blitzstrike 2.4.93 → 2.4.95

package/CHANGELOG.md

@@ -5,6 +5,40 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.95] — 2026-09-17
+
+### Fixed — full interconnection audit (unreachable template + 2 ungrounded classes)
+
+- `auto_poc` `open_redirect` template was UNREACHABLE: `canonicalId("open_redirect")`
+  resolves to `oauth_misconfig`, but the template key was `open_redirect`, so the
+  lookup fell back to the `missing_authz` recipe. Renamed the key to the canonical
+  `oauth_misconfig` + added an interconn invariant that every auto-poc key IS its
+  own canonical id.
+- `nosql_injection` and `host_header` were referenced across intel/orchestrator/
+  writeup/technique-lookup but had no pattern, severity, or synonym (ungrounded).
+  Added full patterns (CWE-943 / CWE-644), severity VRT entries (P1 critical /
+  P3 medium), and synonyms (nosql/mongo injection; host-header poisoning /
+  password-reset poisoning). cwe_map already carried both CWEs.
+- `SINK_TO_VECTOR` mapped the `code_execution` sink to a non-pattern vector name;
+  now maps to `command_injection` (consistent with the "code execution" synonym).
+
+## [2.4.94] — 2026-09-17
+
+### Added — Hunting intel (DNS sinkhole detection + CWE/CVE watchlist)
+
+- `resolve_check(host)` — detects when an ISP/country redirects a domain to a
+  blocking/sinkhole page (gambling/adult/streaming niches). Compares the local
+  resolver against public DNS (8.8.8.8/1.1.1.1) and probes the local IP for
+  blocking-page content — the CONTENT is the signal (a differing IP set alone is
+  normal for CDN/anycast). A sinkhole verdict tells the agent to audit the PUBLIC
+  IP, never the sinkhole.
+- `watchlist()` — the ranked bug-bounty CWE frequency (17 classes) + high-value
+  CVE watchlist (9 CVEs), each with payout range + a saturated flag, joined to a
+  Blitz Strike detector pattern for grounding. Prioritizes high-frequency /
+  high-payout / not-yet-saturated classes (missing-authz, SQLi, SSRF,
+  deserialization) and flags saturated low-value ones (XSS/CSRF/open-redirect).
+  Data: intelligence/watchlist.json.
+
 ## [2.4.93] — 2026-09-17
 
 ### Fixed — reproducible verify harness (flaky wordlist test)

package/dist/index.js

@@ -17349,8 +17349,8 @@ var init_variants = __esm(() => {
 });
 
 // src/sync.ts
-import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync9, readFileSync as readFileSync26, readdirSync as readdirSync7, statSync as statSync4, rmSync as rmSync5 } from "node:fs";
-import { join as join25 } from "node:path";
+import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync9, readFileSync as readFileSync27, readdirSync as readdirSync7, statSync as statSync4, rmSync as rmSync5 } from "node:fs";
+import { join as join26 } from "node:path";
 import { homedir as homedir10 } from "node:os";
 import { fileURLToPath as fileURLToPath13 } from "node:url";
 import { spawnSync as spawnSync4 } from "node:child_process";
@@ -17367,7 +17367,7 @@ function countFiles(dir) {
     const walk = (d) => {
       for (const e of readdirSync7(d, { withFileTypes: true })) {
         if (e.isDirectory())
-          walk(join25(d, e.name));
+          walk(join26(d, e.name));
         else
           n++;
       }
@@ -17381,8 +17381,8 @@ function countFiles(dir) {
 function syncData() {
   if (!dirExists(DATA_ROOT2))
     mkdirSync10(DATA_ROOT2, { recursive: true });
-  const payloadsPath = join25(DATA_ROOT2, "payloads");
-  const templatesPath = join25(DATA_ROOT2, "templates");
+  const payloadsPath = join26(DATA_ROOT2, "payloads");
+  const templatesPath = join26(DATA_ROOT2, "templates");
   const hasPayloads = dirExists(payloadsPath) && countFiles(payloadsPath) > 0;
   const hasTemplates = dirExists(templatesPath) && countFiles(templatesPath) > 0;
   if (hasPayloads && hasTemplates) {
@@ -17392,8 +17392,8 @@ function syncData() {
       data_root: DATA_ROOT2
     };
   }
-  const localPayloads = join25(ROOT7, "payloads");
-  const localTemplates = join25(ROOT7, "templates");
+  const localPayloads = join26(ROOT7, "payloads");
+  const localTemplates = join26(ROOT7, "templates");
   let payloadsSynced = false;
   let templatesSynced = false;
   if (!hasPayloads && dirExists(localPayloads)) {
@@ -17406,7 +17406,7 @@ function syncData() {
   }
   const gitOk = spawnSync4("git", ["--version"]).status === 0;
   if (gitOk && (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0 || !dirExists(templatesPath) || countFiles(templatesPath) === 0)) {
-    const tmp = join25(DATA_ROOT2, ".tmp-clone");
+    const tmp = join26(DATA_ROOT2, ".tmp-clone");
     if (dirExists(tmp))
       rmSync5(tmp, { recursive: true, force: true });
     const r = spawnSync4("git", ["clone", "--depth", "1", "--filter=blob:none", "--sparse", GITHUB_REPO, tmp], { timeout: 120000 });
@@ -17414,11 +17414,11 @@ function syncData() {
       const sparse = spawnSync4("git", ["-C", tmp, "sparse-checkout", "set", "payloads", "templates"], { timeout: 120000 });
       if (sparse.status === 0) {
         if (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0) {
-          copyDir(join25(tmp, "payloads"), payloadsPath);
+          copyDir(join26(tmp, "payloads"), payloadsPath);
           payloadsSynced = true;
         }
         if (!dirExists(templatesPath) || countFiles(templatesPath) === 0) {
-          copyDir(join25(tmp, "templates"), templatesPath);
+          copyDir(join26(tmp, "templates"), templatesPath);
           templatesSynced = true;
         }
       }
@@ -17440,18 +17440,18 @@ function copyDir(src, dst) {
 function manualCopy(src, dst) {
   mkdirSync10(dst, { recursive: true });
   for (const e of readdirSync7(src, { withFileTypes: true })) {
-    const s = join25(src, e.name);
-    const d = join25(dst, e.name);
+    const s = join26(src, e.name);
+    const d = join26(dst, e.name);
     if (e.isDirectory())
       manualCopy(s, d);
     else
-      writeFileSync9(d, readFileSync26(s));
+      writeFileSync9(d, readFileSync27(s));
   }
 }
 var ROOT7, DATA_ROOT2, GITHUB_REPO = "https://github.com/shinthink/blitzstrike.git";
 var init_sync = __esm(() => {
-  ROOT7 = join25(fileURLToPath13(new URL(".", import.meta.url)), "..");
-  DATA_ROOT2 = process.env.BLITZSTRIKE_DATA ?? join25(homedir10(), ".blitzstrike", "data");
+  ROOT7 = join26(fileURLToPath13(new URL(".", import.meta.url)), "..");
+  DATA_ROOT2 = process.env.BLITZSTRIKE_DATA ?? join26(homedir10(), ".blitzstrike", "data");
 });
 
 // src/update.ts
@@ -17496,15 +17496,15 @@ var init_update = __esm(() => {
 });
 
 // src/release.ts
-import { readFileSync as readFileSync28, existsSync as existsSync16 } from "node:fs";
-import { join as join26 } from "node:path";
+import { readFileSync as readFileSync29, existsSync as existsSync16 } from "node:fs";
+import { join as join27 } from "node:path";
 import { fileURLToPath as fileURLToPath14 } from "node:url";
-import { execSync as execSync4 } from "node:child_process";
+import { execSync as execSync5 } from "node:child_process";
 function validateRelease() {
   const checks = [];
   checks.push({ name: "package.json version", ok: true, detail: VERSION });
   try {
-    const changelog = readFileSync28(join26(ROOT8, "CHANGELOG.md"), "utf8");
+    const changelog = readFileSync29(join27(ROOT8, "CHANGELOG.md"), "utf8");
     const m = changelog.match(/^##\s+\[([0-9]+\.[0-9]+\.[0-9]+)\]/m);
     const changelogVersion = m?.[1] ?? null;
     checks.push({
@@ -17516,13 +17516,13 @@ function validateRelease() {
     checks.push({ name: "CHANGELOG version", ok: false, detail: "CHANGELOG.md not found" });
   }
   try {
-    const tag = execSync4("git describe --tags --abbrev=0", { cwd: ROOT8, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    const tag = execSync5("git describe --tags --abbrev=0", { cwd: ROOT8, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
     checks.push({ name: "Git tag", ok: tag === `v${VERSION}`, detail: tag, soft: true });
   } catch {
     checks.push({ name: "Git tag", ok: true, detail: "unavailable (no git/tags)", soft: true });
   }
   try {
-    const published = execSync4("npm view blitzstrike version", { encoding: "utf8", timeout: 8000, stdio: ["ignore", "pipe", "ignore"] }).trim();
+    const published = execSync5("npm view blitzstrike version", { encoding: "utf8", timeout: 8000, stdio: ["ignore", "pipe", "ignore"] }).trim();
     checks.push({ name: "npm registry version", ok: published === VERSION, detail: published, soft: true });
   } catch {
     checks.push({ name: "npm registry version", ok: true, detail: "unavailable (offline)", soft: true });
@@ -17536,22 +17536,22 @@ function validateRelease() {
   return { version: VERSION, checks, consistent: checks.filter((c) => !c.soft).every((c) => c.ok) };
 }
 function lockfilePresent() {
-  return existsSync16(join26(ROOT8, "package-lock.json")) || existsSync16(join26(ROOT8, "bun.lock")) || existsSync16(join26(ROOT8, "bun.lockb"));
+  return existsSync16(join27(ROOT8, "package-lock.json")) || existsSync16(join27(ROOT8, "bun.lock")) || existsSync16(join27(ROOT8, "bun.lockb"));
 }
 var ROOT8;
 var init_release = __esm(() => {
   init_version();
-  ROOT8 = join26(fileURLToPath14(new URL(".", import.meta.url)), "..");
+  ROOT8 = join27(fileURLToPath14(new URL(".", import.meta.url)), "..");
 });
 
 // src/dependency.ts
-import { readFileSync as readFileSync29 } from "node:fs";
-import { join as join27 } from "node:path";
+import { readFileSync as readFileSync30 } from "node:fs";
+import { join as join28 } from "node:path";
 import { fileURLToPath as fileURLToPath15 } from "node:url";
 function checkDependencies() {
   let pkg = {};
   try {
-    pkg = JSON.parse(readFileSync29(join27(ROOT9, "package.json"), "utf8"));
+    pkg = JSON.parse(readFileSync30(join28(ROOT9, "package.json"), "utf8"));
   } catch {
     return { install_scripts: [], git_dependencies: [], total_dependencies: 0, safe: false };
   }
@@ -17574,12 +17574,12 @@ function checkDependencies() {
 }
 var ROOT9;
 var init_dependency = __esm(() => {
-  ROOT9 = join27(fileURLToPath15(new URL(".", import.meta.url)), "..");
+  ROOT9 = join28(fileURLToPath15(new URL(".", import.meta.url)), "..");
 });
 
 // src/cli.ts
-import { readFileSync as readFileSync30, existsSync as existsSync17, writeFileSync as writeFileSync10, mkdirSync as mkdirSync11 } from "node:fs";
-import { join as join28, dirname as dirname6 } from "node:path";
+import { readFileSync as readFileSync31, existsSync as existsSync17, writeFileSync as writeFileSync10, mkdirSync as mkdirSync11 } from "node:fs";
+import { join as join29, dirname as dirname6 } from "node:path";
 import { homedir as homedir11 } from "node:os";
 import { fileURLToPath as fileURLToPath16 } from "node:url";
 import { spawnSync as spawnSync5 } from "node:child_process";
@@ -17624,7 +17624,7 @@ async function runDoctor() {
     detail: h1 ? `X-HackerOne-Research: ${h1}` : "H1_USERNAME not set",
     fix: h1 ? undefined : "export H1_USERNAME=<your-hackerone-username> (adds X-HackerOne-Research to outbound requests)"
   });
-  const dataOk = existsSync17(join28(ROOT10, "chains.json")) && existsSync17(join28(ROOT10, "tools-catalog.json"));
+  const dataOk = existsSync17(join29(ROOT10, "chains.json")) && existsSync17(join29(ROOT10, "tools-catalog.json"));
   issues.push({
     name: "Data layers (chains + tools-catalog)",
     status: dataOk ? "ok" : "fail",
@@ -17675,21 +17675,21 @@ BlitzStrike — ${verdict}`);
 function resolveCommand() {
   if (which("blitzstrike"))
     return { command: "blitzstrike", args: ["serve", "--mcp"] };
-  const src = join28(ROOT10, "src", "index.ts");
+  const src = join29(ROOT10, "src", "index.ts");
   if (which("bun") && existsSync17(src))
     return { command: "bun", args: ["run", src, "serve", "--mcp"] };
   if (which("npx"))
     return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
   if (which("bunx"))
     return { command: "bunx", args: ["blitzstrike", "serve", "--mcp"] };
-  const dist = join28(ROOT10, "dist", "index.js");
+  const dist = join29(ROOT10, "dist", "index.js");
   if (existsSync17(dist))
     return { command: "bun", args: [dist, "serve", "--mcp"] };
   return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
 }
 function readJson(p) {
   try {
-    return JSON.parse(readFileSync30(p, "utf8"));
+    return JSON.parse(readFileSync31(p, "utf8"));
   } catch {
     return null;
   }
@@ -17722,17 +17722,17 @@ function opencodeWrite(p) {
   };
 }
 function copyOpenCodeAgents() {
-  const srcDir = join28(ROOT10, "opencode-agents");
-  const dstDir = join28(homedir11(), ".config", "opencode", "agents");
+  const srcDir = join29(ROOT10, "opencode-agents");
+  const dstDir = join29(homedir11(), ".config", "opencode", "agents");
   if (!existsSync17(srcDir))
     return;
   if (!existsSync17(dstDir))
     mkdirSync11(dstDir, { recursive: true });
   for (const f of ["Blitz Strike.md", "Blitz.md", "Eagle Eye.md", "Strike.md"]) {
-    const src = join28(srcDir, f);
-    const dst = join28(dstDir, f);
+    const src = join29(srcDir, f);
+    const dst = join29(dstDir, f);
     if (existsSync17(src)) {
-      writeFileSync10(dst, readFileSync30(src, "utf8"));
+      writeFileSync10(dst, readFileSync31(src, "utf8"));
     }
   }
 }
@@ -17741,7 +17741,7 @@ function codexWrite(p) {
     const dir = dirname6(p);
     if (!existsSync17(dir))
       mkdirSync11(dir, { recursive: true });
-    let existing = existsSync17(p) ? readFileSync30(p, "utf8") : "";
+    let existing = existsSync17(p) ? readFileSync31(p, "utf8") : "";
     if (!existing.trimEnd().endsWith(`
 `))
       existing += `
@@ -17760,7 +17760,7 @@ function hermesWrite(p) {
     const dir = dirname6(p);
     if (!existsSync17(dir))
       mkdirSync11(dir, { recursive: true });
-    let existing = existsSync17(p) ? readFileSync30(p, "utf8") : "";
+    let existing = existsSync17(p) ? readFileSync31(p, "utf8") : "";
     existing = existing.replace(/^  blitzstrike:\n(?:    .*\n?)*/m, "");
     if (!existing.trimEnd().endsWith(`
 `))
@@ -17787,74 +17787,74 @@ mcp_servers:
 function detectAgents() {
   const home = homedir11();
   const agents = [];
-  const claudeJson = join28(home, ".claude.json");
+  const claudeJson = join29(home, ".claude.json");
   agents.push({
     name: "Claude Code",
     detectPath: claudeJson,
     installed: () => existsSync17(claudeJson) || which("claude"),
     write: jsonMcpServersWrite(claudeJson)
   });
-  const claudeDesktop = join28(home, ".config", "Claude", "claude_desktop_config.json");
+  const claudeDesktop = join29(home, ".config", "Claude", "claude_desktop_config.json");
   agents.push({
     name: "Claude Desktop",
     detectPath: claudeDesktop,
     installed: () => existsSync17(claudeDesktop),
     write: jsonMcpServersWrite(claudeDesktop)
   });
-  const cursor = join28(home, ".cursor", "mcp.json");
+  const cursor = join29(home, ".cursor", "mcp.json");
   agents.push({
     name: "Cursor",
     detectPath: cursor,
-    installed: () => existsSync17(join28(home, ".cursor")) || which("cursor"),
+    installed: () => existsSync17(join29(home, ".cursor")) || which("cursor"),
     write: jsonMcpServersWrite(cursor)
   });
-  const opencode = join28(home, ".config", "opencode", "opencode.jsonc");
+  const opencode = join29(home, ".config", "opencode", "opencode.jsonc");
   agents.push({
     name: "OpenCode",
     detectPath: opencode,
-    installed: () => existsSync17(join28(home, ".config", "opencode")) || which("opencode"),
+    installed: () => existsSync17(join29(home, ".config", "opencode")) || which("opencode"),
     write: opencodeWrite(opencode)
   });
-  const codex = join28(home, ".codex", "config.toml");
+  const codex = join29(home, ".codex", "config.toml");
   agents.push({
     name: "Codex",
     detectPath: codex,
-    installed: () => existsSync17(join28(home, ".codex")) || which("codex"),
+    installed: () => existsSync17(join29(home, ".codex")) || which("codex"),
     write: codexWrite(codex)
   });
-  const hermes = join28(home, ".hermes", "config.yaml");
+  const hermes = join29(home, ".hermes", "config.yaml");
   agents.push({
     name: "Hermes",
     detectPath: hermes,
-    installed: () => existsSync17(join28(home, ".hermes")) || which("hermes"),
+    installed: () => existsSync17(join29(home, ".hermes")) || which("hermes"),
     write: hermesWrite(hermes)
   });
-  const gemini = join28(home, ".gemini", "settings.json");
+  const gemini = join29(home, ".gemini", "settings.json");
   agents.push({
     name: "Gemini CLI",
     detectPath: gemini,
-    installed: () => existsSync17(join28(home, ".gemini")) || which("gemini"),
+    installed: () => existsSync17(join29(home, ".gemini")) || which("gemini"),
     write: jsonMcpServersWrite(gemini)
   });
-  const windsurf = join28(home, ".codeium", "windsurf", "mcp_config.json");
+  const windsurf = join29(home, ".codeium", "windsurf", "mcp_config.json");
   agents.push({
     name: "Windsurf",
     detectPath: windsurf,
-    installed: () => existsSync17(join28(home, ".codeium")) || which("windsurf"),
+    installed: () => existsSync17(join29(home, ".codeium")) || which("windsurf"),
     write: jsonMcpServersWrite(windsurf)
   });
-  const copilot = join28(home, ".copilot", "mcp.json");
+  const copilot = join29(home, ".copilot", "mcp.json");
   agents.push({
     name: "Copilot",
     detectPath: copilot,
-    installed: () => existsSync17(join28(home, ".copilot")),
+    installed: () => existsSync17(join29(home, ".copilot")),
     write: jsonMcpServersWrite(copilot)
   });
-  const cline = join28(home, ".cline", "mcp_settings.json");
+  const cline = join29(home, ".cline", "mcp_settings.json");
   agents.push({
     name: "Cline",
     detectPath: cline,
-    installed: () => existsSync17(join28(home, ".cline")),
+    installed: () => existsSync17(join29(home, ".cline")),
     write: jsonMcpServersWrite(cline)
   });
   return agents;
@@ -17972,7 +17972,7 @@ var init_cli = __esm(() => {
   init_release();
   init_dependency();
   init_mcp_status();
-  ROOT10 = join28(fileURLToPath16(new URL(".", import.meta.url)), "..");
+  ROOT10 = join29(fileURLToPath16(new URL(".", import.meta.url)), "..");
 });
 
 // node_modules/zod/v3/helpers/util.js
@@ -32610,7 +32610,7 @@ class StdioServerTransport {
 
 // src/server.ts
 init_scanner();
-import { readFileSync as readFileSync27 } from "node:fs";
+import { readFileSync as readFileSync28 } from "node:fs";
 
 // src/recon.ts
 var TIMEOUT_MS = 25000;
@@ -34262,7 +34262,7 @@ var SINK_TO_VECTOR = {
   sql_execution: "sql_injection",
   command_execution: "command_injection",
   html_render: "xss",
-  code_execution: "code_execution",
+  code_execution: "command_injection",
   http_request: "ssrf",
   deserialization: "deserialization",
   file_operations: "path_traversal",
@@ -34545,7 +34545,16 @@ var ALIASES = {
   "subdomain takeover": "subdomain_takeover",
   takeover: "subdomain_takeover",
   "dangling dns": "subdomain_takeover",
-  "dangling cname": "subdomain_takeover"
+  "dangling cname": "subdomain_takeover",
+  "nosql injection": "nosql_injection",
+  nosql: "nosql_injection",
+  nosqli: "nosql_injection",
+  "mongo injection": "nosql_injection",
+  "mongodb injection": "nosql_injection",
+  "host header": "host_header",
+  "host header injection": "host_header",
+  "host header poisoning": "host_header",
+  "password reset poisoning": "host_header"
 };
 function normalize(term) {
   return term.trim().toLowerCase().replace(/[_-]+/g, " ").replace(/\s+/g, " ").trim();
@@ -59037,6 +59046,8 @@ var VRT_MAP = {
   sql_injection: { vrt: "injection > sql_injection", priority: "P1", severity: "critical", rationale: "SQL injection reaches sensitive data or enables admin takeover." },
   ssti: { vrt: "injection > server_side_template_injection", priority: "P1", severity: "critical", rationale: "SSTI evaluates expressions server-side → code execution." },
   command_injection: { vrt: "injection > os_command_injection", priority: "P1", severity: "critical", rationale: "User input reaches a shell (system/exec/popen) → arbitrary command execution, full host takeover." },
+  nosql_injection: { vrt: "injection > nosql_injection", priority: "P1", severity: "critical", rationale: "NoSQL operator injection reaches a database query → auth bypass or data exfiltration." },
+  host_header: { vrt: "injection > host_header_injection", priority: "P3", severity: "medium", rationale: "A reflected/trusted Host header can poison password-reset links or enable cache poisoning → account takeover in the right flow." },
   deserialization: { vrt: "injection > insecure_deserialization", priority: "P1", severity: "critical", rationale: "Deserialization escalated via a gadget chain → code execution." },
   xxe: { vrt: "injection > xml_external_entity", priority: "P1", severity: "critical", rationale: "XXE reads local files or reaches internal services." },
   file_upload: { vrt: "insecure_design > unrestricted_file_upload", priority: "P1", severity: "critical", rationale: "A web-reachable uploaded file of an executable type → code execution." },
@@ -61257,7 +61268,7 @@ var POC_TEMPLATES = {
     expected: `The response contains an injected \`X-Injected: ${MK}\` header.`,
     fix: "Strip CR/LF from any value placed into a response header."
   },
-  open_redirect: {
+  oauth_misconfig: {
     severity: "medium",
     marker: "https://attacker.example",
     request: (i) => qs(i, encodeURIComponent("https://attacker.example")),
@@ -61447,18 +61458,123 @@ solc = "0.8.20"
   }
 }
 
+// src/hunting-intel.ts
+import { execSync as execSync4 } from "node:child_process";
+import { resolve4 as resolve42, Resolver } from "node:dns/promises";
+import { readFileSync as readFileSync25 } from "node:fs";
+import { join as join24 } from "node:path";
+var BLOCKING_KEYWORDS = /internet positif|kominfo|\.go\.id\b|pemblokiran|ditutup|dilarang|akses dibatasi|blocked|restricted|illegal|advertencia|coljuegos|regulat|forbidden|this (site|website) has been (blocked|banned)/i;
+async function localResolve(host) {
+  try {
+    return await resolve42(host);
+  } catch {
+    return [];
+  }
+}
+async function publicResolve(host) {
+  const r = new Resolver;
+  r.setServers(["8.8.8.8", "1.1.1.1"]);
+  try {
+    return await r.resolve4(host);
+  } catch {
+    return [];
+  }
+}
+function probeBlockingPage(host, ip, timeoutMs = 8000) {
+  for (const port of ["443", "80"]) {
+    const scheme = port === "443" ? "https" : "http";
+    try {
+      const out = execSync4(`curl -sk -m 6 --resolve ${host}:${port}:${ip} ${scheme}://${host}/ 2>/dev/null`, { encoding: "utf8", timeout: timeoutMs, stdio: ["ignore", "pipe", "ignore"] });
+      const preview = out.replace(/\s+/g, " ").trim().slice(0, 300);
+      if (!preview)
+        continue;
+      return { probed: true, sinkhole: BLOCKING_KEYWORDS.test(preview), preview };
+    } catch {}
+  }
+  return { probed: false, sinkhole: false, preview: "" };
+}
+async function resolveCheck(host) {
+  const clean = host.replace(/^https?:\/\//, "").split("/")[0];
+  const local = await localResolve(clean);
+  const pub = await publicResolve(clean);
+  if (local.length === 0 && pub.length === 0) {
+    return { host: clean, local_ips: [], public_ips: [], sinkhole: false, verdict: "unresolvable", evidence: "no A record from local or public DNS" };
+  }
+  if (local.length === 0) {
+    return { host: clean, local_ips: [], public_ips: pub, sinkhole: false, verdict: "local-unresolvable", evidence: "local resolver returned no A record; public DNS resolves. Use the public IP to reach the real target." };
+  }
+  const firstLocal = local[0];
+  const probe = probeBlockingPage(clean, firstLocal);
+  if (probe.sinkhole) {
+    return {
+      host: clean,
+      local_ips: local,
+      public_ips: pub,
+      sinkhole: true,
+      verdict: "sinkhole",
+      evidence: `local IP ${firstLocal} serves a blocking/sinkhole page ("${probe.preview.slice(0, 120)}"). Audit the PUBLIC IP (${pub[0] ?? "n/a"}) instead — e.g. curl --resolve ${clean}:443:${pub[0]} https://${clean}/`
+    };
+  }
+  if (!probe.probed) {
+    return { host: clean, local_ips: local, public_ips: pub, sinkhole: false, verdict: "inconclusive", evidence: "local IP did not respond on 443/80 — inconclusive; for sensitive niches prefer the public IP anyway." };
+  }
+  const ipDiff = new Set(local).size !== new Set(pub).size || !pub.every((ip) => local.includes(ip));
+  return {
+    host: clean,
+    local_ips: local,
+    public_ips: pub,
+    sinkhole: false,
+    verdict: ipDiff ? "clean-cdn" : "clean",
+    evidence: ipDiff ? "local and public IPs differ but the local page shows no blocking content (normal for CDN/anycast/round-robin)." : "local resolution matches public DNS and shows no blocking content."
+  };
+}
+function loadWatchlist() {
+  const raw = readFileSync25(join24(process.cwd(), "intelligence", "watchlist.json"), "utf8");
+  const data = JSON.parse(raw);
+  return { cwe_frequency: data.cwe_frequency ?? [], cve_watchlist: data.cve_watchlist ?? [] };
+}
+function fmtPayout(min, max) {
+  if (min == null || max == null)
+    return "n/a";
+  const f = (n) => n >= 1000 ? `$${(n / 1000).toFixed(n % 1000 === 0 ? 0 : 1)}K` : `$${n}`;
+  return `${f(min)}–${f(max)}`;
+}
+function watchlist() {
+  const { cwe_frequency, cve_watchlist } = loadWatchlist();
+  const entries = cwe_frequency.map((e) => {
+    const pat = e.pattern ? patternLookup(e.pattern) : null;
+    const payoutMin = e.payout_min ?? pat?.payout_min ?? null;
+    const payoutMax = e.payout_max ?? pat?.payout_max ?? null;
+    return {
+      cwe: e.cwe,
+      name: e.name,
+      rank: e.rank,
+      saturated: e.saturated,
+      pattern: e.pattern ?? null,
+      payout_min: payoutMin,
+      payout_max: payoutMax,
+      typical_payout: fmtPayout(payoutMin, payoutMax),
+      notes: e.notes,
+      grounded: pat != null
+    };
+  }).sort((a, b) => a.rank - b.rank);
+  const unsaturated = entries.filter((e) => !e.saturated);
+  const recommendation = `Prioritize the ${unsaturated.length} non-saturated classes (top: ${unsaturated.slice(0, 3).map((e) => e.cwe).join(", ")}) — high frequency + high payout + not yet saturated. Skip saturated/low-value classes (XSS/CSRF/open-redirect standalone) unless they chain into account takeover.`;
+  return { cwe_frequency: entries, cve_watchlist, recommendation };
+}
+
 // src/enterprise-benchmark.ts
-import { existsSync as existsSync15, readFileSync as readFileSync25, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
-import { join as join24, resolve } from "node:path";
+import { existsSync as existsSync15, readFileSync as readFileSync26, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
+import { join as join25, resolve } from "node:path";
 init_complex_bugs();
 var ROOT6 = resolve(process.cwd(), "bench", "enterprise");
 var ENTERPRISE_FIXTURES = [
-  { id: "php-laravel", dir: join24(ROOT6, "php-laravel"), expected_vulns: 4 },
-  { id: "js-express", dir: join24(ROOT6, "js-express"), expected_vulns: 2 },
-  { id: "py-django", dir: join24(ROOT6, "py-django"), expected_vulns: 2 },
-  { id: "java-spring", dir: join24(ROOT6, "java-spring"), expected_vulns: 2 },
-  { id: "wp-batch-route", dir: join24(ROOT6, "wp-batch-route"), expected_vulns: 3 },
-  { id: "php-complex", dir: join24(ROOT6, "php-complex"), expected_vulns: 4 }
+  { id: "php-laravel", dir: join25(ROOT6, "php-laravel"), expected_vulns: 4 },
+  { id: "js-express", dir: join25(ROOT6, "js-express"), expected_vulns: 2 },
+  { id: "py-django", dir: join25(ROOT6, "py-django"), expected_vulns: 2 },
+  { id: "java-spring", dir: join25(ROOT6, "java-spring"), expected_vulns: 2 },
+  { id: "wp-batch-route", dir: join25(ROOT6, "wp-batch-route"), expected_vulns: 3 },
+  { id: "php-complex", dir: join25(ROOT6, "php-complex"), expected_vulns: 4 }
 ];
 function sourceFiles(root) {
   const out = [];
@@ -61470,7 +61586,7 @@ function sourceFiles(root) {
       return;
     }
     for (const e of entries) {
-      const p = join24(dir, e);
+      const p = join25(dir, e);
       let st;
       try {
         st = statSync3(p);
@@ -61491,7 +61607,7 @@ function detectFixture(dir) {
   for (const f of sourceFiles(dir)) {
     let code;
     try {
-      code = readFileSync25(f, "utf8");
+      code = readFileSync26(f, "utf8");
     } catch {
       continue;
     }
@@ -61704,7 +61820,7 @@ function createServer2() {
 ` + `- A hard block (Cloudflare/WAF/IP-block/captcha) is NOT the end: mark the finding blocked + note the required vantage (residential / authorized / correct-SNI / --resolve direct-to-origin), then CONTINUE to the next lead (origin bypass, non-prod cluster, mobile APK, subdomain).
 ` + `- Keep trying every lead AND every chain step until each is verified/executed or blocked, THEN generate_report. Never deliver a bare surface map, and never stop at 'found X' when X enables more.
 
-` + "TWO PATHS:\\n" + "- Source path on disk -> blitz_scan / taint_file / eagle_eye2 (static).\\n" + "- Live URL -> live_recon / active_scan / strike_verify (web-hunting).\\n\\n" + "DEEPEN A FINDING: attack_plan(target, tech, params) to get the prioritized vector plan (decide what to test next with data); list_chains (escalation), chain_links (compose), technique_lookup(cls), payload_lookup, bypass_lookup (blocked). Ground any detector hit empirically with pattern_lookup(id) — it returns the class's CWE, real-world signature, escalation chains, citable references, per-class bypass techniques, and the high-value assets (crown jewels) that class hits, so a raw hit becomes a class-aware finding. Resolve free-form terminology first with synonym_lookup(term) (IDOR/BOLA/SQLi/prompt-injection → canonical id). For an llm_injection hit, its pattern carries a validation discipline — the RUN-TWICE RULE (reproduce token-for-token across two fresh sessions), NON-GUESSABLE ANCHOR (must leak a real key/URL, not a plausible guess), and OOB PROOF (a verifiable callback log) — apply all three before reporting. BEFORE generating a report, run submission_gate(...) and only ship a finding that passes all 7 questions (reproducible, in-scope, real-impact, no-privileged-assumption, verified-live, evidence-redacted, severity-derived); one false = kill it. Generate the concrete reproduction recipe with auto_poc(type, base_url, endpoint, param) — it emits the exact marker request + negative control + expected differential + Patchstack-style title, so 'reproducible' is executable, not abstract. Calibrate severity with severity_calibrate(type, cvss) to get a P1–P5 tier + VRT-style category. Start each engagement with engagement_scaffold(target, scope) for the folder + scope.md structure, and check data_refresh() to confirm the data layers are consistent. Phase doctrine: read_skill(bs-orchestrate-engagement | bs-web-hunting | bs-source-audit | bs-verify-finding). Campaign plan: read_playbook(target-type). On any failure call retry_guidance(signal) / model_fallback(signal) before giving up. HUNTING DOCTRINE (maximize payout rate): (1) SIBLING RULE — if one endpoint requires auth, check every sibling (/export /delete /share); ~30% of paid IDOR/auth bugs come from siblings — AUTOMATE it with sibling_scan(base_url, endpoint, token_a, token_b), the deterministic live logic-bug prober (sibling enumeration + differential IDOR + auth matrix + mass assignment + rate limit, evidence-first). (2) A→B SIGNAL — a confirmed bug signals a class of developer mistake; hunt B and C (20-min box) before reporting. (3) TWO-ACCOUNT IDOR — always test with attacker account A reading victim account B, and state it in the report. (4) PoC ESCALATION — IDOR shows victim data (not 200), XSS shows cookie exfil (not alert), SSRF shows internal response (not DNS), SQLi shows DB content (not error). (5) FOLLOW THE MONEY — billing/credits/refunds/wallet flows. (6) Kill weak findings with kill_list(type) BEFORE the gate — missing headers, self-XSS, open-redirect-alone, SSRF-DNS-only, GraphQL-introspection-alone are always N/A standalone. (7) CI/CD + SAML/SSO are critical attack surfaces (pull_request_target, expression injection, XML signature wrapping, comment injection). Full doctrine: hunting_doctrine().\n" + "KNOWLEDGE BASE (discover, don't guess): skillLookup(topic) / listSkills for the 40 attack-path + hunting skills (ap-*, hp-*, bs-*); list_attack_vectors / attack_vectors(cat) for the 34-category vector taxonomy; taxonomy(kind) for OWASP/CWE/ASVS/API-top-10; read_playbook(type) for the 17 campaign playbooks; list_manuals / read_tool_manual for 317 tool references; list_tools / run_catalog_tool for the 141-tool catalog. Every tool, skill, and data layer is reachable from these. CROSS-TARGET INTELLIGENCE: strike_resolve auto-records confirmed/false_positive verdicts into the empirical ledger; query it with intelligence(action=hit_rates/top_vectors/recall) so a new target on a known tech inherits historical hit-rates (attack_plan already blends them into success_probability). intelligence(action=recall, tech, target) is the per-engagement pattern recall — it returns which patterns historically CONFIRMED on that tech (prioritize them) versus which only ever produced false positives (avoid them), so a new engagement starts from the empirical playbook of past ones. LIVE PENTEST + TARGETING (black-box, WAF-safe): cache_gap(base_url, endpoint) fuzzes path-normalization + static-extension variants for cache deception/poisoning; blind_oracle(base_url, param, value) detects which SINK a param reaches (sql/ssti/xss) via benign arithmetic (id=1+0, test${7*7}) WITHOUT a malicious payload; param_precedence(base_url, param, A, B) maps duplicate-parameter precedence (first/last-wins) for WAF-bypass. OOB (out-of-band) PROOF for BLIND vulns: oob_start() spins an interactsh listener (unique *.oast.* domain, streams DNS/HTTP interactions — the standard for public targets) or a local HTTP listener for local labs; inject the canary, then oob_poll(id) until the hit arrives; oob_stop(id) to clean up. A blind SSRF/XXE/SQLi/command-injection is CONFIRMED only when the canary actually arrives — never from a guess. SOURCE TARGETING: action_surface(code) maps every wp_ajax_* action to its vuln class + DERIVED priority (what to look for WHERE); security_state(sanitizers, sink) gives a wrong-context sanitization verdict; framework_knowledge(framework) returns auth/nonce primitives for 9 frameworks; variant_scan(root, signature) mass-sweeps an install base for ONE bug family; patch_analyze(old, new) REVERSES a security patch into the 0-day, and its mine_signature feeds variant_scan to sweep unpatched copies. All of these are DETECTION HINTS — verify each live (strike_verify / browser_validate) before it enters the report. NEWEST DETECTORS — understand AND try them: variant_scan also emits priv_esc (privilege escalation — a role/capability/user change fed by request input, traced cross-file via reverse call-graph, e.g. set_role($id, sanitize_key($_POST['um-role'])) or update_user_meta(...,'wp_capabilities', $_POST[...])) and flags uploadAllow=>array('all') unrestricted-upload configs as file_upload (the file-manager/connector shape). TO TRY a priv_esc hit: submit the role field with 'administrator' (or send wp_capabilities meta) and confirm the account actually gains admin. TO TRY an unrestricted-upload hit: POST a .php/.phtml and confirm it lands web-reachable + executes. variant_scan also emits hardcoded_secret (CWE-798) in three tiers: a secret field (api_key/db_password/access_token/aws_*) assigned a literal (HIGH), a known secret FORMAT (JWT eyJ…/AWS AKIA…/GitHub ghp_…/Slack xoxb-…/…) regardless of name (HIGH), or a high-entropy suspect token (MEDIUM — verify before reporting). Verify a frontend/JS secret live via drive_devtools (inspect the JS bundle / network response and confirm the key is actually exposed), and for a backend secret confirm it is reachable/valid. A static hit is a HYPOTHESIS until verified live — never report unverified. For a repo, also scan_git_history(root) — secrets DELETED from HEAD still live in .git history (the removed-later-is-not-fixed trap), and it feeds every recovered pre-deletion blob through the same secret detector. Once you recover a credential, prove it is still ACTIVE with validate_leaked_key(apiBase, endpoints, key|blobUrl) — a READ-ONLY differential test (401-without-key vs 200-with-key = auth bypass PROVEN). Two supply-chain detectors: dependency_confusion (a manifest/build file resolving a package from a public registry — pypi.org/npmjs.org --extra-index-url, or a scoped @company/pkg with no private registry) and ml_supply_chain (torch.load without weights_only=True / joblib.load / np.load(allow_pickle=True) / keras load_model on an untrusted model → pickle RCE). Rust is supported end-to-end: the taint engine (blitz_scan / taint_file) maps Rust sinks (std::process::Command, sqlx/diesel, reqwest/hyper, std::fs, serde/bincode) to the classic classes, plus two Rust-specific detectors — rust_unsafe (transmute / assume_init / from_raw_parts / ptr::* — memory-unsafety surface, CWE-119) and rust_format_string (println!/format! with a variable as the format string — CWE-134). The sqlx query! compile-time macro is treated as safe (suppressed). Two more web-class detectors: jwt_alg_confusion (a JWT verifier that dispatches on the token's alg header and accepts BOTH RS256 and HS256, with the HS256 HMAC secret derived from public/shared key material — CWE-347; the attacker sets alg=HS256 and signs with the public key to forge admin tokens) and cache_deception (a reverse proxy caching static-extension URLs with a cache key that omits the session cookie, over a session-authenticated backend — CWE-525; the victim's cached private response is re-fetched anonymously). TO TRY a jwt_alg_confusion hit: fetch the public key (/.well-known/jwks.json), forge an HS256 token signed with that public key, and confirm admin access. TO TRY a cache_deception hit: request an authenticated path with a static extension appended (.css/.js) and re-fetch it anonymously. Three more detectors: cors_misconfiguration (Access-Control-Allow-Origin reflects the request Origin or is '*' while credentials are true — CWE-942; any site reads the victim's authenticated responses), xss (user input into a DOM sink — innerHTML / dangerouslySetInnerHTML / document.write / .html() / eval — CWE-79), and subdomain_takeover (a dangling CNAME/AliasTarget to a claimable service like *.github.io/*.herokuapp.com/*.amazonaws.com — CWE-404). TO TRY a cors hit: send an evil Origin + confirm the response echoes it with Allow-Credentials:true. TO TRY an xss hit: confirm the sink executes (drive_devtools). TO TRY a takeover hit: verify the CNAME target resolves to an unclaimed/not-found page. WEB3: for Solidity/EVM, call web3_audit(code|path) — a deterministic 13-class smart-contract audit (reentrancy incl. ERC721/ERC1155 callback reentrancy, unchecked return, unchecked arithmetic, tx.origin auth, signature replay, unprotected selfdestruct, delegatecall-to-user-input, missing access control, timestamp dependence, spot-price oracle manipulation incl. slot0/latestRoundData, unbounded loop, abi.encodePacked hash collision, missing address(0) validation) returning ranked findings (class/CWE/severity/line), then foundry_poc(class, contract) to generate an executable Foundry test, and foundry_run(contract_code, poc_code|class_) to actually EXECUTE it — a PASSING PoC test is the proof that the exploit reproduces (deterministic: forge's own test verdict). A web3 hit is a HYPOTHESIS until the Foundry PoC reproduces it.\n" + `PRECISION ANALYSIS — chrome-devtools MCP is MANDATORY, not optional:
+` + "TWO PATHS:\\n" + "- Source path on disk -> blitz_scan / taint_file / eagle_eye2 (static).\\n" + "- Live URL -> live_recon / active_scan / strike_verify (web-hunting).\\n\\n" + "DEEPEN A FINDING: attack_plan(target, tech, params) to get the prioritized vector plan (decide what to test next with data); list_chains (escalation), chain_links (compose), technique_lookup(cls), payload_lookup, bypass_lookup (blocked). Ground any detector hit empirically with pattern_lookup(id) — it returns the class's CWE, real-world signature, escalation chains, citable references, per-class bypass techniques, and the high-value assets (crown jewels) that class hits, so a raw hit becomes a class-aware finding. Resolve free-form terminology first with synonym_lookup(term) (IDOR/BOLA/SQLi/prompt-injection → canonical id). For an llm_injection hit, its pattern carries a validation discipline — the RUN-TWICE RULE (reproduce token-for-token across two fresh sessions), NON-GUESSABLE ANCHOR (must leak a real key/URL, not a plausible guess), and OOB PROOF (a verifiable callback log) — apply all three before reporting. BEFORE generating a report, run submission_gate(...) and only ship a finding that passes all 7 questions (reproducible, in-scope, real-impact, no-privileged-assumption, verified-live, evidence-redacted, severity-derived); one false = kill it. Generate the concrete reproduction recipe with auto_poc(type, base_url, endpoint, param) — it emits the exact marker request + negative control + expected differential + Patchstack-style title, so 'reproducible' is executable, not abstract. Calibrate severity with severity_calibrate(type, cvss) to get a P1–P5 tier + VRT-style category. Start each engagement with engagement_scaffold(target, scope) for the folder + scope.md structure, and check data_refresh() to confirm the data layers are consistent. Phase doctrine: read_skill(bs-orchestrate-engagement | bs-web-hunting | bs-source-audit | bs-verify-finding). Campaign plan: read_playbook(target-type). On any failure call retry_guidance(signal) / model_fallback(signal) before giving up. HUNTING DOCTRINE (maximize payout rate): (1) SIBLING RULE — if one endpoint requires auth, check every sibling (/export /delete /share); ~30% of paid IDOR/auth bugs come from siblings — AUTOMATE it with sibling_scan(base_url, endpoint, token_a, token_b), the deterministic live logic-bug prober (sibling enumeration + differential IDOR + auth matrix + mass assignment + rate limit, evidence-first). (2) A→B SIGNAL — a confirmed bug signals a class of developer mistake; hunt B and C (20-min box) before reporting. (3) TWO-ACCOUNT IDOR — always test with attacker account A reading victim account B, and state it in the report. (4) PoC ESCALATION — IDOR shows victim data (not 200), XSS shows cookie exfil (not alert), SSRF shows internal response (not DNS), SQLi shows DB content (not error). (5) FOLLOW THE MONEY — billing/credits/refunds/wallet flows. (6) Kill weak findings with kill_list(type) BEFORE the gate — missing headers, self-XSS, open-redirect-alone, SSRF-DNS-only, GraphQL-introspection-alone are always N/A standalone. (7) CI/CD + SAML/SSO are critical attack surfaces (pull_request_target, expression injection, XML signature wrapping, comment injection). Full doctrine: hunting_doctrine(). WHAT TO HUNT NEXT: watchlist() returns the ranked CWE frequency + high-value CVEs with payout + a saturated flag (prioritize high-freq/high-payout/not-saturated: missing-authz, SQLi, SSRF, deserialization; skip saturated XSS/CSRF/open-redirect unless they chain into takeover). PRECISION GUARD: resolve_check(host) detects when an ISP/country redirects the domain to a blocking/sinkhole page (gambling/adult/streaming niches) — audit the PUBLIC IP, never the sinkhole.\n" + "KNOWLEDGE BASE (discover, don't guess): skillLookup(topic) / listSkills for the 40 attack-path + hunting skills (ap-*, hp-*, bs-*); list_attack_vectors / attack_vectors(cat) for the 34-category vector taxonomy; taxonomy(kind) for OWASP/CWE/ASVS/API-top-10; read_playbook(type) for the 17 campaign playbooks; list_manuals / read_tool_manual for 317 tool references; list_tools / run_catalog_tool for the 141-tool catalog. Every tool, skill, and data layer is reachable from these. CROSS-TARGET INTELLIGENCE: strike_resolve auto-records confirmed/false_positive verdicts into the empirical ledger; query it with intelligence(action=hit_rates/top_vectors/recall) so a new target on a known tech inherits historical hit-rates (attack_plan already blends them into success_probability). intelligence(action=recall, tech, target) is the per-engagement pattern recall — it returns which patterns historically CONFIRMED on that tech (prioritize them) versus which only ever produced false positives (avoid them), so a new engagement starts from the empirical playbook of past ones. LIVE PENTEST + TARGETING (black-box, WAF-safe): cache_gap(base_url, endpoint) fuzzes path-normalization + static-extension variants for cache deception/poisoning; blind_oracle(base_url, param, value) detects which SINK a param reaches (sql/ssti/xss) via benign arithmetic (id=1+0, test${7*7}) WITHOUT a malicious payload; param_precedence(base_url, param, A, B) maps duplicate-parameter precedence (first/last-wins) for WAF-bypass. OOB (out-of-band) PROOF for BLIND vulns: oob_start() spins an interactsh listener (unique *.oast.* domain, streams DNS/HTTP interactions — the standard for public targets) or a local HTTP listener for local labs; inject the canary, then oob_poll(id) until the hit arrives; oob_stop(id) to clean up. A blind SSRF/XXE/SQLi/command-injection is CONFIRMED only when the canary actually arrives — never from a guess. SOURCE TARGETING: action_surface(code) maps every wp_ajax_* action to its vuln class + DERIVED priority (what to look for WHERE); security_state(sanitizers, sink) gives a wrong-context sanitization verdict; framework_knowledge(framework) returns auth/nonce primitives for 9 frameworks; variant_scan(root, signature) mass-sweeps an install base for ONE bug family; patch_analyze(old, new) REVERSES a security patch into the 0-day, and its mine_signature feeds variant_scan to sweep unpatched copies. All of these are DETECTION HINTS — verify each live (strike_verify / browser_validate) before it enters the report. NEWEST DETECTORS — understand AND try them: variant_scan also emits priv_esc (privilege escalation — a role/capability/user change fed by request input, traced cross-file via reverse call-graph, e.g. set_role($id, sanitize_key($_POST['um-role'])) or update_user_meta(...,'wp_capabilities', $_POST[...])) and flags uploadAllow=>array('all') unrestricted-upload configs as file_upload (the file-manager/connector shape). TO TRY a priv_esc hit: submit the role field with 'administrator' (or send wp_capabilities meta) and confirm the account actually gains admin. TO TRY an unrestricted-upload hit: POST a .php/.phtml and confirm it lands web-reachable + executes. variant_scan also emits hardcoded_secret (CWE-798) in three tiers: a secret field (api_key/db_password/access_token/aws_*) assigned a literal (HIGH), a known secret FORMAT (JWT eyJ…/AWS AKIA…/GitHub ghp_…/Slack xoxb-…/…) regardless of name (HIGH), or a high-entropy suspect token (MEDIUM — verify before reporting). Verify a frontend/JS secret live via drive_devtools (inspect the JS bundle / network response and confirm the key is actually exposed), and for a backend secret confirm it is reachable/valid. A static hit is a HYPOTHESIS until verified live — never report unverified. For a repo, also scan_git_history(root) — secrets DELETED from HEAD still live in .git history (the removed-later-is-not-fixed trap), and it feeds every recovered pre-deletion blob through the same secret detector. Once you recover a credential, prove it is still ACTIVE with validate_leaked_key(apiBase, endpoints, key|blobUrl) — a READ-ONLY differential test (401-without-key vs 200-with-key = auth bypass PROVEN). Two supply-chain detectors: dependency_confusion (a manifest/build file resolving a package from a public registry — pypi.org/npmjs.org --extra-index-url, or a scoped @company/pkg with no private registry) and ml_supply_chain (torch.load without weights_only=True / joblib.load / np.load(allow_pickle=True) / keras load_model on an untrusted model → pickle RCE). Rust is supported end-to-end: the taint engine (blitz_scan / taint_file) maps Rust sinks (std::process::Command, sqlx/diesel, reqwest/hyper, std::fs, serde/bincode) to the classic classes, plus two Rust-specific detectors — rust_unsafe (transmute / assume_init / from_raw_parts / ptr::* — memory-unsafety surface, CWE-119) and rust_format_string (println!/format! with a variable as the format string — CWE-134). The sqlx query! compile-time macro is treated as safe (suppressed). Two more web-class detectors: jwt_alg_confusion (a JWT verifier that dispatches on the token's alg header and accepts BOTH RS256 and HS256, with the HS256 HMAC secret derived from public/shared key material — CWE-347; the attacker sets alg=HS256 and signs with the public key to forge admin tokens) and cache_deception (a reverse proxy caching static-extension URLs with a cache key that omits the session cookie, over a session-authenticated backend — CWE-525; the victim's cached private response is re-fetched anonymously). TO TRY a jwt_alg_confusion hit: fetch the public key (/.well-known/jwks.json), forge an HS256 token signed with that public key, and confirm admin access. TO TRY a cache_deception hit: request an authenticated path with a static extension appended (.css/.js) and re-fetch it anonymously. Three more detectors: cors_misconfiguration (Access-Control-Allow-Origin reflects the request Origin or is '*' while credentials are true — CWE-942; any site reads the victim's authenticated responses), xss (user input into a DOM sink — innerHTML / dangerouslySetInnerHTML / document.write / .html() / eval — CWE-79), and subdomain_takeover (a dangling CNAME/AliasTarget to a claimable service like *.github.io/*.herokuapp.com/*.amazonaws.com — CWE-404). TO TRY a cors hit: send an evil Origin + confirm the response echoes it with Allow-Credentials:true. TO TRY an xss hit: confirm the sink executes (drive_devtools). TO TRY a takeover hit: verify the CNAME target resolves to an unclaimed/not-found page. WEB3: for Solidity/EVM, call web3_audit(code|path) — a deterministic 13-class smart-contract audit (reentrancy incl. ERC721/ERC1155 callback reentrancy, unchecked return, unchecked arithmetic, tx.origin auth, signature replay, unprotected selfdestruct, delegatecall-to-user-input, missing access control, timestamp dependence, spot-price oracle manipulation incl. slot0/latestRoundData, unbounded loop, abi.encodePacked hash collision, missing address(0) validation) returning ranked findings (class/CWE/severity/line), then foundry_poc(class, contract) to generate an executable Foundry test, and foundry_run(contract_code, poc_code|class_) to actually EXECUTE it — a PASSING PoC test is the proof that the exploit reproduces (deterministic: forge's own test verdict). A web3 hit is a HYPOTHESIS until the Foundry PoC reproduces it.\n" + `PRECISION ANALYSIS — chrome-devtools MCP is MANDATORY, not optional:
 ` + `- When a lead needs DOM/JS precision — DOM-XSS sink execution, AJAX endpoint + payload interception, JS runtime errors, redirect chains, SSO/token flow, or anything a static HTML glance cannot prove — call drive_devtools(target). It spawns chrome-devtools-mcp and drives a REAL headless browser (navigate -> list_network_requests -> list_console_messages -> evaluate_script), giving reproducible evidence instead of a guess.
 ` + `- Before calling it, check_mcp() to confirm the browser MCP is available; if not, blitzstrike install-tools or npm i -g chrome-devtools-mcp. Never substitute eyeballing minified JS or a static sink guess when a live browser can PROVE it. This is the precision + consistency layer.
 ` + "EXTERNAL MCP SERVERS (verified, connect them — NOT one-shot CLIs): chrome-devtools-mcp (29 tools: list_network_requests/get_network_request for raw HTTP interception, list_console_messages for JS errors + DOM-XSS, evaluate_script to run JS, take_screenshot) -> stdio chrome-devtools-mcp --headless --chromeArg=--no-sandbox --chromeArg=--disable-gpu (as root/container this is MANDATORY or the browser crashes; add --proxyServer http://127.0.0.1:8080 to route through Burp, --acceptInsecureCerts for bad TLS). burp-suite-mcp (proxy history + active scan + repeater) -> NOT npm: build the JAR (git clone https://github.com/PortSwigger/mcp-server.git && cd mcp-server && ./gradlew embedProxyJar), load it in Burp Extensions, then connect the client to http://127.0.0.1:9876 (SSE) or the stdio proxy java -jar mcp-proxy-all.jar --sse-url http://127.0.0.1:9876."
@@ -62585,7 +62701,7 @@ ${statusLine}` : statusLine },
     let src = code;
     if (!src && path) {
       try {
-        src = readFileSync27(path, "utf8");
+        src = readFileSync28(path, "utf8");
       } catch {
         return { content: [{ type: "text", text: JSON.stringify({ error: "unreadable path" }) }] };
       }
@@ -62666,7 +62782,7 @@ ${statusLine}` : statusLine },
     let src = code;
     if (!src && path) {
       try {
-        src = readFileSync27(path, "utf8");
+        src = readFileSync28(path, "utf8");
       } catch {
         return { content: [{ type: "text", text: JSON.stringify({ error: "unreadable path" }) }] };
       }
@@ -62714,6 +62830,22 @@ ${statusLine}` : statusLine },
   }, async () => {
     return { content: [{ type: "text", text: JSON.stringify(huntingDoctrine()) }] };
   });
+  server.registerTool("resolve_check", {
+    title: "DNS sinkhole / blocking-page detection (precision guard)",
+    description: "Detect when a target domain is redirected by the ISP/country to a blocking/sinkhole page (gambling/adult/streaming niches) instead of the real site. Compares the local resolver against public DNS (8.8.8.8/1.1.1.1) and probes the local IP for blocking-page content (.gov / 'Internet Positif' / 'blocked' keywords). If a sinkhole is detected, audit the PUBLIC IP — never the sinkhole. Content is the signal (a different IP set alone is normal for CDN/anycast). Use before live_recon/active_scan on any sensitive-niche domain.",
+    inputSchema: {
+      host: string2().describe("Domain to check (e.g. indoav.site or https://target.com)")
+    }
+  }, async ({ host }) => {
+    return { content: [{ type: "text", text: JSON.stringify(await resolveCheck(host)) }] };
+  });
+  server.registerTool("watchlist", {
+    title: "Known CWE/CVE frequency + payout watchlist (what to hunt next)",
+    description: "Return the most-reported bug-bounty classes (CWE frequency, ranked) and high-value CVEs, each with payout range + a 'saturated' flag, joined to a Blitz Strike detector pattern for grounding. Use it to decide WHAT to hunt next: prioritize high-frequency, high-payout, NOT-yet-saturated classes (IDOR/missing-authz, SQLi, SSRF, deserialization); skip saturated/low-value classes (XSS/CSRF/open-redirect) unless they chain into account takeover.",
+    inputSchema: {}
+  }, async () => {
+    return { content: [{ type: "text", text: JSON.stringify(watchlist()) }] };
+  });
   server.registerTool("auto_poc", {
     title: "Auto-PoC — generate a copy-paste-ready reproduction recipe",
     description: "Turn a finding into a concrete reproduction recipe (the 'reproducible' gate question made executable). Given a vuln class + target + endpoint + param, emit the exact request (with a MARKER), a NEGATIVE CONTROL, and the expected differential that PROVES the bug — plus a Patchstack-style title, derived severity, and the fix. Covers sql_injection, missing_authz/idor, ssrf, xss, ssti, command_injection, file_upload, mass_assignment, jwt_alg_confusion, crlf, open_redirect, xxe, prototype_pollution, deserialization, hardcoded_secret, cache_deception, cors_misconfiguration, subdomain_takeover. Pass type='list' to enumerate supported classes.",
@@ -63333,7 +63465,7 @@ ${statusLine}` : statusLine },
     description: "Route confusion (separate class from source→sink taint): detect attacker-controlled dispatch (call_user_func/forward/dispatch), dynamic method calls ($obj->$m()), dynamic include (LFI), batch/proxy forwarding without per-route auth re-check, and route matching without path normalization.",
     inputSchema: { path: string2().describe("Source file path (PHP)") }
   }, async ({ path }) => {
-    const code = readFileSync27(path, "utf8");
+    const code = readFileSync28(path, "utf8");
     const findings = detectRouteConfusion(code, path);
     return {
       content: [{
@@ -63347,7 +63479,7 @@ ${statusLine}` : statusLine },
     description: "Complex-bug detection beyond taint: deserialization→POP gadget chain (unserialize + magic method), type juggling (loose ==/!= vs hash/secret), mass assignment (extract/parse_str without a safe flag), prototype pollution (unsafe merge of request data), CRLF/header injection (user input into a header), path confusion (user input into a file path without canonicalization), SSRF (user-controlled URL with no host allowlist), XXE (user XML parsed without disabling entities), SSTI (user input into a template render with no sandbox), wrong-context sanitization (sanitize_text_field() into a SQL query), missing authorization/nonce on WordPress entry points (wp_ajax_* / admin_post_* / register_rest_route without current_user_can, nonce verification, or permission_callback), CORS misconfiguration (reflected/wildcard origin + credentials), XSS (user input into a DOM sink: innerHTML / dangerouslySetInnerHTML / document.write / .html / eval), and subdomain takeover (CNAME/AliasTarget to a claimable service).",
     inputSchema: { path: string2().describe("Source file path") }
   }, async ({ path }) => {
-    const code = readFileSync27(path, "utf8");
+    const code = readFileSync28(path, "utf8");
     const findings = detectComplexBugs(code, path);
     return {
       content: [{
@@ -63433,7 +63565,7 @@ ${statusLine}` : statusLine },
     let lang = language;
     if (path && !code) {
       try {
-        src = readFileSync27(path, "utf8");
+        src = readFileSync28(path, "utf8");
       } catch {
         return { content: [{ type: "text", text: JSON.stringify({ error: `cannot read ${path}` }) }] };
       }
@@ -63682,15 +63814,15 @@ async function serve() {
 
 // src/index.ts
 init_cli();
-import { readFileSync as readFileSync31, existsSync as existsSync18 } from "node:fs";
-import { join as join29 } from "node:path";
+import { readFileSync as readFileSync32, existsSync as existsSync18 } from "node:fs";
+import { join as join30 } from "node:path";
 import { fileURLToPath as fileURLToPath17 } from "node:url";
-var ROOT11 = join29(fileURLToPath17(new URL(".", import.meta.url)), "..");
+var ROOT11 = join30(fileURLToPath17(new URL(".", import.meta.url)), "..");
 function readVersion() {
   try {
-    const p = join29(ROOT11, "package.json");
+    const p = join30(ROOT11, "package.json");
     if (existsSync18(p))
-      return JSON.parse(readFileSync31(p, "utf8")).version ?? "1.0.0";
+      return JSON.parse(readFileSync32(p, "utf8")).version ?? "1.0.0";
   } catch {}
   return "1.0.0";
 }

package/intelligence/patterns.json

@@ -988,6 +988,69 @@
       "payout_min": 1000,
       "payout_max": 15000,
       "typical_payout": "$1K\u2013$15K"
+    },
+    {
+      "id": "nosql_injection",
+      "name": "NoSQL Injection",
+      "cwe": "CWE-943",
+      "real_world": "User input reaches a NoSQL query (MongoDB $where/$gt/$ne, an unsanitized find/aggregate). Attackers inject operators to bypass authentication or dump collections.",
+      "detection_signatures": [
+        "unsanitized input into a NoSQL find/where/aggregate",
+        "operator injection ($ne/$gt/$where) from request input"
+      ],
+      "chain_templates": [
+        "nosql_injection_to_data_theft"
+      ],
+      "references": [
+        "CWE-943",
+        "OWASP A03:2021 Injection"
+      ],
+      "bypass_techniques": [
+        "operator injection ($ne/$gt/$where)",
+        "JSON-body operator injection",
+        "array/object type juggling to slip past input filters",
+        "blind extraction via regex/timing"
+      ],
+      "crown_jewels": [
+        "user/account collections",
+        "password hashes",
+        "admin documents"
+      ],
+      "severity": "critical",
+      "payout_min": 1000,
+      "payout_max": 15000,
+      "typical_payout": "$1K\u2013$15K"
+    },
+    {
+      "id": "host_header",
+      "name": "Host Header Injection",
+      "cwe": "CWE-644",
+      "real_world": "The app trusts the Host header for link generation, password-reset URLs, or routing. An attacker injects a malicious host to poison password-reset links or bypass access controls.",
+      "detection_signatures": [
+        "Host header reflected into a generated URL / Location / Set-Cookie",
+        "Host header used in password-reset link generation"
+      ],
+      "chain_templates": [
+        "http_smuggling_to_auth_bypass"
+      ],
+      "references": [
+        "CWE-644"
+      ],
+      "bypass_techniques": [
+        "Host header override via X-Forwarded-Host",
+        "absolute-URL host injection",
+        "password-reset link poisoning",
+        "web cache poisoning via Host"
+      ],
+      "crown_jewels": [
+        "password-reset tokens",
+        "account takeover via poisoned links",
+        "cache poisoning"
+      ],
+      "severity": "medium",
+      "payout_min": 500,
+      "payout_max": 5000,
+      "typical_payout": "$500\u2013$5K"
     }
   ]
 }

package/intelligence/watchlist.json

@@ -0,0 +1,33 @@
+{
+  "_comment": "Bug-bounty disclosure frequency + payout watchlist. Derived from public disclosure statistics (HackerOne Hacktivity / CWE Top 25) and typical bounty ranges — a 'what to hunt next' signal, not a vulnerability database. Each CWE entry links to a Blitz Strike detector pattern when one exists (grounding via pattern_lookup).",
+  "cwe_frequency": [
+    { "cwe": "CWE-79", "name": "Cross-site Scripting (XSS)", "rank": 1, "saturated": true, "pattern": "xss", "payout_min": 100, "payout_max": 2500, "notes": "Most-reported class; heavily automated and low-paying — hunt only for high-impact variants (stored/account-takeover)." },
+    { "cwe": "CWE-862", "name": "Missing Authorization / IDOR", "rank": 2, "saturated": false, "pattern": "missing_authz", "payout_min": 1000, "payout_max": 10000, "notes": "~30% of paid access-control bugs; sibling rule + two-account test are the highest-ROI moves." },
+    { "cwe": "CWE-284", "name": "Improper Access Control (priv-esc)", "rank": 3, "saturated": false, "pattern": "priv_esc", "payout_min": 1000, "payout_max": 15000, "notes": "Role/privilege escalation; mass assignment + forced membership are under-hunted." },
+    { "cwe": "CWE-89", "name": "SQL Injection", "rank": 4, "saturated": false, "pattern": "sql_injection", "payout_min": 1000, "payout_max": 15000, "notes": "Still high-value where it reaches a real query; WAF bypass + second-order matter." },
+    { "cwe": "CWE-918", "name": "Server-Side Request Forgery (SSRF)", "rank": 5, "saturated": false, "pattern": "ssrf", "payout_min": 1000, "payout_max": 15000, "notes": "P1 when it hits cloud metadata; proof = internal response or OOB callback." },
+    { "cwe": "CWE-78", "name": "OS Command Injection", "rank": 6, "saturated": false, "pattern": "command_injection", "payout_min": 1000, "payout_max": 15000, "notes": "Critical class; less common than XSS/SQLi but very high impact." },
+    { "cwe": "CWE-502", "name": "Insecure Deserialization", "rank": 7, "saturated": false, "pattern": "deserialization", "payout_min": 5000, "payout_max": 30000, "notes": "Highest per-finding payout; needs a gadget chain but very rewarded." },
+    { "cwe": "CWE-94", "name": "Code Injection / eval", "rank": 8, "saturated": false, "pattern": "command_injection", "payout_min": 1000, "payout_max": 15000, "notes": "eval/exec with user input; folds into RCE umbrella." },
+    { "cwe": "CWE-434", "name": "Unrestricted File Upload", "rank": 9, "saturated": false, "pattern": "file_upload", "payout_min": 1000, "payout_max": 10000, "notes": "Upload → RCE chains pay well; confirm the file actually executes." },
+    { "cwe": "CWE-611", "name": "XML External Entity (XXE)", "rank": 10, "saturated": false, "pattern": "xxe", "payout_min": 1000, "payout_max": 10000, "notes": "Less common post-2020 but still found in SOAP/XML upload flows." },
+    { "cwe": "CWE-287", "name": "Authentication Bypass", "rank": 11, "saturated": false, "pattern": "type_juggling", "payout_min": 1000, "payout_max": 15000, "notes": "Loose comparison / JWT confusion / OAuth misconfig — account takeover class." },
+    { "cwe": "CWE-798", "name": "Hardcoded Credentials", "rank": 12, "saturated": false, "pattern": "hardcoded_secret", "payout_min": 500, "payout_max": 10000, "notes": "Committed keys are common in JS bundles + .git history; prove the key is ACTIVE." },
+    { "cwe": "CWE-22", "name": "Path Traversal / LFI", "rank": 13, "saturated": true, "pattern": "path_confusion", "payout_min": 500, "payout_max": 5000, "notes": "Saturated; value only when it chains to RCE (log poisoning, session files)." },
+    { "cwe": "CWE-601", "name": "Open Redirect", "rank": 14, "saturated": true, "pattern": "oauth_misconfig", "payout_min": 100, "payout_max": 1500, "notes": "Standalone is usually N/A; value only chained into OAuth/token theft." },
+    { "cwe": "CWE-352", "name": "Cross-Site Request Forgery (CSRF)", "rank": 15, "saturated": true, "pattern": "missing_nonce", "payout_min": 100, "payout_max": 2000, "notes": "Saturated + low; only for high-impact state changes (password/email/transfer)." },
+    { "cwe": "CWE-200", "name": "Information Exposure", "rank": 16, "saturated": true, "pattern": "hardcoded_secret", "payout_min": 100, "payout_max": 2000, "notes": "Excessive data exposure / verbose errors; usually a chain enabler, not a standalone bounty." },
+    { "cwe": "CWE-400", "name": "Denial of Service / rate-limit", "rank": 17, "saturated": true, "pattern": null, "payout_min": 100, "payout_max": 1000, "notes": "Usually out of scope standalone; relevant only for business-critical flows." }
+  ],
+  "cve_watchlist": [
+    { "cve": "CVE-2021-44228", "name": "Log4Shell", "product": "Apache Log4j 2", "class": "RCE", "payout_hint": "critical" },
+    { "cve": "CVE-2022-22965", "name": "Spring4Shell", "product": "Spring Framework", "class": "RCE", "payout_hint": "critical" },
+    { "cve": "CVE-2021-41773", "name": "Apache path traversal", "product": "Apache httpd 2.4.49", "class": "Path traversal / RCE", "payout_hint": "high" },
+    { "cve": "CVE-2023-22518", "name": "Confluence auth bypass", "product": "Atlassian Confluence", "class": "Auth bypass", "payout_hint": "high" },
+    { "cve": "CVE-2024-27198", "name": "TeamCity auth bypass", "product": "JetBrains TeamCity", "class": "Auth bypass / RCE", "payout_hint": "high" },
+    { "cve": "CVE-2023-34362", "name": "MOVEit SQLi", "product": "Progress MOVEit", "class": "SQL injection", "payout_hint": "critical" },
+    { "cve": "CVE-2022-42475", "name": "Fortinet SSL-VPN", "product": "FortiOS", "class": "RCE", "payout_hint": "critical" },
+    { "cve": "CVE-2023-27997", "name": "Fortinet SSL-VPN pre-auth", "product": "FortiOS", "class": "RCE", "payout_hint": "critical" },
+    { "cve": "CVE-2024-6387", "name": "regreSSHion", "product": "OpenSSH", "class": "RCE (race)", "payout_hint": "critical" }
+  ]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.93",
+  "version": "2.4.95",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {