blitzstrike 2.4.96 → 2.4.98

package/dist/index.js

@@ -17285,12 +17285,12 @@ document.getElementById('out').innerHTML = u;
 });
 
 // src/variants.ts
-import { readFileSync as readFileSync20 } from "node:fs";
-import { join as join20, dirname as dirname5 } from "node:path";
+import { readFileSync as readFileSync21 } from "node:fs";
+import { join as join21, dirname as dirname5 } from "node:path";
 import { fileURLToPath as fileURLToPath11 } from "node:url";
 function loadVariants() {
   try {
-    const doc = JSON.parse(readFileSync20(join20(__dirname5, "..", "intelligence", "variants.json"), "utf8"));
+    const doc = JSON.parse(readFileSync21(join21(__dirname5, "..", "intelligence", "variants.json"), "utf8"));
     return doc.variants ?? [];
   } catch {
     return [];
@@ -32693,8 +32693,8 @@ async function nvdLookup(cveId) {
 
 // src/orchestrator.ts
 init_scanner();
-import { readFileSync as readFileSync10, existsSync as existsSync8, statSync as statSync2 } from "node:fs";
-import { join as join12 } from "node:path";
+import { readFileSync as readFileSync11, existsSync as existsSync8, statSync as statSync2 } from "node:fs";
+import { join as join13 } from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 
 // src/memory.ts
@@ -36067,8 +36067,135 @@ function toSarif(findings, opts = {}) {
 // src/orchestrator.ts
 init_version();
 
+// src/hunting-intel.ts
+import { execFileSync } from "node:child_process";
+import { resolve4, Resolver } from "node:dns/promises";
+import { readFileSync as readFileSync10 } from "node:fs";
+import { join as join12 } from "node:path";
+var BLOCKING_KEYWORDS = /internet positif|kominfo|\.go\.id\b|pemblokiran|ditutup|dilarang|akses dibatasi|blocked|restricted|illegal|advertencia|coljuegos|regulat|forbidden|this (site|website) has been (blocked|banned)/i;
+var HOSTNAME_RE = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$/i;
+function isValidHostname(host) {
+  return host.length <= 253 && HOSTNAME_RE.test(host);
+}
+async function localResolve(host) {
+  try {
+    return await resolve4(host);
+  } catch {
+    return [];
+  }
+}
+async function publicResolve(host) {
+  const r = new Resolver;
+  r.setServers(["8.8.8.8", "1.1.1.1"]);
+  try {
+    return await r.resolve4(host);
+  } catch {
+    return [];
+  }
+}
+function probeBlockingPage(host, ip, timeoutMs = 8000) {
+  for (const port of ["443", "80"]) {
+    const scheme = port === "443" ? "https" : "http";
+    try {
+      const out = execFileSync("curl", ["-sk", "-m", "6", "--resolve", `${host}:${port}:${ip}`, `${scheme}://${host}/`], { encoding: "utf8", timeout: timeoutMs, stdio: ["ignore", "pipe", "ignore"] });
+      const preview = out.replace(/\s+/g, " ").trim().slice(0, 300);
+      if (!preview)
+        continue;
+      return { probed: true, sinkhole: BLOCKING_KEYWORDS.test(preview), preview };
+    } catch {}
+  }
+  return { probed: false, sinkhole: false, preview: "" };
+}
+async function resolveCheck(host) {
+  const clean = host.replace(/^https?:\/\//, "").split("/")[0];
+  if (!isValidHostname(clean)) {
+    return { host: clean, local_ips: [], public_ips: [], sinkhole: false, verdict: "invalid", evidence: "not a valid hostname — rejected before DNS/subprocess" };
+  }
+  const local = await localResolve(clean);
+  const pub = await publicResolve(clean);
+  if (local.length === 0 && pub.length === 0) {
+    return { host: clean, local_ips: [], public_ips: [], sinkhole: false, verdict: "unresolvable", evidence: "no A record from local or public DNS" };
+  }
+  if (local.length === 0) {
+    return { host: clean, local_ips: [], public_ips: pub, sinkhole: false, verdict: "local-unresolvable", evidence: "local resolver returned no A record; public DNS resolves. Use the public IP to reach the real target." };
+  }
+  const firstLocal = local[0];
+  const probe = probeBlockingPage(clean, firstLocal);
+  if (probe.sinkhole) {
+    return {
+      host: clean,
+      local_ips: local,
+      public_ips: pub,
+      sinkhole: true,
+      verdict: "sinkhole",
+      evidence: `local IP ${firstLocal} serves a blocking/sinkhole page ("${probe.preview.slice(0, 120)}"). Audit the PUBLIC IP (${pub[0] ?? "n/a"}) instead — e.g. curl --resolve ${clean}:443:${pub[0]} https://${clean}/`
+    };
+  }
+  if (!probe.probed) {
+    return { host: clean, local_ips: local, public_ips: pub, sinkhole: false, verdict: "inconclusive", evidence: "local IP did not respond on 443/80 — inconclusive; for sensitive niches prefer the public IP anyway." };
+  }
+  const ipDiff = new Set(local).size !== new Set(pub).size || !pub.every((ip) => local.includes(ip));
+  return {
+    host: clean,
+    local_ips: local,
+    public_ips: pub,
+    sinkhole: false,
+    verdict: ipDiff ? "clean-cdn" : "clean",
+    evidence: ipDiff ? "local and public IPs differ but the local page shows no blocking content (normal for CDN/anycast/round-robin)." : "local resolution matches public DNS and shows no blocking content."
+  };
+}
+function loadWatchlist() {
+  const raw = readFileSync10(join12(process.cwd(), "intelligence", "watchlist.json"), "utf8");
+  const data = JSON.parse(raw);
+  return { cwe_frequency: data.cwe_frequency ?? [], cve_watchlist: data.cve_watchlist ?? [] };
+}
+function fmtPayout(min, max) {
+  if (min == null || max == null)
+    return "n/a";
+  const f = (n) => n >= 1000 ? `$${(n / 1000).toFixed(n % 1000 === 0 ? 0 : 1)}K` : `$${n}`;
+  return `${f(min)}–${f(max)}`;
+}
+function watchlist() {
+  const { cwe_frequency, cve_watchlist } = loadWatchlist();
+  const entries = cwe_frequency.map((e) => {
+    const pat = e.pattern ? patternLookup(e.pattern) : null;
+    const payoutMin = e.payout_min ?? pat?.payout_min ?? null;
+    const payoutMax = e.payout_max ?? pat?.payout_max ?? null;
+    return {
+      cwe: e.cwe,
+      name: e.name,
+      rank: e.rank,
+      saturated: e.saturated,
+      pattern: e.pattern ?? null,
+      payout_min: payoutMin,
+      payout_max: payoutMax,
+      typical_payout: fmtPayout(payoutMin, payoutMax),
+      notes: e.notes,
+      grounded: pat != null
+    };
+  }).sort((a, b) => a.rank - b.rank);
+  const unsaturated = entries.filter((e) => !e.saturated);
+  const topCve = cve_watchlist.filter((c) => (c.epss ?? 0) >= 0.8 || (c.reports ?? 0) >= 100).slice(0, 4).map((c) => c.cve).join(", ");
+  const recommendation = `Prioritize the ${unsaturated.length} non-saturated classes (top: ${unsaturated.slice(0, 3).map((e) => e.cwe).join(", ")}) — high frequency + high payout + not yet saturated. Skip saturated/low-value classes (XSS/CSRF/open-redirect standalone) unless they chain into account takeover. FINGERPRINT FIRST: if the target stack matches a watchlist product (Next.js, Kibana, Langflow, Confluence/Jira, PAN-OS, Grafana), test that specific CVE — top EPSS/report CVEs: ${topCve}.`;
+  return { cwe_frequency: entries, cve_watchlist, recommendation };
+}
+function watchlistCveMatches(techs, headers = {}, body = "") {
+  const { cve_watchlist } = loadWatchlist();
+  const haystack = `${techs.join(" ")} ${Object.keys(headers).join(" ")} ${Object.values(headers).join(" ")} ${body}`.toLowerCase();
+  return cve_watchlist.filter((c) => {
+    const m = c.match;
+    if (!m)
+      return false;
+    try {
+      return new RegExp(m, "i").test(haystack);
+    } catch {
+      return false;
+    }
+  });
+}
+
 // src/live-recon.ts
-import { resolve4 } from "node:dns/promises";
+import { resolve4 as resolve42 } from "node:dns/promises";
 import { connect } from "node:net";
 var HTTP_TIMEOUT_MS = 20000;
 function isLikelyCdn(ip) {
@@ -36284,7 +36411,7 @@ async function dnsBrute(domain) {
   const hosts = COMMON_SUBDOMAINS.map((p) => `${p}.${base}`).filter((h) => !seen.has(h));
   const settled = await Promise.allSettled(hosts.map(async (host) => {
     try {
-      const ips = await resolve4(host);
+      const ips = await resolve42(host);
       return ips.length > 0 ? { host, ips } : null;
     } catch {
       return null;
@@ -36501,6 +36628,7 @@ async function liveRecon(target, includeActive = false) {
   const waf = detectWaf(root.headers, root.body);
   const techs = detectTech(root.headers, root.body);
   const versions = extractVersion(root.headers, root.body);
+  const suggestedCves = watchlistCveMatches(techs, root.headers, root.body);
   const { links, scripts } = crawlLinks(base, root.body);
   const { robots, sitemap } = await fetchRobotsAndSitemap(base);
   const allUrls = [...links, ...scripts, ...robots, ...sitemap];
@@ -36534,6 +36662,9 @@ async function liveRecon(target, includeActive = false) {
   for (const v of versions) {
     nextSteps.push(`Version ${v.product}/${v.version} detected — check cve_correlation + nvd_lookup for known CVEs affecting ${v.product} ${v.version}.`);
   }
+  if (suggestedCves.length > 0) {
+    nextSteps.push(`FINGERPRINT MATCH: the stack matches a high-value watchlist product — test these specific CVEs first instead of generic scanning: ${suggestedCves.map((c) => `${c.cve} (${c.name}, EPSS ${((c.epss ?? 0) * 100).toFixed(0)}%)`).join("; ")}.`);
+  }
   if (crawl.endpoints.length > 0)
     nextSteps.push(`Found ${crawl.endpoints.length} endpoints — feed them to taint_file/blitz_scan for source analysis, or strike_verify for live validation.`);
   if (params.length > 0)
@@ -36560,6 +36691,7 @@ async function liveRecon(target, includeActive = false) {
     waf,
     tech: { detected: techs, server: fingerprint.server },
     versions,
+    suggested_cves: suggestedCves.map((c) => ({ cve: c.cve, name: c.name, product: c.product, epss: c.epss, reports: c.reports })),
     crawl,
     params,
     subdomains,
@@ -36636,9 +36768,9 @@ function loadChains() {
   if (_chainsCache)
     return _chainsCache;
   try {
-    const dir = join12(fileURLToPath6(new URL(".", import.meta.url)), "..");
-    const path = join12(dir, "chains.json");
-    const raw = JSON.parse(readFileSync10(path, "utf8"));
+    const dir = join13(fileURLToPath6(new URL(".", import.meta.url)), "..");
+    const path = join13(dir, "chains.json");
+    const raw = JSON.parse(readFileSync11(path, "utf8"));
     _chainsCache = raw.chains ?? [];
     return _chainsCache;
   } catch {
@@ -37419,8 +37551,8 @@ var CHAIN_ID_TO_ESCALATION = {
 };
 function loadChainLinks() {
   try {
-    const dir = join12(fileURLToPath6(new URL(".", import.meta.url)), "..");
-    const data = JSON.parse(readFileSync10(join12(dir, "intelligence", "chain_links.json"), "utf8"));
+    const dir = join13(fileURLToPath6(new URL(".", import.meta.url)), "..");
+    const data = JSON.parse(readFileSync11(join13(dir, "intelligence", "chain_links.json"), "utf8"));
     return data.links ?? [];
   } catch {
     return [];
@@ -37491,7 +37623,7 @@ async function runAutonomous(target, scope = "", mode = "bug-bounty", maxPasses
 }
 
 // src/ops.ts
-import { execSync, execFileSync } from "node:child_process";
+import { execSync, execFileSync as execFileSync2 } from "node:child_process";
 function decomposeBatches(tasks) {
   const remaining = [...tasks];
   const done = new Set;
@@ -37536,13 +37668,13 @@ function worktree(action, path, branch) {
       if (!path)
         return { action, ok: false, error: "path is required for worktree add" };
       const b = branch ?? `blitz-${Date.now().toString(36)}`;
-      const out = execFileSync("git", ["worktree", "add", "-b", b, path], { encoding: "utf8" }).trim();
+      const out = execFileSync2("git", ["worktree", "add", "-b", b, path], { encoding: "utf8" }).trim();
       return { action, ok: true, branch: b, path, out };
     }
     if (action === "remove") {
       if (!path)
         return { action, ok: false, error: "path is required for worktree remove" };
-      execFileSync("git", ["worktree", "remove", path, "--force"], { encoding: "utf8" });
+      execFileSync2("git", ["worktree", "remove", path, "--force"], { encoding: "utf8" });
       return { action, ok: true, path };
     }
     return { action, ok: false, error: "unknown action (use add | list | remove)" };
@@ -37576,18 +37708,18 @@ function compactState(phase, findings) {
 }
 
 // src/tasks.ts
-import { mkdirSync as mkdirSync6, readFileSync as readFileSync11, writeFileSync as writeFileSync3 } from "node:fs";
-import { join as join13 } from "node:path";
+import { mkdirSync as mkdirSync6, readFileSync as readFileSync12, writeFileSync as writeFileSync3 } from "node:fs";
+import { join as join14 } from "node:path";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
 function tasksDir() {
-  return join13(fileURLToPath7(new URL(".", import.meta.url)), "..", ".blitzstrike", "tasks");
+  return join14(fileURLToPath7(new URL(".", import.meta.url)), "..", ".blitzstrike", "tasks");
 }
 function taskPath(id) {
-  return join13(tasksDir(), `${id}.json`);
+  return join14(tasksDir(), `${id}.json`);
 }
 function load2(id) {
   try {
-    return JSON.parse(readFileSync11(taskPath(id), "utf8"));
+    return JSON.parse(readFileSync12(taskPath(id), "utf8"));
   } catch {
     return null;
   }
@@ -37925,18 +38057,18 @@ function scaffoldEngagement(target, scope = [], out_of_scope = []) {
 }
 
 // src/incremental.ts
-import { execFileSync as execFileSync2 } from "node:child_process";
+import { execFileSync as execFileSync3 } from "node:child_process";
 import { writeFileSync as writeFileSync4, mkdtempSync, rmSync } from "node:fs";
-import { join as join14 } from "node:path";
+import { join as join15 } from "node:path";
 import { tmpdir } from "node:os";
 
 // src/eagle2.ts
 var import_php_parser2 = __toESM(require_src(), 1);
-import { readFileSync as readFileSync14 } from "node:fs";
+import { readFileSync as readFileSync15 } from "node:fs";
 
 // src/dataflow.ts
 init_scanner();
-import { readFileSync as readFileSync12 } from "node:fs";
+import { readFileSync as readFileSync13 } from "node:fs";
 var SOURCES = {
   $_GET: { id: "http_get", label: "HTTP GET parameter", attacker_controlled: true },
   $_POST: { id: "http_post", label: "HTTP POST body", attacker_controlled: true },
@@ -38021,7 +38153,7 @@ function traceDataFlow(path) {
     return result;
   let text;
   try {
-    text = readFileSync12(path, "utf8");
+    text = readFileSync13(path, "utf8");
   } catch {
     return result;
   }
@@ -38102,7 +38234,7 @@ init_scanner();
 
 // src/callgraph.ts
 var import_php_parser = __toESM(require_src(), 1);
-import { readFileSync as readFileSync13 } from "node:fs";
+import { readFileSync as readFileSync14 } from "node:fs";
 var parser = new import_php_parser.Engine({
   parser: { extractDoc: false, php7: true },
   ast: { withPositions: true, withSource: false }
@@ -38163,7 +38295,7 @@ function buildCallGraph(path) {
   const g = { nodes: new Map, edges: [] };
   let code;
   try {
-    code = readFileSync13(path, "utf8");
+    code = readFileSync14(path, "utf8");
   } catch {
     return g;
   }
@@ -38825,7 +38957,7 @@ function resolveFuncId(name, summaries) {
 function analyzeDataFlow2(path) {
   let cacheCode = "";
   try {
-    cacheCode = readFileSync14(path, "utf8");
+    cacheCode = readFileSync15(path, "utf8");
   } catch {}
   if (cacheCode) {
     const cached = getCache("eagle2", cacheCode);
@@ -38847,7 +38979,7 @@ function analyzeDataFlow2(path) {
   };
   let code;
   try {
-    code = cacheCode || readFileSync14(path, "utf8");
+    code = cacheCode || readFileSync15(path, "utf8");
   } catch {
     return result;
   }
@@ -57518,7 +57650,7 @@ registerLanguage(rustAdapter);
 var SOURCE_EXTS = [".php", ".phtml", ".js", ".mjs", ".ts", ".tsx", ".py", ".pyw", ".java"];
 function git(repo, args) {
   try {
-    return execFileSync2("git", args.split(/\s+/).filter(Boolean), { cwd: repo, encoding: "utf8", maxBuffer: 50 * 1024 * 1024 }).trim();
+    return execFileSync3("git", args.split(/\s+/).filter(Boolean), { cwd: repo, encoding: "utf8", maxBuffer: 50 * 1024 * 1024 }).trim();
   } catch {
     return "";
   }
@@ -57533,8 +57665,8 @@ function analyzeChangedFiles(repo, base = "HEAD~1", head = "HEAD") {
       continue;
     const lang = detectLanguage(file)?.language;
     if (lang === "php") {
-      const dir = mkdtempSync(join14(tmpdir(), "blitz-incr-"));
-      const tmp = join14(dir, "changed.php");
+      const dir = mkdtempSync(join15(tmpdir(), "blitz-incr-"));
+      const tmp = join15(dir, "changed.php");
       writeFileSync4(tmp, code);
       try {
         const r = analyzeDataFlow2(tmp);
@@ -57555,7 +57687,7 @@ function analyzeChangedFiles(repo, base = "HEAD~1", head = "HEAD") {
 // src/taint.ts
 init_scanner();
 var import_php_parser4 = __toESM(require_src(), 1);
-import { readFileSync as readFileSync15 } from "node:fs";
+import { readFileSync as readFileSync16 } from "node:fs";
 var parser4 = new import_php_parser4.Engine({
   parser: { extractDoc: false, php7: true },
   ast: { withPositions: true, withSource: false }
@@ -57853,7 +57985,7 @@ function analyzeTaint(path) {
   const result = { file: path, findings: [], suppressed: 0 };
   let code;
   try {
-    code = readFileSync15(path, "utf8");
+    code = readFileSync16(path, "utf8");
   } catch {
     return result;
   }
@@ -57947,15 +58079,15 @@ function taintTree(root, maxFiles = 2000) {
 }
 
 // src/differential.ts
-import { writeFileSync as writeFileSync5, rmSync as rmSync2, mkdtempSync as mkdtempSync2, readFileSync as readFileSync16 } from "node:fs";
-import { join as join15 } from "node:path";
+import { writeFileSync as writeFileSync5, rmSync as rmSync2, mkdtempSync as mkdtempSync2, readFileSync as readFileSync17 } from "node:fs";
+import { join as join16 } from "node:path";
 import { tmpdir as tmpdir2 } from "node:os";
-import { execFileSync as execFileSync3 } from "node:child_process";
+import { execFileSync as execFileSync4 } from "node:child_process";
 init_scanner();
 function runEngine(code, language, file) {
   if (language === "php") {
-    const dir = mkdtempSync2(join15(tmpdir2(), "blitz-diff-"));
-    const tmp = join15(dir, "old.php");
+    const dir = mkdtempSync2(join16(tmpdir2(), "blitz-diff-"));
+    const tmp = join16(dir, "old.php");
     writeFileSync5(tmp, code);
     try {
       const r = analyzeDataFlow2(tmp);
@@ -58109,8 +58241,8 @@ function languageOf(file) {
   return adapter?.language ?? "php";
 }
 function analyzeDifferentialFiles(oldPath, newPath, language) {
-  const oldCode = readFileSync16(oldPath, "utf8");
-  const newCode = readFileSync16(newPath, "utf8");
+  const oldCode = readFileSync17(oldPath, "utf8");
+  const newCode = readFileSync17(newPath, "utf8");
   const lang = language ?? languageOf(newPath);
   return analyzeDifferential(oldCode, newCode, lang, newPath);
 }
@@ -58118,7 +58250,7 @@ var SOURCE_EXTS2 = [".php", ".phtml", ".php5", ".js", ".mjs", ".ts", ".tsx", ".p
 function analyzeGitDiff(repo, base = "HEAD~1", head = "HEAD") {
   const git = (args) => {
     try {
-      return execFileSync3("git", args.split(/\s+/).filter(Boolean), { cwd: repo, encoding: "utf8", maxBuffer: 50 * 1024 * 1024 }).trim();
+      return execFileSync4("git", args.split(/\s+/).filter(Boolean), { cwd: repo, encoding: "utf8", maxBuffer: 50 * 1024 * 1024 }).trim();
     } catch {
       return "";
     }
@@ -58237,27 +58369,27 @@ function analyzePatch(oldCode, newCode, language = "php") {
   };
 }
 function analyzePatchFiles(oldPath, newPath, language) {
-  const oldCode = readFileSync16(oldPath, "utf8");
-  const newCode = readFileSync16(newPath, "utf8");
+  const oldCode = readFileSync17(oldPath, "utf8");
+  const newCode = readFileSync17(newPath, "utf8");
   const lang = language ?? languageOf(newPath);
   return analyzePatch(oldCode, newCode, lang);
 }
 
 // src/frameworks.ts
-import { readFileSync as readFileSync17, existsSync as existsSync9 } from "node:fs";
-import { join as join16 } from "node:path";
+import { readFileSync as readFileSync18, existsSync as existsSync9 } from "node:fs";
+import { join as join17 } from "node:path";
 import { fileURLToPath as fileURLToPath8 } from "node:url";
-var ROOT4 = join16(fileURLToPath8(new URL(".", import.meta.url)), "..");
-var INTEL2 = join16(ROOT4, "intelligence");
+var ROOT4 = join17(fileURLToPath8(new URL(".", import.meta.url)), "..");
+var INTEL2 = join17(ROOT4, "intelligence");
 var cache = null;
 function load3() {
   if (cache)
     return cache;
-  const p = join16(INTEL2, "frameworks.json");
+  const p = join17(INTEL2, "frameworks.json");
   if (!existsSync9(p))
     return null;
   try {
-    cache = JSON.parse(readFileSync17(p, "utf8"));
+    cache = JSON.parse(readFileSync18(p, "utf8"));
     return cache;
   } catch {
     return null;
@@ -58767,9 +58899,9 @@ function nextSteps(ctx) {
 
 // src/git-history.ts
 init_complex_bugs();
-import { execFileSync as execFileSync4 } from "node:child_process";
+import { execFileSync as execFileSync5 } from "node:child_process";
 import { existsSync as existsSync11 } from "node:fs";
-import { join as join17 } from "node:path";
+import { join as join18 } from "node:path";
 function parseDeletions(output) {
   const out = [];
   let commit = "";
@@ -58790,7 +58922,7 @@ function parseDeletions(output) {
   return out;
 }
 function blobBeforeDeletion(root, commit, path) {
-  return execFileSync4("git", ["-C", root, "show", `${commit}^:${path}`], {
+  return execFileSync5("git", ["-C", root, "show", `${commit}^:${path}`], {
     encoding: "utf8",
     maxBuffer: 10 * 1024 * 1024
   });
@@ -58798,12 +58930,12 @@ function blobBeforeDeletion(root, commit, path) {
 function scanGitHistory(root, opts) {
   const limit = opts?.limit ?? 30;
   const findings = [];
-  if (!existsSync11(join17(root, ".git"))) {
+  if (!existsSync11(join18(root, ".git"))) {
     return { root, is_git_repo: false, total: 0, findings: [], error: "not a git repository (no .git dir)" };
   }
   if (opts?.secretPattern) {
     try {
-      const pick = execFileSync4("git", ["-C", root, "log", "-S", opts.secretPattern, "--all", "--format=__COMMIT__ %H %s"], { encoding: "utf8", maxBuffer: 5 * 1024 * 1024 });
+      const pick = execFileSync5("git", ["-C", root, "log", "-S", opts.secretPattern, "--all", "--format=__COMMIT__ %H %s"], { encoding: "utf8", maxBuffer: 5 * 1024 * 1024 });
       const commits = pick.split(`
 `).filter(Boolean).map((l) => {
         const rest = l.startsWith("__COMMIT__ ") ? l.slice("__COMMIT__ ".length) : l;
@@ -58824,7 +58956,7 @@ function scanGitHistory(root, opts) {
     }
   }
   try {
-    const log = execFileSync4("git", ["-C", root, "log", "--all", "--diff-filter=D", "--name-status", "--format=__COMMIT__ %H %s", "--no-renames"], { encoding: "utf8", maxBuffer: 10 * 1024 * 1024 });
+    const log = execFileSync5("git", ["-C", root, "log", "--all", "--diff-filter=D", "--name-status", "--format=__COMMIT__ %H %s", "--no-renames"], { encoding: "utf8", maxBuffer: 10 * 1024 * 1024 });
     const deletions = parseDeletions(log);
     const seen = new Set;
     let checked = 0;
@@ -58945,13 +59077,13 @@ async function validateLeakedKey(input) {
 }
 
 // src/hackbot-arena.ts
-import { readFileSync as readFileSync18 } from "node:fs";
-import { join as join18, dirname as dirname3 } from "node:path";
+import { readFileSync as readFileSync19 } from "node:fs";
+import { join as join19, dirname as dirname3 } from "node:path";
 import { fileURLToPath as fileURLToPath9 } from "node:url";
 var __dirname3 = dirname3(fileURLToPath9(import.meta.url));
 function load4() {
   try {
-    return JSON.parse(readFileSync18(join18(__dirname3, "..", "intelligence", "hackbot-arena.json"), "utf8"));
+    return JSON.parse(readFileSync19(join19(__dirname3, "..", "intelligence", "hackbot-arena.json"), "utf8"));
   } catch {
     return { total: 0, flag_format: "FLAG{nusasec-<32 hex>}", labs: [] };
   }
@@ -59113,13 +59245,13 @@ function listSeverityMap() {
 }
 
 // src/datarefresh.ts
-import { readFileSync as readFileSync19 } from "node:fs";
-import { join as join19, dirname as dirname4 } from "node:path";
+import { readFileSync as readFileSync20 } from "node:fs";
+import { join as join20, dirname as dirname4 } from "node:path";
 import { fileURLToPath as fileURLToPath10 } from "node:url";
 var __dirname4 = dirname4(fileURLToPath10(import.meta.url));
 function loadJson2(rel) {
   try {
-    return JSON.parse(readFileSync19(join19(__dirname4, "..", rel), "utf8"));
+    return JSON.parse(readFileSync20(join20(__dirname4, "..", rel), "utf8"));
   } catch {
     return null;
   }
@@ -59154,18 +59286,18 @@ init_verify_harness();
 init_variants();
 
 // src/benchmark.ts
-import { readFileSync as readFileSync21, readdirSync as readdirSync5, writeFileSync as writeFileSync6, rmSync as rmSync3, mkdirSync as mkdirSync7 } from "node:fs";
-import { join as join21 } from "node:path";
+import { readFileSync as readFileSync22, readdirSync as readdirSync5, writeFileSync as writeFileSync6, rmSync as rmSync3, mkdirSync as mkdirSync7 } from "node:fs";
+import { join as join22 } from "node:path";
 import { fileURLToPath as fileURLToPath12 } from "node:url";
 import { tmpdir as tmpdir3, homedir as homedir8 } from "node:os";
 init_complex_bugs();
-var ROOT5 = join21(fileURLToPath12(new URL(".", import.meta.url)), "..");
-var CORPUS = join21(ROOT5, "bench", "corpus");
-var CAPTURED_CORPUS_DIR = process.env.BLITZSTRIKE_CORPUS_DIR ?? join21(homedir8(), ".blitzstrike", "corpus");
+var ROOT5 = join22(fileURLToPath12(new URL(".", import.meta.url)), "..");
+var CORPUS = join22(ROOT5, "bench", "corpus");
+var CAPTURED_CORPUS_DIR = process.env.BLITZSTRIKE_CORPUS_DIR ?? join22(homedir8(), ".blitzstrike", "corpus");
 function parseCorpusFile(path) {
   let text;
   try {
-    text = readFileSync21(path, "utf8");
+    text = readFileSync22(path, "utf8");
   } catch {
     return null;
   }
@@ -59221,7 +59353,7 @@ function loadDir(dir) {
     for (const f of readdirSync5(dir)) {
       if (!f.endsWith(".md"))
         continue;
-      const e = parseCorpusFile(join21(dir, f));
+      const e = parseCorpusFile(join22(dir, f));
       if (e)
         entries.push(e);
     }
@@ -59248,7 +59380,7 @@ function captureFalsePositive(input) {
     input.code,
     "```"
   ].filter((l) => l !== null);
-  const path = join21(CAPTURED_CORPUS_DIR, `${id}.md`);
+  const path = join22(CAPTURED_CORPUS_DIR, `${id}.md`);
   writeFileSync6(path, lines.join(`
 `) + `
 `, "utf8");
@@ -59270,7 +59402,7 @@ function detect(entry) {
   }
   const lang = entry.language;
   if (lang === "php") {
-    const tmp = join21(tmpdir3(), `blitzstrike-bench-${entry.id}-${process.pid}.php`);
+    const tmp = join22(tmpdir3(), `blitzstrike-bench-${entry.id}-${process.pid}.php`);
     writeFileSync6(tmp, entry.code);
     const r = analyzeDataFlow2(tmp);
     rmSync3(tmp, { force: true });
@@ -59339,12 +59471,12 @@ function runBenchmark() {
 }
 
 // src/obligations.ts
-import { readFileSync as readFileSync22, appendFileSync as appendFileSync4, mkdirSync as mkdirSync8, existsSync as existsSync12, writeFileSync as writeFileSync7 } from "node:fs";
-import { join as join22 } from "node:path";
+import { readFileSync as readFileSync23, appendFileSync as appendFileSync4, mkdirSync as mkdirSync8, existsSync as existsSync12, writeFileSync as writeFileSync7 } from "node:fs";
+import { join as join23 } from "node:path";
 import { createHash as createHash6 } from "node:crypto";
 import { homedir as homedir9 } from "node:os";
-var HOME_DIR4 = process.env.BLITZSTRIKE_HOME ?? join22(homedir9(), ".blitzstrike");
-var OBLIGATION_PATH = join22(HOME_DIR4, "obligations.jsonl");
+var HOME_DIR4 = process.env.BLITZSTRIKE_HOME ?? join23(homedir9(), ".blitzstrike");
+var OBLIGATION_PATH = join23(HOME_DIR4, "obligations.jsonl");
 function ensureDir3() {
   if (!existsSync12(HOME_DIR4))
     mkdirSync8(HOME_DIR4, { recursive: true });
@@ -59357,7 +59489,7 @@ function loadObligations() {
     return [];
   try {
     const out = [];
-    for (const line of readFileSync22(OBLIGATION_PATH, "utf8").split(`
+    for (const line of readFileSync23(OBLIGATION_PATH, "utf8").split(`
 `)) {
       const t = line.trim();
       if (!t)
@@ -59461,11 +59593,11 @@ init_framework_security();
 // src/variant-scan.ts
 init_scanner();
 init_complex_bugs();
-import { readFileSync as readFileSync24 } from "node:fs";
+import { readFileSync as readFileSync25 } from "node:fs";
 
 // src/cross-file.ts
 init_scanner();
-import { readFileSync as readFileSync23 } from "node:fs";
+import { readFileSync as readFileSync24 } from "node:fs";
 var PUBLIC_HOOK_RE = /(?:wp_ajax_nopriv_\w+|admin_post_nopriv_\w+|init|template_redirect|wp_loaded|parse_request|user_register|um_user_register|register_new_user|authenticate)/;
 var PRIV_SINK_RE = /\b(set_role|add_role|remove_role|set_user_role|wp_set_current_user|wp_set_auth_cookie|wp_insert_user|wp_create_user|wp_update_user)\s*\(/;
 var ROLE_META_RE = /update_user_meta\s*\(\s*[^,]+,\s*['"](wp_capabilities|role|roles|capabilities|wp_user_level)['"]/;
@@ -59517,7 +59649,7 @@ function detectCrossFilePrivesc(root) {
   for (const file of files) {
     let code;
     try {
-      code = stripComments(readFileSync23(file, "utf8"));
+      code = stripComments(readFileSync24(file, "utf8"));
     } catch {
       continue;
     }
@@ -59558,7 +59690,7 @@ function detectCrossFilePrivesc(root) {
   for (const file of files) {
     let code;
     try {
-      code = stripComments(readFileSync23(file, "utf8"));
+      code = stripComments(readFileSync24(file, "utf8"));
     } catch {
       continue;
     }
@@ -59581,7 +59713,7 @@ function detectCrossFilePrivesc(root) {
   for (const file of files) {
     let code;
     try {
-      code = stripComments(readFileSync23(file, "utf8"));
+      code = stripComments(readFileSync24(file, "utf8"));
     } catch {
       continue;
     }
@@ -59696,7 +59828,7 @@ function variantScan(root, opts = {}) {
   for (const file of files) {
     let code;
     try {
-      code = readFileSync24(file, "utf8");
+      code = readFileSync25(file, "utf8");
     } catch {
       continue;
     }
@@ -60943,6 +61075,11 @@ var HUNTING_DOCTRINE = [
     id: "rotation",
     title: "20-Minute Rotation",
     rule: "Every 20 minutes ask 'am I making progress?'. No → rotate to the next endpoint / subdomain / class. Fresh context finds more bugs than brute force."
+  },
+  {
+    id: "dedup_before_report",
+    title: "Search for Duplicates Before Reporting",
+    rule: "The #1 cause of 'Duplicate'/'N/A' rejections is not searching first. Before writing the report, search Hacktivity (and the program's prior public reports) for the same endpoint/tech/vuln class; an already-reported open S3 bucket, CORS misconfig, or XSS param is not worth a second report. Only submit what is genuinely new."
   }
 ];
 function huntingDoctrine() {
@@ -61371,7 +61508,7 @@ function listPocTypes() {
 import { execSync as execSync3 } from "node:child_process";
 import { mkdtempSync as mkdtempSync3, mkdirSync as mkdirSync9, writeFileSync as writeFileSync8, rmSync as rmSync4, existsSync as existsSync14 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
-import { join as join23 } from "node:path";
+import { join as join24 } from "node:path";
 function findForge() {
   try {
     const p = execSync3("which forge 2>/dev/null", { encoding: "utf8", timeout: 3000 }).trim();
@@ -61420,14 +61557,14 @@ async function foundryRun(input) {
     };
   }
   const poc = input.poc_code ?? foundryPoc(input.class_ ?? "missing_access_control", name);
-  const dir = mkdtempSync3(join23(tmpdir4(), "blitzstrike-foundry-"));
+  const dir = mkdtempSync3(join24(tmpdir4(), "blitzstrike-foundry-"));
   try {
     try {
       execSync3(`${forge} init --force --no-git ${dir}`, { stdio: "ignore", timeout: 60000 });
     } catch {
-      mkdirSync9(join23(dir, "src"), { recursive: true });
-      mkdirSync9(join23(dir, "test"), { recursive: true });
-      writeFileSync8(join23(dir, "foundry.toml"), `[profile.default]
+      mkdirSync9(join24(dir, "src"), { recursive: true });
+      mkdirSync9(join24(dir, "test"), { recursive: true });
+      writeFileSync8(join24(dir, "foundry.toml"), `[profile.default]
 src = "src"
 out = "out"
 libs = ["lib"]
@@ -61437,12 +61574,12 @@ solc = "0.8.20"
     for (const f of ["Counter.sol", "Counter.t.sol", "Counter.s.sol"]) {
       for (const sub of ["src", "test", "script"]) {
         try {
-          rmSync4(join23(dir, sub, f), { force: true });
+          rmSync4(join24(dir, sub, f), { force: true });
         } catch {}
       }
     }
-    writeFileSync8(join23(dir, "src", `${name}.sol`), input.contract_code);
-    writeFileSync8(join23(dir, "test", `${name}.t.sol`), poc);
+    writeFileSync8(join24(dir, "src", `${name}.sol`), input.contract_code);
+    writeFileSync8(join24(dir, "test", `${name}.t.sol`), poc);
     const { out } = runForge(forge, dir, input.timeout_ms ?? 60000);
     const tests = parseTestResults(out);
     const anyFail = tests.some((t) => t.status === "fail");
@@ -61459,118 +61596,6 @@ solc = "0.8.20"
   }
 }
 
-// src/hunting-intel.ts
-import { execFileSync as execFileSync5 } from "node:child_process";
-import { resolve4 as resolve42, Resolver } from "node:dns/promises";
-import { readFileSync as readFileSync25 } from "node:fs";
-import { join as join24 } from "node:path";
-var BLOCKING_KEYWORDS = /internet positif|kominfo|\.go\.id\b|pemblokiran|ditutup|dilarang|akses dibatasi|blocked|restricted|illegal|advertencia|coljuegos|regulat|forbidden|this (site|website) has been (blocked|banned)/i;
-var HOSTNAME_RE = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$/i;
-function isValidHostname(host) {
-  return host.length <= 253 && HOSTNAME_RE.test(host);
-}
-async function localResolve(host) {
-  try {
-    return await resolve42(host);
-  } catch {
-    return [];
-  }
-}
-async function publicResolve(host) {
-  const r = new Resolver;
-  r.setServers(["8.8.8.8", "1.1.1.1"]);
-  try {
-    return await r.resolve4(host);
-  } catch {
-    return [];
-  }
-}
-function probeBlockingPage(host, ip, timeoutMs = 8000) {
-  for (const port of ["443", "80"]) {
-    const scheme = port === "443" ? "https" : "http";
-    try {
-      const out = execFileSync5("curl", ["-sk", "-m", "6", "--resolve", `${host}:${port}:${ip}`, `${scheme}://${host}/`], { encoding: "utf8", timeout: timeoutMs, stdio: ["ignore", "pipe", "ignore"] });
-      const preview = out.replace(/\s+/g, " ").trim().slice(0, 300);
-      if (!preview)
-        continue;
-      return { probed: true, sinkhole: BLOCKING_KEYWORDS.test(preview), preview };
-    } catch {}
-  }
-  return { probed: false, sinkhole: false, preview: "" };
-}
-async function resolveCheck(host) {
-  const clean = host.replace(/^https?:\/\//, "").split("/")[0];
-  if (!isValidHostname(clean)) {
-    return { host: clean, local_ips: [], public_ips: [], sinkhole: false, verdict: "invalid", evidence: "not a valid hostname — rejected before DNS/subprocess" };
-  }
-  const local = await localResolve(clean);
-  const pub = await publicResolve(clean);
-  if (local.length === 0 && pub.length === 0) {
-    return { host: clean, local_ips: [], public_ips: [], sinkhole: false, verdict: "unresolvable", evidence: "no A record from local or public DNS" };
-  }
-  if (local.length === 0) {
-    return { host: clean, local_ips: [], public_ips: pub, sinkhole: false, verdict: "local-unresolvable", evidence: "local resolver returned no A record; public DNS resolves. Use the public IP to reach the real target." };
-  }
-  const firstLocal = local[0];
-  const probe = probeBlockingPage(clean, firstLocal);
-  if (probe.sinkhole) {
-    return {
-      host: clean,
-      local_ips: local,
-      public_ips: pub,
-      sinkhole: true,
-      verdict: "sinkhole",
-      evidence: `local IP ${firstLocal} serves a blocking/sinkhole page ("${probe.preview.slice(0, 120)}"). Audit the PUBLIC IP (${pub[0] ?? "n/a"}) instead — e.g. curl --resolve ${clean}:443:${pub[0]} https://${clean}/`
-    };
-  }
-  if (!probe.probed) {
-    return { host: clean, local_ips: local, public_ips: pub, sinkhole: false, verdict: "inconclusive", evidence: "local IP did not respond on 443/80 — inconclusive; for sensitive niches prefer the public IP anyway." };
-  }
-  const ipDiff = new Set(local).size !== new Set(pub).size || !pub.every((ip) => local.includes(ip));
-  return {
-    host: clean,
-    local_ips: local,
-    public_ips: pub,
-    sinkhole: false,
-    verdict: ipDiff ? "clean-cdn" : "clean",
-    evidence: ipDiff ? "local and public IPs differ but the local page shows no blocking content (normal for CDN/anycast/round-robin)." : "local resolution matches public DNS and shows no blocking content."
-  };
-}
-function loadWatchlist() {
-  const raw = readFileSync25(join24(process.cwd(), "intelligence", "watchlist.json"), "utf8");
-  const data = JSON.parse(raw);
-  return { cwe_frequency: data.cwe_frequency ?? [], cve_watchlist: data.cve_watchlist ?? [] };
-}
-function fmtPayout(min, max) {
-  if (min == null || max == null)
-    return "n/a";
-  const f = (n) => n >= 1000 ? `$${(n / 1000).toFixed(n % 1000 === 0 ? 0 : 1)}K` : `$${n}`;
-  return `${f(min)}–${f(max)}`;
-}
-function watchlist() {
-  const { cwe_frequency, cve_watchlist } = loadWatchlist();
-  const entries = cwe_frequency.map((e) => {
-    const pat = e.pattern ? patternLookup(e.pattern) : null;
-    const payoutMin = e.payout_min ?? pat?.payout_min ?? null;
-    const payoutMax = e.payout_max ?? pat?.payout_max ?? null;
-    return {
-      cwe: e.cwe,
-      name: e.name,
-      rank: e.rank,
-      saturated: e.saturated,
-      pattern: e.pattern ?? null,
-      payout_min: payoutMin,
-      payout_max: payoutMax,
-      typical_payout: fmtPayout(payoutMin, payoutMax),
-      notes: e.notes,
-      grounded: pat != null
-    };
-  }).sort((a, b) => a.rank - b.rank);
-  const unsaturated = entries.filter((e) => !e.saturated);
-  const recommendation = `Prioritize the ${unsaturated.length} non-saturated classes (top: ${unsaturated.slice(0, 3).map((e) => e.cwe).join(", ")}) — high frequency + high payout + not yet saturated. Skip saturated/low-value classes (XSS/CSRF/open-redirect standalone) unless they chain into account takeover.`;
-  return { cwe_frequency: entries, cve_watchlist, recommendation };
-}
-
 // src/enterprise-benchmark.ts
 import { existsSync as existsSync15, readFileSync as readFileSync26, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
 import { join as join25, resolve } from "node:path";