(user_input) \u2014 so the attacker's format specifiers (positional args, width/precision) read or corrupt memory.",
       "detection_signatures": [
         "format!(var) / println!(var) / print!(var) / eprintln!(var) with a VARIABLE as the format string (not a literal)"
       ],
@@ -751,7 +751,7 @@
         "CWE-134",
         "OWASP WSTG-INPV-13 Format String Injection",
         "yevh/rust-security-handbook (injection attack prevention)",
-        "StackHawk — Rust command injection examples"
+        "StackHawk \u2014 Rust command injection examples"
       ],
       "bypass_techniques": [
         "width/precision specifiers to read past the intended argument",
@@ -765,7 +765,7 @@
       ],
       "payout_min": 500,
       "payout_max": 5000,
-      "typical_payout": "$500–$5K"
+      "typical_payout": "$500\u2013$5K"
     },
     {
       "id": "jwt_alg_confusion",
@@ -802,7 +802,7 @@
       ],
       "payout_min": 1000,
       "payout_max": 10000,
-      "typical_payout": "$1K–$10K"
+      "typical_payout": "$1K\u2013$10K"
     },
     {
       "id": "cache_deception",
@@ -815,7 +815,7 @@
       ],
       "references": [
         "CWE-525",
-        "Omer Gil — Web Cache Deception Attack",
+        "Omer Gil \u2014 Web Cache Deception Attack",
         "OWASP WSTG-ATHN-03"
       ],
       "real_world": "A reverse proxy caches static-extension URLs (.css/.js/.png) with a cache key that omits the session cookie, while a backend route (often a greedy regex like /account(/.*)?) serves per-session private data for those URLs. An attacker submits a victim-visited URL, the bot's private response is cached, then re-fetched anonymously.",
@@ -839,7 +839,7 @@
       ],
       "payout_min": 1000,
       "payout_max": 10000,
-      "typical_payout": "$1K–$10K"
+      "typical_payout": "$1K\u2013$10K"
     },
     {
       "id": "cors_misconfiguration",
@@ -854,7 +854,7 @@
       "references": [
         "CWE-942",
         "OWASP WSTG-CLNT-01",
-        "PortSwigger — CORS vulnerability with basic origin reflection"
+        "PortSwigger \u2014 CORS vulnerability with basic origin reflection"
       ],
       "real_world": "A server echoes the request Origin header into Access-Control-Allow-Origin while also sending Access-Control-Allow-Credentials: true. Any website the victim visits can then make credentialed requests and read the victim's authenticated responses cross-origin (session theft, account data exfil).",
       "detection_signatures": [
@@ -878,7 +878,7 @@
       ],
       "payout_min": 500,
       "payout_max": 5000,
-      "typical_payout": "$500–$5K"
+      "typical_payout": "$500\u2013$5K"
     },
     {
       "id": "xss",
@@ -892,7 +892,7 @@
       "references": [
         "CWE-79",
         "OWASP WSTG-INPV-02",
-        "PortSwigger — DOM-based XSS"
+        "PortSwigger \u2014 DOM-based XSS"
       ],
       "real_world": "A DOM sink (innerHTML, document.write, dangerouslySetInnerHTML, jQuery .html(), eval) is fed user-controlled input without sanitization/encoding. The injected script runs in the victim's origin, stealing cookies, hijacking the session, or exfiltrating data.",
       "detection_signatures": [
@@ -915,14 +915,14 @@
       ],
       "payout_min": 500,
       "payout_max": 5000,
-      "typical_payout": "$500–$5K"
+      "typical_payout": "$500\u2013$5K"
     },
     {
       "id": "subdomain_takeover",
       "name": "Subdomain Takeover",
       "cwe": "CWE-404",
       "severity": "high",
-      "signature": "a DNS CNAME/AliasTarget points at a service that can be claimed by an attacker (GitHub Pages/S3/Heroku/…)",
+      "signature": "a DNS CNAME/AliasTarget points at a service that can be claimed by an attacker (GitHub Pages/S3/Heroku/\u2026)",
       "chains": [
         "subdomain_takeover",
         "subdomain_takeover_to_cookie_theft"
@@ -932,9 +932,9 @@
         "OWASP WSTG-CONFIG-10",
         "Can I Take Over XYZ (EdOverflow)"
       ],
-      "real_world": "A dangling DNS record (CNAME/AliasTarget) points to a service the org no longer owns (e.g. a deleted GitHub Pages repo, S3 bucket, or Heroku app). An attacker re-registers that name and serves arbitrary content from the victim's subdomain — phishing, cookie theft via a parent-domain cookie, and same-origin attacks.",
+      "real_world": "A dangling DNS record (CNAME/AliasTarget) points to a service the org no longer owns (e.g. a deleted GitHub Pages repo, S3 bucket, or Heroku app). An attacker re-registers that name and serves arbitrary content from the victim's subdomain \u2014 phishing, cookie theft via a parent-domain cookie, and same-origin attacks.",
       "detection_signatures": [
-        "CNAME/AliasTarget/DNSName -> *.github.io / *.herokuapp.com / *.amazonaws.com / …",
+        "CNAME/AliasTarget/DNSName -> *.github.io / *.herokuapp.com / *.amazonaws.com / \u2026",
         "aws_route53_record type=CNAME with an unclaimed service target"
       ],
       "chain_templates": [
@@ -952,7 +952,42 @@
       ],
       "payout_min": 500,
       "payout_max": 5000,
-      "typical_payout": "$500–$5K"
+      "typical_payout": "$500\u2013$5K"
+    },
+    {
+      "id": "command_injection",
+      "name": "OS Command Injection",
+      "cwe": "CWE-78",
+      "real_world": "User input is interpolated into a shell command (system/exec/popen/subprocess) without argument escaping. Attackers append ; | && $(...) to run arbitrary commands, from id/whoami probes to full reverse shells.",
+      "detection_signatures": [
+        "raw input concatenated into a shell/exec sink",
+        "no escapeshellarg / argument-array / shlex.quote",
+        "user-controlled parameter into os.system / subprocess / exec"
+      ],
+      "chain_templates": [
+        "command_injection_os_cmd"
+      ],
+      "references": [
+        "CWE-78",
+        "OWASP A03:2021 Injection"
+      ],
+      "bypass_techniques": [
+        "command separators ; | && || for chained commands",
+        "$(...) and backtick substitution to bypass keyword filters",
+        "newline / IFS-based argument splitting",
+        "URL + hex encoding of payloads",
+        "base64-encode the payload, then decode + execute"
+      ],
+      "crown_jewels": [
+        "shell access (reverse shell / bind shell)",
+        "credential files (config, .env, id_rsa)",
+        "database dumps",
+        "internal network pivoting"
+      ],
+      "severity": "critical",
+      "payout_min": 1000,
+      "payout_max": 15000,
+      "typical_payout": "$1K\u2013$15K"
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.90",
+  "version": "2.4.92",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {