blitzstrike 2.4.97 → 2.4.99

package/CHANGELOG.md

@@ -5,9 +5,30 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.99] — 2026-09-17
+
+### Fixed — grounding completeness for the CVE watchlist class tags
+
+- The CVE watchlist's `class` tags (`auth_bypass`, `infoleak`) did not resolve
+  to a detector pattern. Added synonyms (`auth bypass`/`authentication bypass`
+  → `type_juggling`; `infoleak`/`info|information disclosure|exposure|leak` →
+  `hardcoded_secret`). Every one of the 18 CVE class tags now resolves to a
+  grounded pattern (locked by a regression check).
+
+## [2.4.98] — 2026-09-17
+
+### Added — fingerprint-first CVE matching wired into live_recon
+
+- `live_recon()` now cross-references the detected stack (tech + headers +
+  body) against the CVE watchlist and returns `suggested_cves` + a
+  "FINGERPRINT MATCH" next-step: when the target matches a high-value
+  watchlist product (Next.js, Kibana, Langflow, Confluence/Jira, PAN-OS,
+  Grafana, Keycloak, …) it names the specific CVEs to test first (with EPSS)
+  instead of relying on generic scanning.
+
 ## [2.4.97] — 2026-09-17
 
-### Added — bugbounty-lab101 knowledge extraction (watchlist upgrade + dedup doctrine)
+### Added — hunting-intel upgrade (Hacktivity-ranked CVE watchlist + dedup doctrine)
 
 - Upgraded `watchlist()` CVE data from a generic 9-CVE list to the 18
   Hacktivity-ranked CVEs with EPSS, report counts, and per-CVE fingerprint

package/dist/index.js

@@ -17285,12 +17285,12 @@ document.getElementById('out').innerHTML = u;
 });
 
 // src/variants.ts
-import { readFileSync as readFileSync20 } from "node:fs";
-import { join as join20, dirname as dirname5 } from "node:path";
+import { readFileSync as readFileSync21 } from "node:fs";
+import { join as join21, dirname as dirname5 } from "node:path";
 import { fileURLToPath as fileURLToPath11 } from "node:url";
 function loadVariants() {
   try {
-    const doc = JSON.parse(readFileSync20(join20(__dirname5, "..", "intelligence", "variants.json"), "utf8"));
+    const doc = JSON.parse(readFileSync21(join21(__dirname5, "..", "intelligence", "variants.json"), "utf8"));
     return doc.variants ?? [];
   } catch {
     return [];
@@ -32693,8 +32693,8 @@ async function nvdLookup(cveId) {
 
 // src/orchestrator.ts
 init_scanner();
-import { readFileSync as readFileSync10, existsSync as existsSync8, statSync as statSync2 } from "node:fs";
-import { join as join12 } from "node:path";
+import { readFileSync as readFileSync11, existsSync as existsSync8, statSync as statSync2 } from "node:fs";
+import { join as join13 } from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 
 // src/memory.ts
@@ -34489,6 +34489,14 @@ var ALIASES = {
   "hardcoded credential": "hardcoded_secret",
   "hardcoded secret": "hardcoded_secret",
   "credential leak": "hardcoded_secret",
+  "auth bypass": "type_juggling",
+  "authentication bypass": "type_juggling",
+  auth_bypass: "type_juggling",
+  infoleak: "hardcoded_secret",
+  "info leak": "hardcoded_secret",
+  "information leak": "hardcoded_secret",
+  "information disclosure": "hardcoded_secret",
+  "information exposure": "hardcoded_secret",
   "hard coded credentials": "hardcoded_secret",
   "priv esc": "priv_esc",
   privesc: "priv_esc",
@@ -36067,8 +36075,135 @@ function toSarif(findings, opts = {}) {
 // src/orchestrator.ts
 init_version();
 
+// src/hunting-intel.ts
+import { execFileSync } from "node:child_process";
+import { resolve4, Resolver } from "node:dns/promises";
+import { readFileSync as readFileSync10 } from "node:fs";
+import { join as join12 } from "node:path";
+var BLOCKING_KEYWORDS = /internet positif|kominfo|\.go\.id\b|pemblokiran|ditutup|dilarang|akses dibatasi|blocked|restricted|illegal|advertencia|coljuegos|regulat|forbidden|this (site|website) has been (blocked|banned)/i;
+var HOSTNAME_RE = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$/i;
+function isValidHostname(host) {
+  return host.length <= 253 && HOSTNAME_RE.test(host);
+}
+async function localResolve(host) {
+  try {
+    return await resolve4(host);
+  } catch {
+    return [];
+  }
+}
+async function publicResolve(host) {
+  const r = new Resolver;
+  r.setServers(["8.8.8.8", "1.1.1.1"]);
+  try {
+    return await r.resolve4(host);
+  } catch {
+    return [];
+  }
+}
+function probeBlockingPage(host, ip, timeoutMs = 8000) {
+  for (const port of ["443", "80"]) {
+    const scheme = port === "443" ? "https" : "http";
+    try {
+      const out = execFileSync("curl", ["-sk", "-m", "6", "--resolve", `${host}:${port}:${ip}`, `${scheme}://${host}/`], { encoding: "utf8", timeout: timeoutMs, stdio: ["ignore", "pipe", "ignore"] });
+      const preview = out.replace(/\s+/g, " ").trim().slice(0, 300);
+      if (!preview)
+        continue;
+      return { probed: true, sinkhole: BLOCKING_KEYWORDS.test(preview), preview };
+    } catch {}
+  }
+  return { probed: false, sinkhole: false, preview: "" };
+}
+async function resolveCheck(host) {
+  const clean = host.replace(/^https?:\/\//, "").split("/")[0];
+  if (!isValidHostname(clean)) {
+    return { host: clean, local_ips: [], public_ips: [], sinkhole: false, verdict: "invalid", evidence: "not a valid hostname — rejected before DNS/subprocess" };
+  }
+  const local = await localResolve(clean);
+  const pub = await publicResolve(clean);
+  if (local.length === 0 && pub.length === 0) {
+    return { host: clean, local_ips: [], public_ips: [], sinkhole: false, verdict: "unresolvable", evidence: "no A record from local or public DNS" };
+  }
+  if (local.length === 0) {
+    return { host: clean, local_ips: [], public_ips: pub, sinkhole: false, verdict: "local-unresolvable", evidence: "local resolver returned no A record; public DNS resolves. Use the public IP to reach the real target." };
+  }
+  const firstLocal = local[0];
+  const probe = probeBlockingPage(clean, firstLocal);
+  if (probe.sinkhole) {
+    return {
+      host: clean,
+      local_ips: local,
+      public_ips: pub,
+      sinkhole: true,
+      verdict: "sinkhole",
+      evidence: `local IP ${firstLocal} serves a blocking/sinkhole page ("${probe.preview.slice(0, 120)}"). Audit the PUBLIC IP (${pub[0] ?? "n/a"}) instead — e.g. curl --resolve ${clean}:443:${pub[0]} https://${clean}/`
+    };
+  }
+  if (!probe.probed) {
+    return { host: clean, local_ips: local, public_ips: pub, sinkhole: false, verdict: "inconclusive", evidence: "local IP did not respond on 443/80 — inconclusive; for sensitive niches prefer the public IP anyway." };
+  }
+  const ipDiff = new Set(local).size !== new Set(pub).size || !pub.every((ip) => local.includes(ip));
+  return {
+    host: clean,
+    local_ips: local,
+    public_ips: pub,
+    sinkhole: false,
+    verdict: ipDiff ? "clean-cdn" : "clean",
+    evidence: ipDiff ? "local and public IPs differ but the local page shows no blocking content (normal for CDN/anycast/round-robin)." : "local resolution matches public DNS and shows no blocking content."
+  };
+}
+function loadWatchlist() {
+  const raw = readFileSync10(join12(process.cwd(), "intelligence", "watchlist.json"), "utf8");
+  const data = JSON.parse(raw);
+  return { cwe_frequency: data.cwe_frequency ?? [], cve_watchlist: data.cve_watchlist ?? [] };
+}
+function fmtPayout(min, max) {
+  if (min == null || max == null)
+    return "n/a";
+  const f = (n) => n >= 1000 ? `$${(n / 1000).toFixed(n % 1000 === 0 ? 0 : 1)}K` : `$${n}`;
+  return `${f(min)}–${f(max)}`;
+}
+function watchlist() {
+  const { cwe_frequency, cve_watchlist } = loadWatchlist();
+  const entries = cwe_frequency.map((e) => {
+    const pat = e.pattern ? patternLookup(e.pattern) : null;
+    const payoutMin = e.payout_min ?? pat?.payout_min ?? null;
+    const payoutMax = e.payout_max ?? pat?.payout_max ?? null;
+    return {
+      cwe: e.cwe,
+      name: e.name,
+      rank: e.rank,
+      saturated: e.saturated,
+      pattern: e.pattern ?? null,
+      payout_min: payoutMin,
+      payout_max: payoutMax,
+      typical_payout: fmtPayout(payoutMin, payoutMax),
+      notes: e.notes,
+      grounded: pat != null
+    };
+  }).sort((a, b) => a.rank - b.rank);
+  const unsaturated = entries.filter((e) => !e.saturated);
+  const topCve = cve_watchlist.filter((c) => (c.epss ?? 0) >= 0.8 || (c.reports ?? 0) >= 100).slice(0, 4).map((c) => c.cve).join(", ");
+  const recommendation = `Prioritize the ${unsaturated.length} non-saturated classes (top: ${unsaturated.slice(0, 3).map((e) => e.cwe).join(", ")}) — high frequency + high payout + not yet saturated. Skip saturated/low-value classes (XSS/CSRF/open-redirect standalone) unless they chain into account takeover. FINGERPRINT FIRST: if the target stack matches a watchlist product (Next.js, Kibana, Langflow, Confluence/Jira, PAN-OS, Grafana), test that specific CVE — top EPSS/report CVEs: ${topCve}.`;
+  return { cwe_frequency: entries, cve_watchlist, recommendation };
+}
+function watchlistCveMatches(techs, headers = {}, body = "") {
+  const { cve_watchlist } = loadWatchlist();
+  const haystack = `${techs.join(" ")} ${Object.keys(headers).join(" ")} ${Object.values(headers).join(" ")} ${body}`.toLowerCase();
+  return cve_watchlist.filter((c) => {
+    const m = c.match;
+    if (!m)
+      return false;
+    try {
+      return new RegExp(m, "i").test(haystack);
+    } catch {
+      return false;
+    }
+  });
+}
+
 // src/live-recon.ts
-import { resolve4 } from "node:dns/promises";
+import { resolve4 as resolve42 } from "node:dns/promises";
 import { connect } from "node:net";
 var HTTP_TIMEOUT_MS = 20000;
 function isLikelyCdn(ip) {
@@ -36284,7 +36419,7 @@ async function dnsBrute(domain) {
   const hosts = COMMON_SUBDOMAINS.map((p) => `${p}.${base}`).filter((h) => !seen.has(h));
   const settled = await Promise.allSettled(hosts.map(async (host) => {
     try {
-      const ips = await resolve4(host);
+      const ips = await resolve42(host);
       return ips.length > 0 ? { host, ips } : null;
     } catch {
       return null;
@@ -36501,6 +36636,7 @@ async function liveRecon(target, includeActive = false) {
   const waf = detectWaf(root.headers, root.body);
   const techs = detectTech(root.headers, root.body);
   const versions = extractVersion(root.headers, root.body);
+  const suggestedCves = watchlistCveMatches(techs, root.headers, root.body);
   const { links, scripts } = crawlLinks(base, root.body);
   const { robots, sitemap } = await fetchRobotsAndSitemap(base);
   const allUrls = [...links, ...scripts, ...robots, ...sitemap];
@@ -36534,6 +36670,9 @@ async function liveRecon(target, includeActive = false) {
   for (const v of versions) {
     nextSteps.push(`Version ${v.product}/${v.version} detected — check cve_correlation + nvd_lookup for known CVEs affecting ${v.product} ${v.version}.`);
   }
+  if (suggestedCves.length > 0) {
+    nextSteps.push(`FINGERPRINT MATCH: the stack matches a high-value watchlist product — test these specific CVEs first instead of generic scanning: ${suggestedCves.map((c) => `${c.cve} (${c.name}, EPSS ${((c.epss ?? 0) * 100).toFixed(0)}%)`).join("; ")}.`);
+  }
   if (crawl.endpoints.length > 0)
     nextSteps.push(`Found ${crawl.endpoints.length} endpoints — feed them to taint_file/blitz_scan for source analysis, or strike_verify for live validation.`);
   if (params.length > 0)
@@ -36560,6 +36699,7 @@ async function liveRecon(target, includeActive = false) {
     waf,
     tech: { detected: techs, server: fingerprint.server },
     versions,
+    suggested_cves: suggestedCves.map((c) => ({ cve: c.cve, name: c.name, product: c.product, epss: c.epss, reports: c.reports })),
     crawl,
     params,
     subdomains,
@@ -36636,9 +36776,9 @@ function loadChains() {
   if (_chainsCache)
     return _chainsCache;
   try {
-    const dir = join12(fileURLToPath6(new URL(".", import.meta.url)), "..");
-    const path = join12(dir, "chains.json");
-    const raw = JSON.parse(readFileSync10(path, "utf8"));
+    const dir = join13(fileURLToPath6(new URL(".", import.meta.url)), "..");
+    const path = join13(dir, "chains.json");
+    const raw = JSON.parse(readFileSync11(path, "utf8"));
     _chainsCache = raw.chains ?? [];
     return _chainsCache;
   } catch {
@@ -37419,8 +37559,8 @@ var CHAIN_ID_TO_ESCALATION = {
 };
 function loadChainLinks() {
   try {
-    const dir = join12(fileURLToPath6(new URL(".", import.meta.url)), "..");
-    const data = JSON.parse(readFileSync10(join12(dir, "intelligence", "chain_links.json"), "utf8"));
+    const dir = join13(fileURLToPath6(new URL(".", import.meta.url)), "..");
+    const data = JSON.parse(readFileSync11(join13(dir, "intelligence", "chain_links.json"), "utf8"));
     return data.links ?? [];
   } catch {
     return [];
@@ -37491,7 +37631,7 @@ async function runAutonomous(target, scope = "", mode = "bug-bounty", maxPasses
 }
 
 // src/ops.ts
-import { execSync, execFileSync } from "node:child_process";
+import { execSync, execFileSync as execFileSync2 } from "node:child_process";
 function decomposeBatches(tasks) {
   const remaining = [...tasks];
   const done = new Set;
@@ -37536,13 +37676,13 @@ function worktree(action, path, branch) {
       if (!path)
         return { action, ok: false, error: "path is required for worktree add" };
       const b = branch ?? `blitz-${Date.now().toString(36)}`;
-      const out = execFileSync("git", ["worktree", "add", "-b", b, path], { encoding: "utf8" }).trim();
+      const out = execFileSync2("git", ["worktree", "add", "-b", b, path], { encoding: "utf8" }).trim();
       return { action, ok: true, branch: b, path, out };
     }
     if (action === "remove") {
       if (!path)
         return { action, ok: false, error: "path is required for worktree remove" };
-      execFileSync("git", ["worktree", "remove", path, "--force"], { encoding: "utf8" });
+      execFileSync2("git", ["worktree", "remove", path, "--force"], { encoding: "utf8" });
       return { action, ok: true, path };
     }
     return { action, ok: false, error: "unknown action (use add | list | remove)" };
@@ -37576,18 +37716,18 @@ function compactState(phase, findings) {
 }
 
 // src/tasks.ts
-import { mkdirSync as mkdirSync6, readFileSync as readFileSync11, writeFileSync as writeFileSync3 } from "node:fs";
-import { join as join13 } from "node:path";
+import { mkdirSync as mkdirSync6, readFileSync as readFileSync12, writeFileSync as writeFileSync3 } from "node:fs";
+import { join as join14 } from "node:path";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
 function tasksDir() {
-  return join13(fileURLToPath7(new URL(".", import.meta.url)), "..", ".blitzstrike", "tasks");
+  return join14(fileURLToPath7(new URL(".", import.meta.url)), "..", ".blitzstrike", "tasks");
 }
 function taskPath(id) {
-  return join13(tasksDir(), `${id}.json`);
+  return join14(tasksDir(), `${id}.json`);
 }
 function load2(id) {
   try {
-    return JSON.parse(readFileSync11(taskPath(id), "utf8"));
+    return JSON.parse(readFileSync12(taskPath(id), "utf8"));
   } catch {
     return null;
   }
@@ -37925,18 +38065,18 @@ function scaffoldEngagement(target, scope = [], out_of_scope = []) {
 }
 
 // src/incremental.ts
-import { execFileSync as execFileSync2 } from "node:child_process";
+import { execFileSync as execFileSync3 } from "node:child_process";
 import { writeFileSync as writeFileSync4, mkdtempSync, rmSync } from "node:fs";
-import { join as join14 } from "node:path";
+import { join as join15 } from "node:path";
 import { tmpdir } from "node:os";
 
 // src/eagle2.ts
 var import_php_parser2 = __toESM(require_src(), 1);
-import { readFileSync as readFileSync14 } from "node:fs";
+import { readFileSync as readFileSync15 } from "node:fs";
 
 // src/dataflow.ts
 init_scanner();
-import { readFileSync as readFileSync12 } from "node:fs";
+import { readFileSync as readFileSync13 } from "node:fs";
 var SOURCES = {
   $_GET: { id: "http_get", label: "HTTP GET parameter", attacker_controlled: true },
   $_POST: { id: "http_post", label: "HTTP POST body", attacker_controlled: true },
@@ -38021,7 +38161,7 @@ function traceDataFlow(path) {
     return result;
   let text;
   try {
-    text = readFileSync12(path, "utf8");
+    text = readFileSync13(path, "utf8");
   } catch {
     return result;
   }
@@ -38102,7 +38242,7 @@ init_scanner();
 
 // src/callgraph.ts
 var import_php_parser = __toESM(require_src(), 1);
-import { readFileSync as readFileSync13 } from "node:fs";
+import { readFileSync as readFileSync14 } from "node:fs";
 var parser = new import_php_parser.Engine({
   parser: { extractDoc: false, php7: true },
   ast: { withPositions: true, withSource: false }
@@ -38163,7 +38303,7 @@ function buildCallGraph(path) {
   const g = { nodes: new Map, edges: [] };
   let code;
   try {
-    code = readFileSync13(path, "utf8");
+    code = readFileSync14(path, "utf8");
   } catch {
     return g;
   }
@@ -38825,7 +38965,7 @@ function resolveFuncId(name, summaries) {
 function analyzeDataFlow2(path) {
   let cacheCode = "";
   try {
-    cacheCode = readFileSync14(path, "utf8");
+    cacheCode = readFileSync15(path, "utf8");
   } catch {}
   if (cacheCode) {
     const cached = getCache("eagle2", cacheCode);
@@ -38847,7 +38987,7 @@ function analyzeDataFlow2(path) {
   };
   let code;
   try {
-    code = cacheCode || readFileSync14(path, "utf8");
+    code = cacheCode || readFileSync15(path, "utf8");
   } catch {
     return result;
   }
@@ -57518,7 +57658,7 @@ registerLanguage(rustAdapter);
 var SOURCE_EXTS = [".php", ".phtml", ".js", ".mjs", ".ts", ".tsx", ".py", ".pyw", ".java"];
 function git(repo, args) {
   try {
-    return execFileSync2("git", args.split(/\s+/).filter(Boolean), { cwd: repo, encoding: "utf8", maxBuffer: 50 * 1024 * 1024 }).trim();
+    return execFileSync3("git", args.split(/\s+/).filter(Boolean), { cwd: repo, encoding: "utf8", maxBuffer: 50 * 1024 * 1024 }).trim();
   } catch {
     return "";
   }
@@ -57533,8 +57673,8 @@ function analyzeChangedFiles(repo, base = "HEAD~1", head = "HEAD") {
       continue;
     const lang = detectLanguage(file)?.language;
     if (lang === "php") {
-      const dir = mkdtempSync(join14(tmpdir(), "blitz-incr-"));
-      const tmp = join14(dir, "changed.php");
+      const dir = mkdtempSync(join15(tmpdir(), "blitz-incr-"));
+      const tmp = join15(dir, "changed.php");
       writeFileSync4(tmp, code);
       try {
         const r = analyzeDataFlow2(tmp);
@@ -57555,7 +57695,7 @@ function analyzeChangedFiles(repo, base = "HEAD~1", head = "HEAD") {
 // src/taint.ts
 init_scanner();
 var import_php_parser4 = __toESM(require_src(), 1);
-import { readFileSync as readFileSync15 } from "node:fs";
+import { readFileSync as readFileSync16 } from "node:fs";
 var parser4 = new import_php_parser4.Engine({
   parser: { extractDoc: false, php7: true },
   ast: { withPositions: true, withSource: false }
@@ -57853,7 +57993,7 @@ function analyzeTaint(path) {
   const result = { file: path, findings: [], suppressed: 0 };
   let code;
   try {
-    code = readFileSync15(path, "utf8");
+    code = readFileSync16(path, "utf8");
   } catch {
     return result;
   }
@@ -57947,15 +58087,15 @@ function taintTree(root, maxFiles = 2000) {
 }
 
 // src/differential.ts
-import { writeFileSync as writeFileSync5, rmSync as rmSync2, mkdtempSync as mkdtempSync2, readFileSync as readFileSync16 } from "node:fs";
-import { join as join15 } from "node:path";
+import { writeFileSync as writeFileSync5, rmSync as rmSync2, mkdtempSync as mkdtempSync2, readFileSync as readFileSync17 } from "node:fs";
+import { join as join16 } from "node:path";
 import { tmpdir as tmpdir2 } from "node:os";
-import { execFileSync as execFileSync3 } from "node:child_process";
+import { execFileSync as execFileSync4 } from "node:child_process";
 init_scanner();
 function runEngine(code, language, file) {
   if (language === "php") {
-    const dir = mkdtempSync2(join15(tmpdir2(), "blitz-diff-"));
-    const tmp = join15(dir, "old.php");
+    const dir = mkdtempSync2(join16(tmpdir2(), "blitz-diff-"));
+    const tmp = join16(dir, "old.php");
     writeFileSync5(tmp, code);
     try {
       const r = analyzeDataFlow2(tmp);
@@ -58109,8 +58249,8 @@ function languageOf(file) {
   return adapter?.language ?? "php";
 }
 function analyzeDifferentialFiles(oldPath, newPath, language) {
-  const oldCode = readFileSync16(oldPath, "utf8");
-  const newCode = readFileSync16(newPath, "utf8");
+  const oldCode = readFileSync17(oldPath, "utf8");
+  const newCode = readFileSync17(newPath, "utf8");
   const lang = language ?? languageOf(newPath);
   return analyzeDifferential(oldCode, newCode, lang, newPath);
 }
@@ -58118,7 +58258,7 @@ var SOURCE_EXTS2 = [".php", ".phtml", ".php5", ".js", ".mjs", ".ts", ".tsx", ".p
 function analyzeGitDiff(repo, base = "HEAD~1", head = "HEAD") {
   const git = (args) => {
     try {
-      return execFileSync3("git", args.split(/\s+/).filter(Boolean), { cwd: repo, encoding: "utf8", maxBuffer: 50 * 1024 * 1024 }).trim();
+      return execFileSync4("git", args.split(/\s+/).filter(Boolean), { cwd: repo, encoding: "utf8", maxBuffer: 50 * 1024 * 1024 }).trim();
     } catch {
       return "";
     }
@@ -58237,27 +58377,27 @@ function analyzePatch(oldCode, newCode, language = "php") {
   };
 }
 function analyzePatchFiles(oldPath, newPath, language) {
-  const oldCode = readFileSync16(oldPath, "utf8");
-  const newCode = readFileSync16(newPath, "utf8");
+  const oldCode = readFileSync17(oldPath, "utf8");
+  const newCode = readFileSync17(newPath, "utf8");
   const lang = language ?? languageOf(newPath);
   return analyzePatch(oldCode, newCode, lang);
 }
 
 // src/frameworks.ts
-import { readFileSync as readFileSync17, existsSync as existsSync9 } from "node:fs";
-import { join as join16 } from "node:path";
+import { readFileSync as readFileSync18, existsSync as existsSync9 } from "node:fs";
+import { join as join17 } from "node:path";
 import { fileURLToPath as fileURLToPath8 } from "node:url";
-var ROOT4 = join16(fileURLToPath8(new URL(".", import.meta.url)), "..");
-var INTEL2 = join16(ROOT4, "intelligence");
+var ROOT4 = join17(fileURLToPath8(new URL(".", import.meta.url)), "..");
+var INTEL2 = join17(ROOT4, "intelligence");
 var cache = null;
 function load3() {
   if (cache)
     return cache;
-  const p = join16(INTEL2, "frameworks.json");
+  const p = join17(INTEL2, "frameworks.json");
   if (!existsSync9(p))
     return null;
   try {
-    cache = JSON.parse(readFileSync17(p, "utf8"));
+    cache = JSON.parse(readFileSync18(p, "utf8"));
     return cache;
   } catch {
     return null;
@@ -58767,9 +58907,9 @@ function nextSteps(ctx) {
 
 // src/git-history.ts
 init_complex_bugs();
-import { execFileSync as execFileSync4 } from "node:child_process";
+import { execFileSync as execFileSync5 } from "node:child_process";
 import { existsSync as existsSync11 } from "node:fs";
-import { join as join17 } from "node:path";
+import { join as join18 } from "node:path";
 function parseDeletions(output) {
   const out = [];
   let commit = "";
@@ -58790,7 +58930,7 @@ function parseDeletions(output) {
   return out;
 }
 function blobBeforeDeletion(root, commit, path) {
-  return execFileSync4("git", ["-C", root, "show", `${commit}^:${path}`], {
+  return execFileSync5("git", ["-C", root, "show", `${commit}^:${path}`], {
     encoding: "utf8",
     maxBuffer: 10 * 1024 * 1024
   });
@@ -58798,12 +58938,12 @@ function blobBeforeDeletion(root, commit, path) {
 function scanGitHistory(root, opts) {
   const limit = opts?.limit ?? 30;
   const findings = [];
-  if (!existsSync11(join17(root, ".git"))) {
+  if (!existsSync11(join18(root, ".git"))) {
     return { root, is_git_repo: false, total: 0, findings: [], error: "not a git repository (no .git dir)" };
   }
   if (opts?.secretPattern) {
     try {
-      const pick = execFileSync4("git", ["-C", root, "log", "-S", opts.secretPattern, "--all", "--format=__COMMIT__ %H %s"], { encoding: "utf8", maxBuffer: 5 * 1024 * 1024 });
+      const pick = execFileSync5("git", ["-C", root, "log", "-S", opts.secretPattern, "--all", "--format=__COMMIT__ %H %s"], { encoding: "utf8", maxBuffer: 5 * 1024 * 1024 });
       const commits = pick.split(`
 `).filter(Boolean).map((l) => {
         const rest = l.startsWith("__COMMIT__ ") ? l.slice("__COMMIT__ ".length) : l;
@@ -58824,7 +58964,7 @@ function scanGitHistory(root, opts) {
     }
   }
   try {
-    const log = execFileSync4("git", ["-C", root, "log", "--all", "--diff-filter=D", "--name-status", "--format=__COMMIT__ %H %s", "--no-renames"], { encoding: "utf8", maxBuffer: 10 * 1024 * 1024 });
+    const log = execFileSync5("git", ["-C", root, "log", "--all", "--diff-filter=D", "--name-status", "--format=__COMMIT__ %H %s", "--no-renames"], { encoding: "utf8", maxBuffer: 10 * 1024 * 1024 });
     const deletions = parseDeletions(log);
     const seen = new Set;
     let checked = 0;
@@ -58945,13 +59085,13 @@ async function validateLeakedKey(input) {
 }
 
 // src/hackbot-arena.ts
-import { readFileSync as readFileSync18 } from "node:fs";
-import { join as join18, dirname as dirname3 } from "node:path";
+import { readFileSync as readFileSync19 } from "node:fs";
+import { join as join19, dirname as dirname3 } from "node:path";
 import { fileURLToPath as fileURLToPath9 } from "node:url";
 var __dirname3 = dirname3(fileURLToPath9(import.meta.url));
 function load4() {
   try {
-    return JSON.parse(readFileSync18(join18(__dirname3, "..", "intelligence", "hackbot-arena.json"), "utf8"));
+    return JSON.parse(readFileSync19(join19(__dirname3, "..", "intelligence", "hackbot-arena.json"), "utf8"));
   } catch {
     return { total: 0, flag_format: "FLAG{nusasec-<32 hex>}", labs: [] };
   }
@@ -59113,13 +59253,13 @@ function listSeverityMap() {
 }
 
 // src/datarefresh.ts
-import { readFileSync as readFileSync19 } from "node:fs";
-import { join as join19, dirname as dirname4 } from "node:path";
+import { readFileSync as readFileSync20 } from "node:fs";
+import { join as join20, dirname as dirname4 } from "node:path";
 import { fileURLToPath as fileURLToPath10 } from "node:url";
 var __dirname4 = dirname4(fileURLToPath10(import.meta.url));
 function loadJson2(rel) {
   try {
-    return JSON.parse(readFileSync19(join19(__dirname4, "..", rel), "utf8"));
+    return JSON.parse(readFileSync20(join20(__dirname4, "..", rel), "utf8"));
   } catch {
     return null;
   }
@@ -59154,18 +59294,18 @@ init_verify_harness();
 init_variants();
 
 // src/benchmark.ts
-import { readFileSync as readFileSync21, readdirSync as readdirSync5, writeFileSync as writeFileSync6, rmSync as rmSync3, mkdirSync as mkdirSync7 } from "node:fs";
-import { join as join21 } from "node:path";
+import { readFileSync as readFileSync22, readdirSync as readdirSync5, writeFileSync as writeFileSync6, rmSync as rmSync3, mkdirSync as mkdirSync7 } from "node:fs";
+import { join as join22 } from "node:path";
 import { fileURLToPath as fileURLToPath12 } from "node:url";
 import { tmpdir as tmpdir3, homedir as homedir8 } from "node:os";
 init_complex_bugs();
-var ROOT5 = join21(fileURLToPath12(new URL(".", import.meta.url)), "..");
-var CORPUS = join21(ROOT5, "bench", "corpus");
-var CAPTURED_CORPUS_DIR = process.env.BLITZSTRIKE_CORPUS_DIR ?? join21(homedir8(), ".blitzstrike", "corpus");
+var ROOT5 = join22(fileURLToPath12(new URL(".", import.meta.url)), "..");
+var CORPUS = join22(ROOT5, "bench", "corpus");
+var CAPTURED_CORPUS_DIR = process.env.BLITZSTRIKE_CORPUS_DIR ?? join22(homedir8(), ".blitzstrike", "corpus");
 function parseCorpusFile(path) {
   let text;
   try {
-    text = readFileSync21(path, "utf8");
+    text = readFileSync22(path, "utf8");
   } catch {
     return null;
   }
@@ -59221,7 +59361,7 @@ function loadDir(dir) {
     for (const f of readdirSync5(dir)) {
       if (!f.endsWith(".md"))
         continue;
-      const e = parseCorpusFile(join21(dir, f));
+      const e = parseCorpusFile(join22(dir, f));
       if (e)
         entries.push(e);
     }
@@ -59248,7 +59388,7 @@ function captureFalsePositive(input) {
     input.code,
     "```"
   ].filter((l) => l !== null);
-  const path = join21(CAPTURED_CORPUS_DIR, `${id}.md`);
+  const path = join22(CAPTURED_CORPUS_DIR, `${id}.md`);
   writeFileSync6(path, lines.join(`
 `) + `
 `, "utf8");
@@ -59270,7 +59410,7 @@ function detect(entry) {
   }
   const lang = entry.language;
   if (lang === "php") {
-    const tmp = join21(tmpdir3(), `blitzstrike-bench-${entry.id}-${process.pid}.php`);
+    const tmp = join22(tmpdir3(), `blitzstrike-bench-${entry.id}-${process.pid}.php`);
     writeFileSync6(tmp, entry.code);
     const r = analyzeDataFlow2(tmp);
     rmSync3(tmp, { force: true });
@@ -59339,12 +59479,12 @@ function runBenchmark() {
 }
 
 // src/obligations.ts
-import { readFileSync as readFileSync22, appendFileSync as appendFileSync4, mkdirSync as mkdirSync8, existsSync as existsSync12, writeFileSync as writeFileSync7 } from "node:fs";
-import { join as join22 } from "node:path";
+import { readFileSync as readFileSync23, appendFileSync as appendFileSync4, mkdirSync as mkdirSync8, existsSync as existsSync12, writeFileSync as writeFileSync7 } from "node:fs";
+import { join as join23 } from "node:path";
 import { createHash as createHash6 } from "node:crypto";
 import { homedir as homedir9 } from "node:os";
-var HOME_DIR4 = process.env.BLITZSTRIKE_HOME ?? join22(homedir9(), ".blitzstrike");
-var OBLIGATION_PATH = join22(HOME_DIR4, "obligations.jsonl");
+var HOME_DIR4 = process.env.BLITZSTRIKE_HOME ?? join23(homedir9(), ".blitzstrike");
+var OBLIGATION_PATH = join23(HOME_DIR4, "obligations.jsonl");
 function ensureDir3() {
   if (!existsSync12(HOME_DIR4))
     mkdirSync8(HOME_DIR4, { recursive: true });
@@ -59357,7 +59497,7 @@ function loadObligations() {
     return [];
   try {
     const out = [];
-    for (const line of readFileSync22(OBLIGATION_PATH, "utf8").split(`
+    for (const line of readFileSync23(OBLIGATION_PATH, "utf8").split(`
 `)) {
       const t = line.trim();
       if (!t)
@@ -59461,11 +59601,11 @@ init_framework_security();
 // src/variant-scan.ts
 init_scanner();
 init_complex_bugs();
-import { readFileSync as readFileSync24 } from "node:fs";
+import { readFileSync as readFileSync25 } from "node:fs";
 
 // src/cross-file.ts
 init_scanner();
-import { readFileSync as readFileSync23 } from "node:fs";
+import { readFileSync as readFileSync24 } from "node:fs";
 var PUBLIC_HOOK_RE = /(?:wp_ajax_nopriv_\w+|admin_post_nopriv_\w+|init|template_redirect|wp_loaded|parse_request|user_register|um_user_register|register_new_user|authenticate)/;
 var PRIV_SINK_RE = /\b(set_role|add_role|remove_role|set_user_role|wp_set_current_user|wp_set_auth_cookie|wp_insert_user|wp_create_user|wp_update_user)\s*\(/;
 var ROLE_META_RE = /update_user_meta\s*\(\s*[^,]+,\s*['"](wp_capabilities|role|roles|capabilities|wp_user_level)['"]/;
@@ -59517,7 +59657,7 @@ function detectCrossFilePrivesc(root) {
   for (const file of files) {
     let code;
     try {
-      code = stripComments(readFileSync23(file, "utf8"));
+      code = stripComments(readFileSync24(file, "utf8"));
     } catch {
       continue;
     }
@@ -59558,7 +59698,7 @@ function detectCrossFilePrivesc(root) {
   for (const file of files) {
     let code;
     try {
-      code = stripComments(readFileSync23(file, "utf8"));
+      code = stripComments(readFileSync24(file, "utf8"));
     } catch {
       continue;
     }
@@ -59581,7 +59721,7 @@ function detectCrossFilePrivesc(root) {
   for (const file of files) {
     let code;
     try {
-      code = stripComments(readFileSync23(file, "utf8"));
+      code = stripComments(readFileSync24(file, "utf8"));
     } catch {
       continue;
     }
@@ -59696,7 +59836,7 @@ function variantScan(root, opts = {}) {
   for (const file of files) {
     let code;
     try {
-      code = readFileSync24(file, "utf8");
+      code = readFileSync25(file, "utf8");
     } catch {
       continue;
     }
@@ -61376,7 +61516,7 @@ function listPocTypes() {
 import { execSync as execSync3 } from "node:child_process";
 import { mkdtempSync as mkdtempSync3, mkdirSync as mkdirSync9, writeFileSync as writeFileSync8, rmSync as rmSync4, existsSync as existsSync14 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
-import { join as join23 } from "node:path";
+import { join as join24 } from "node:path";
 function findForge() {
   try {
     const p = execSync3("which forge 2>/dev/null", { encoding: "utf8", timeout: 3000 }).trim();
@@ -61425,14 +61565,14 @@ async function foundryRun(input) {
     };
   }
   const poc = input.poc_code ?? foundryPoc(input.class_ ?? "missing_access_control", name);
-  const dir = mkdtempSync3(join23(tmpdir4(), "blitzstrike-foundry-"));
+  const dir = mkdtempSync3(join24(tmpdir4(), "blitzstrike-foundry-"));
   try {
     try {
       execSync3(`${forge} init --force --no-git ${dir}`, { stdio: "ignore", timeout: 60000 });
     } catch {
-      mkdirSync9(join23(dir, "src"), { recursive: true });
-      mkdirSync9(join23(dir, "test"), { recursive: true });
-      writeFileSync8(join23(dir, "foundry.toml"), `[profile.default]
+      mkdirSync9(join24(dir, "src"), { recursive: true });
+      mkdirSync9(join24(dir, "test"), { recursive: true });
+      writeFileSync8(join24(dir, "foundry.toml"), `[profile.default]
 src = "src"
 out = "out"
 libs = ["lib"]
@@ -61442,12 +61582,12 @@ solc = "0.8.20"
     for (const f of ["Counter.sol", "Counter.t.sol", "Counter.s.sol"]) {
       for (const sub of ["src", "test", "script"]) {
         try {
-          rmSync4(join23(dir, sub, f), { force: true });
+          rmSync4(join24(dir, sub, f), { force: true });
         } catch {}
       }
     }
-    writeFileSync8(join23(dir, "src", `${name}.sol`), input.contract_code);
-    writeFileSync8(join23(dir, "test", `${name}.t.sol`), poc);
+    writeFileSync8(join24(dir, "src", `${name}.sol`), input.contract_code);
+    writeFileSync8(join24(dir, "test", `${name}.t.sol`), poc);
     const { out } = runForge(forge, dir, input.timeout_ms ?? 60000);
     const tests = parseTestResults(out);
     const anyFail = tests.some((t) => t.status === "fail");
@@ -61464,119 +61604,6 @@ solc = "0.8.20"
   }
 }
 
-// src/hunting-intel.ts
-import { execFileSync as execFileSync5 } from "node:child_process";
-import { resolve4 as resolve42, Resolver } from "node:dns/promises";
-import { readFileSync as readFileSync25 } from "node:fs";
-import { join as join24 } from "node:path";
-var BLOCKING_KEYWORDS = /internet positif|kominfo|\.go\.id\b|pemblokiran|ditutup|dilarang|akses dibatasi|blocked|restricted|illegal|advertencia|coljuegos|regulat|forbidden|this (site|website) has been (blocked|banned)/i;
-var HOSTNAME_RE = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$/i;
-function isValidHostname(host) {
-  return host.length <= 253 && HOSTNAME_RE.test(host);
-}
-async function localResolve(host) {
-  try {
-    return await resolve42(host);
-  } catch {
-    return [];
-  }
-}
-async function publicResolve(host) {
-  const r = new Resolver;
-  r.setServers(["8.8.8.8", "1.1.1.1"]);
-  try {
-    return await r.resolve4(host);
-  } catch {
-    return [];
-  }
-}
-function probeBlockingPage(host, ip, timeoutMs = 8000) {
-  for (const port of ["443", "80"]) {
-    const scheme = port === "443" ? "https" : "http";
-    try {
-      const out = execFileSync5("curl", ["-sk", "-m", "6", "--resolve", `${host}:${port}:${ip}`, `${scheme}://${host}/`], { encoding: "utf8", timeout: timeoutMs, stdio: ["ignore", "pipe", "ignore"] });
-      const preview = out.replace(/\s+/g, " ").trim().slice(0, 300);
-      if (!preview)
-        continue;
-      return { probed: true, sinkhole: BLOCKING_KEYWORDS.test(preview), preview };
-    } catch {}
-  }
-  return { probed: false, sinkhole: false, preview: "" };
-}
-async function resolveCheck(host) {
-  const clean = host.replace(/^https?:\/\//, "").split("/")[0];
-  if (!isValidHostname(clean)) {
-    return { host: clean, local_ips: [], public_ips: [], sinkhole: false, verdict: "invalid", evidence: "not a valid hostname — rejected before DNS/subprocess" };
-  }
-  const local = await localResolve(clean);
-  const pub = await publicResolve(clean);
-  if (local.length === 0 && pub.length === 0) {
-    return { host: clean, local_ips: [], public_ips: [], sinkhole: false, verdict: "unresolvable", evidence: "no A record from local or public DNS" };
-  }
-  if (local.length === 0) {
-    return { host: clean, local_ips: [], public_ips: pub, sinkhole: false, verdict: "local-unresolvable", evidence: "local resolver returned no A record; public DNS resolves. Use the public IP to reach the real target." };
-  }
-  const firstLocal = local[0];
-  const probe = probeBlockingPage(clean, firstLocal);
-  if (probe.sinkhole) {
-    return {
-      host: clean,
-      local_ips: local,
-      public_ips: pub,
-      sinkhole: true,
-      verdict: "sinkhole",
-      evidence: `local IP ${firstLocal} serves a blocking/sinkhole page ("${probe.preview.slice(0, 120)}"). Audit the PUBLIC IP (${pub[0] ?? "n/a"}) instead — e.g. curl --resolve ${clean}:443:${pub[0]} https://${clean}/`
-    };
-  }
-  if (!probe.probed) {
-    return { host: clean, local_ips: local, public_ips: pub, sinkhole: false, verdict: "inconclusive", evidence: "local IP did not respond on 443/80 — inconclusive; for sensitive niches prefer the public IP anyway." };
-  }
-  const ipDiff = new Set(local).size !== new Set(pub).size || !pub.every((ip) => local.includes(ip));
-  return {
-    host: clean,
-    local_ips: local,
-    public_ips: pub,
-    sinkhole: false,
-    verdict: ipDiff ? "clean-cdn" : "clean",
-    evidence: ipDiff ? "local and public IPs differ but the local page shows no blocking content (normal for CDN/anycast/round-robin)." : "local resolution matches public DNS and shows no blocking content."
-  };
-}
-function loadWatchlist() {
-  const raw = readFileSync25(join24(process.cwd(), "intelligence", "watchlist.json"), "utf8");
-  const data = JSON.parse(raw);
-  return { cwe_frequency: data.cwe_frequency ?? [], cve_watchlist: data.cve_watchlist ?? [] };
-}
-function fmtPayout(min, max) {
-  if (min == null || max == null)
-    return "n/a";
-  const f = (n) => n >= 1000 ? `$${(n / 1000).toFixed(n % 1000 === 0 ? 0 : 1)}K` : `$${n}`;
-  return `${f(min)}–${f(max)}`;
-}
-function watchlist() {
-  const { cwe_frequency, cve_watchlist } = loadWatchlist();
-  const entries = cwe_frequency.map((e) => {
-    const pat = e.pattern ? patternLookup(e.pattern) : null;
-    const payoutMin = e.payout_min ?? pat?.payout_min ?? null;
-    const payoutMax = e.payout_max ?? pat?.payout_max ?? null;
-    return {
-      cwe: e.cwe,
-      name: e.name,
-      rank: e.rank,
-      saturated: e.saturated,
-      pattern: e.pattern ?? null,
-      payout_min: payoutMin,
-      payout_max: payoutMax,
-      typical_payout: fmtPayout(payoutMin, payoutMax),
-      notes: e.notes,
-      grounded: pat != null
-    };
-  }).sort((a, b) => a.rank - b.rank);
-  const unsaturated = entries.filter((e) => !e.saturated);
-  const topCve = cve_watchlist.filter((c) => (c.epss ?? 0) >= 0.8 || (c.reports ?? 0) >= 100).slice(0, 4).map((c) => c.cve).join(", ");
-  const recommendation = `Prioritize the ${unsaturated.length} non-saturated classes (top: ${unsaturated.slice(0, 3).map((e) => e.cwe).join(", ")}) — high frequency + high payout + not yet saturated. Skip saturated/low-value classes (XSS/CSRF/open-redirect standalone) unless they chain into account takeover. FINGERPRINT FIRST: if the target stack matches a watchlist product (Next.js, Kibana, Langflow, Confluence/Jira, PAN-OS, Grafana), test that specific CVE — top EPSS/report CVEs: ${topCve}.`;
-  return { cwe_frequency: entries, cve_watchlist, recommendation };
-}
-
 // src/enterprise-benchmark.ts
 import { existsSync as existsSync15, readFileSync as readFileSync26, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
 import { join as join25, resolve } from "node:path";

package/intelligence/watchlist.json

@@ -180,7 +180,8 @@
       "class": "rce",
       "epss": 1.0,
       "reports": 2669,
-      "fingerprint": "Confluence (Server/Data Center) \u2014 /login.action, confluence headers"
+      "fingerprint": "Confluence (Server/Data Center) \u2014 /login.action, confluence headers",
+      "match": "confluence|login\\.action|atlassian"
     },
     {
       "cve": "CVE-2025-29927",
@@ -189,7 +190,8 @@
       "class": "auth_bypass",
       "epss": 0.9962,
       "reports": 132,
-      "fingerprint": "_next/static/chunks/ bundles; x-middleware-subrequest header"
+      "fingerprint": "_next/static/chunks/ bundles; x-middleware-subrequest header",
+      "match": "_next/|__next|next\\.js|middleware"
     },
     {
       "cve": "CVE-2025-55182",
@@ -198,7 +200,8 @@
       "class": "rce",
       "epss": 0.9956,
       "reports": 415,
-      "fingerprint": "_next/ + Server Function / flight endpoints"
+      "fingerprint": "_next/ + Server Function / flight endpoints",
+      "match": "_next/|server function|react server|rsc"
     },
     {
       "cve": "CVE-2025-3248",
@@ -207,7 +210,8 @@
       "class": "rce",
       "epss": 0.9997,
       "reports": 29,
-      "fingerprint": "/api/v1/validate/code \u2014 AI/agent tooling"
+      "fingerprint": "/api/v1/validate/code \u2014 AI/agent tooling",
+      "match": "langflow|validate/code"
     },
     {
       "cve": "CVE-2024-34351",
@@ -216,7 +220,8 @@
       "class": "ssrf",
       "epss": 0.0545,
       "reports": 50,
-      "fingerprint": "Next.js Server Actions (Host header + relative redirect)"
+      "fingerprint": "Next.js Server Actions (Host header + relative redirect)",
+      "match": "_next/|server action"
     },
     {
       "cve": "CVE-2025-0133",
@@ -225,7 +230,8 @@
       "class": "xss",
       "epss": 0.4352,
       "reports": 1990,
-      "fingerprint": "GlobalProtect captive portal"
+      "fingerprint": "GlobalProtect captive portal",
+      "match": "globalprotect|palo alto|pan-os|pan os"
     },
     {
       "cve": "CVE-2026-0257",
@@ -234,7 +240,8 @@
       "class": "auth_bypass",
       "epss": 0.8668,
       "reports": 27,
-      "fingerprint": "GlobalProtect portal/gateway"
+      "fingerprint": "GlobalProtect portal/gateway",
+      "match": "globalprotect|palo alto|pan-os|pan os"
     },
     {
       "cve": "CVE-2025-4123",
@@ -243,7 +250,8 @@
       "class": "xss",
       "epss": 0.9781,
       "reports": 220,
-      "fingerprint": "Grafana path traversal + open redirect (Image Renderer)"
+      "fingerprint": "Grafana path traversal + open redirect (Image Renderer)",
+      "match": "grafana|x-grafana"
     },
     {
       "cve": "CVE-2021-20323",
@@ -252,7 +260,8 @@
       "class": "xss",
       "epss": 0.3725,
       "reports": 107,
-      "fingerprint": "Keycloak auth flows"
+      "fingerprint": "Keycloak auth flows",
+      "match": "keycloak|kc-|realms/"
     },
     {
       "cve": "CVE-2018-5230",
@@ -261,7 +270,8 @@
       "class": "xss",
       "epss": 0.3761,
       "reports": 4694,
-      "fingerprint": "Jira /issuecollector custom fields"
+      "fingerprint": "Jira /issuecollector custom fields",
+      "match": "jira|issuecollector|atlassian"
     },
     {
       "cve": "CVE-2026-33461",
@@ -270,7 +280,8 @@
       "class": "auth_bypass",
       "epss": 0.0028,
       "reports": 8,
-      "fingerprint": "Kibana internal Fleet endpoints"
+      "fingerprint": "Kibana internal Fleet endpoints",
+      "match": "kibana|elastic|fleet"
     },
     {
       "cve": "CVE-2026-49093",
@@ -279,7 +290,8 @@
       "class": "ssrf",
       "epss": 0.002,
       "reports": 5,
-      "fingerprint": "Kibana connectors / allowlist bypass"
+      "fingerprint": "Kibana connectors / allowlist bypass",
+      "match": "kibana|elastic|connector"
     },
     {
       "cve": "CVE-2026-26938",
@@ -288,7 +300,8 @@
       "class": "ssti",
       "epss": 0.0025,
       "reports": 5,
-      "fingerprint": "Kibana Workflows"
+      "fingerprint": "Kibana Workflows",
+      "match": "kibana|elastic|workflow"
     },
     {
       "cve": "CVE-2026-33068",
@@ -297,7 +310,8 @@
       "class": "priv_esc",
       "epss": 0.0034,
       "reports": 5,
-      "fingerprint": "repo .claude/settings.json"
+      "fingerprint": "repo .claude/settings.json",
+      "match": "\\.claude/settings"
     },
     {
       "cve": "CVE-2025-25297",
@@ -306,7 +320,8 @@
       "class": "ssrf",
       "epss": 0.0062,
       "reports": 2,
-      "fingerprint": "Label Studio S3 integration"
+      "fingerprint": "Label Studio S3 integration",
+      "match": "label ?studio|labelstudio|label-studio"
     },
     {
       "cve": "CVE-2026-33309",
@@ -315,7 +330,8 @@
       "class": "file_upload",
       "epss": 0.0142,
       "reports": 6,
-      "fingerprint": "Langflow multipart upload filename"
+      "fingerprint": "Langflow multipart upload filename",
+      "match": "langflow"
     },
     {
       "cve": "CVE-2026-45543",
@@ -324,7 +340,8 @@
       "class": "missing_authz",
       "epss": 0.0027,
       "reports": 5,
-      "fingerprint": "Nextcloud Forms collaborator removal"
+      "fingerprint": "Nextcloud Forms collaborator removal",
+      "match": "nextcloud|ocs-provider"
     },
     {
       "cve": "CVE-2017-15277",
@@ -333,7 +350,8 @@
       "class": "infoleak",
       "epss": 0.1919,
       "reports": 5914,
-      "fingerprint": "image processing (GIF upload)"
+      "fingerprint": "image processing (GIF upload)",
+      "match": "imagemagick|graphicsmagick"
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.97",
+  "version": "2.4.99",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {