blitzstrike 2.4.99 → 2.4.101

package/CHANGELOG.md

@@ -5,6 +5,29 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.101] — 2026-09-17
+
+### Added — three new hunting classes (techniques + attack vectors)
+
+- Added `broken_link_hijacking` (expired-domain takeover), `padding_oracle`
+  (CBC PKCS#7 cookie/token decryption), and `dns_rebinding` (hostname
+  re-resolution to internal IP) to the technique base (53 → 56 classes) and the
+  attack-vector taxonomy (588 → 591 vectors). Each carries summary, objectives,
+  how-to-test steps, concrete techniques, and verify (marker + negative
+  control) — matching the existing per-class methodology shape.
+
+## [2.4.100] — 2026-09-17
+
+### Fixed — data-file resolution was `process.cwd()`-dependent (broke under npx)
+
+- `watchlist()` / `watchlistCveMatches()` resolved `intelligence/watchlist.json`
+  via `process.cwd()`; `run_enterprise_benchmark()` resolved `bench/enterprise`
+  fixtures the same way. When the MCP server / compiled binary runs from any
+  directory other than the package root (the `npx blitzstrike` case), both threw
+  `ENOENT`. Now both resolve via `import.meta.url` (module-relative), matching
+  every other data loader (`patterns.ts`, `chains.json`, `tools-catalog.json`).
+  Verified: `watchlist()` and the enterprise fixtures load from an arbitrary cwd.
+
 ## [2.4.99] — 2026-09-17
 
 ### Fixed — grounding completeness for the CVE watchlist class tags

package/dist/index.js

@@ -17287,7 +17287,7 @@ document.getElementById('out').innerHTML = u;
 // src/variants.ts
 import { readFileSync as readFileSync21 } from "node:fs";
 import { join as join21, dirname as dirname5 } from "node:path";
-import { fileURLToPath as fileURLToPath11 } from "node:url";
+import { fileURLToPath as fileURLToPath12 } from "node:url";
 function loadVariants() {
   try {
     const doc = JSON.parse(readFileSync21(join21(__dirname5, "..", "intelligence", "variants.json"), "utf8"));
@@ -17344,7 +17344,7 @@ function variantCoverageText() {
 var __dirname5, CROSS_FILE_ONLY;
 var init_variants = __esm(() => {
   init_complex_bugs();
-  __dirname5 = dirname5(fileURLToPath11(import.meta.url));
+  __dirname5 = dirname5(fileURLToPath12(import.meta.url));
   CROSS_FILE_ONLY = new Set(["priv_esc"]);
 });
 
@@ -17352,7 +17352,7 @@ var init_variants = __esm(() => {
 import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync9, readFileSync as readFileSync27, readdirSync as readdirSync7, statSync as statSync4, rmSync as rmSync5 } from "node:fs";
 import { join as join26 } from "node:path";
 import { homedir as homedir10 } from "node:os";
-import { fileURLToPath as fileURLToPath13 } from "node:url";
+import { fileURLToPath as fileURLToPath15 } from "node:url";
 import { spawnSync as spawnSync4 } from "node:child_process";
 function dirExists(p) {
   try {
@@ -17392,8 +17392,8 @@ function syncData() {
       data_root: DATA_ROOT2
     };
   }
-  const localPayloads = join26(ROOT7, "payloads");
-  const localTemplates = join26(ROOT7, "templates");
+  const localPayloads = join26(ROOT8, "payloads");
+  const localTemplates = join26(ROOT8, "templates");
   let payloadsSynced = false;
   let templatesSynced = false;
   if (!hasPayloads && dirExists(localPayloads)) {
@@ -17448,9 +17448,9 @@ function manualCopy(src, dst) {
       writeFileSync9(d, readFileSync27(s));
   }
 }
-var ROOT7, DATA_ROOT2, GITHUB_REPO = "https://github.com/shinthink/blitzstrike.git";
+var ROOT8, DATA_ROOT2, GITHUB_REPO = "https://github.com/shinthink/blitzstrike.git";
 var init_sync = __esm(() => {
-  ROOT7 = join26(fileURLToPath13(new URL(".", import.meta.url)), "..");
+  ROOT8 = join26(fileURLToPath15(new URL(".", import.meta.url)), "..");
   DATA_ROOT2 = process.env.BLITZSTRIKE_DATA ?? join26(homedir10(), ".blitzstrike", "data");
 });
 
@@ -17498,13 +17498,13 @@ var init_update = __esm(() => {
 // src/release.ts
 import { readFileSync as readFileSync29, existsSync as existsSync16 } from "node:fs";
 import { join as join27 } from "node:path";
-import { fileURLToPath as fileURLToPath14 } from "node:url";
+import { fileURLToPath as fileURLToPath16 } from "node:url";
 import { execSync as execSync4 } from "node:child_process";
 function validateRelease() {
   const checks = [];
   checks.push({ name: "package.json version", ok: true, detail: VERSION });
   try {
-    const changelog = readFileSync29(join27(ROOT8, "CHANGELOG.md"), "utf8");
+    const changelog = readFileSync29(join27(ROOT9, "CHANGELOG.md"), "utf8");
     const m = changelog.match(/^##\s+\[([0-9]+\.[0-9]+\.[0-9]+)\]/m);
     const changelogVersion = m?.[1] ?? null;
     checks.push({
@@ -17516,7 +17516,7 @@ function validateRelease() {
     checks.push({ name: "CHANGELOG version", ok: false, detail: "CHANGELOG.md not found" });
   }
   try {
-    const tag = execSync4("git describe --tags --abbrev=0", { cwd: ROOT8, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    const tag = execSync4("git describe --tags --abbrev=0", { cwd: ROOT9, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
     checks.push({ name: "Git tag", ok: tag === `v${VERSION}`, detail: tag, soft: true });
   } catch {
     checks.push({ name: "Git tag", ok: true, detail: "unavailable (no git/tags)", soft: true });
@@ -17536,22 +17536,22 @@ function validateRelease() {
   return { version: VERSION, checks, consistent: checks.filter((c) => !c.soft).every((c) => c.ok) };
 }
 function lockfilePresent() {
-  return existsSync16(join27(ROOT8, "package-lock.json")) || existsSync16(join27(ROOT8, "bun.lock")) || existsSync16(join27(ROOT8, "bun.lockb"));
+  return existsSync16(join27(ROOT9, "package-lock.json")) || existsSync16(join27(ROOT9, "bun.lock")) || existsSync16(join27(ROOT9, "bun.lockb"));
 }
-var ROOT8;
+var ROOT9;
 var init_release = __esm(() => {
   init_version();
-  ROOT8 = join27(fileURLToPath14(new URL(".", import.meta.url)), "..");
+  ROOT9 = join27(fileURLToPath16(new URL(".", import.meta.url)), "..");
 });
 
 // src/dependency.ts
 import { readFileSync as readFileSync30 } from "node:fs";
 import { join as join28 } from "node:path";
-import { fileURLToPath as fileURLToPath15 } from "node:url";
+import { fileURLToPath as fileURLToPath17 } from "node:url";
 function checkDependencies() {
   let pkg = {};
   try {
-    pkg = JSON.parse(readFileSync30(join28(ROOT9, "package.json"), "utf8"));
+    pkg = JSON.parse(readFileSync30(join28(ROOT10, "package.json"), "utf8"));
   } catch {
     return { install_scripts: [], git_dependencies: [], total_dependencies: 0, safe: false };
   }
@@ -17572,16 +17572,16 @@ function checkDependencies() {
     safe: installScripts.length === 0 && gitDependencies.length === 0
   };
 }
-var ROOT9;
+var ROOT10;
 var init_dependency = __esm(() => {
-  ROOT9 = join28(fileURLToPath15(new URL(".", import.meta.url)), "..");
+  ROOT10 = join28(fileURLToPath17(new URL(".", import.meta.url)), "..");
 });
 
 // src/cli.ts
 import { readFileSync as readFileSync31, existsSync as existsSync17, writeFileSync as writeFileSync10, mkdirSync as mkdirSync11 } from "node:fs";
 import { join as join29, dirname as dirname6 } from "node:path";
 import { homedir as homedir11 } from "node:os";
-import { fileURLToPath as fileURLToPath16 } from "node:url";
+import { fileURLToPath as fileURLToPath18 } from "node:url";
 import { spawnSync as spawnSync5 } from "node:child_process";
 function which(cmd) {
   return spawnSync5("sh", ["-c", 'command -v "$1" >/dev/null 2>&1', "sh", cmd]).status === 0;
@@ -17624,7 +17624,7 @@ async function runDoctor() {
     detail: h1 ? `X-HackerOne-Research: ${h1}` : "H1_USERNAME not set",
     fix: h1 ? undefined : "export H1_USERNAME=<your-hackerone-username> (adds X-HackerOne-Research to outbound requests)"
   });
-  const dataOk = existsSync17(join29(ROOT10, "chains.json")) && existsSync17(join29(ROOT10, "tools-catalog.json"));
+  const dataOk = existsSync17(join29(ROOT11, "chains.json")) && existsSync17(join29(ROOT11, "tools-catalog.json"));
   issues.push({
     name: "Data layers (chains + tools-catalog)",
     status: dataOk ? "ok" : "fail",
@@ -17675,14 +17675,14 @@ BlitzStrike — ${verdict}`);
 function resolveCommand() {
   if (which("blitzstrike"))
     return { command: "blitzstrike", args: ["serve", "--mcp"] };
-  const src = join29(ROOT10, "src", "index.ts");
+  const src = join29(ROOT11, "src", "index.ts");
   if (which("bun") && existsSync17(src))
     return { command: "bun", args: ["run", src, "serve", "--mcp"] };
   if (which("npx"))
     return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
   if (which("bunx"))
     return { command: "bunx", args: ["blitzstrike", "serve", "--mcp"] };
-  const dist = join29(ROOT10, "dist", "index.js");
+  const dist = join29(ROOT11, "dist", "index.js");
   if (existsSync17(dist))
     return { command: "bun", args: [dist, "serve", "--mcp"] };
   return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
@@ -17722,7 +17722,7 @@ function opencodeWrite(p) {
   };
 }
 function copyOpenCodeAgents() {
-  const srcDir = join29(ROOT10, "opencode-agents");
+  const srcDir = join29(ROOT11, "opencode-agents");
   const dstDir = join29(homedir11(), ".config", "opencode", "agents");
   if (!existsSync17(srcDir))
     return;
@@ -17966,13 +17966,13 @@ Failed (${failedList.length}) — reason per tool:`);
 Common causes: missing toolchain, pip/git network failures, or very heavy builds. ` + `Re-run after installing the missing toolchain — failed tools are skipped, not fatal.`);
   }
 }
-var ROOT10;
+var ROOT11;
 var init_cli = __esm(() => {
   init_catalog();
   init_release();
   init_dependency();
   init_mcp_status();
-  ROOT10 = join29(fileURLToPath16(new URL(".", import.meta.url)), "..");
+  ROOT11 = join29(fileURLToPath18(new URL(".", import.meta.url)), "..");
 });
 
 // node_modules/zod/v3/helpers/util.js
@@ -32695,7 +32695,7 @@ async function nvdLookup(cveId) {
 init_scanner();
 import { readFileSync as readFileSync11, existsSync as existsSync8, statSync as statSync2 } from "node:fs";
 import { join as join13 } from "node:path";
-import { fileURLToPath as fileURLToPath6 } from "node:url";
+import { fileURLToPath as fileURLToPath7 } from "node:url";
 
 // src/memory.ts
 import { readFileSync as readFileSync2, appendFileSync, mkdirSync, existsSync, writeFileSync } from "node:fs";
@@ -36080,6 +36080,8 @@ import { execFileSync } from "node:child_process";
 import { resolve4, Resolver } from "node:dns/promises";
 import { readFileSync as readFileSync10 } from "node:fs";
 import { join as join12 } from "node:path";
+import { fileURLToPath as fileURLToPath6 } from "node:url";
+var ROOT4 = join12(fileURLToPath6(new URL(".", import.meta.url)), "..");
 var BLOCKING_KEYWORDS = /internet positif|kominfo|\.go\.id\b|pemblokiran|ditutup|dilarang|akses dibatasi|blocked|restricted|illegal|advertencia|coljuegos|regulat|forbidden|this (site|website) has been (blocked|banned)/i;
 var HOSTNAME_RE = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$/i;
 function isValidHostname(host) {
@@ -36153,7 +36155,7 @@ async function resolveCheck(host) {
   };
 }
 function loadWatchlist() {
-  const raw = readFileSync10(join12(process.cwd(), "intelligence", "watchlist.json"), "utf8");
+  const raw = readFileSync10(join12(ROOT4, "intelligence", "watchlist.json"), "utf8");
   const data = JSON.parse(raw);
   return { cwe_frequency: data.cwe_frequency ?? [], cve_watchlist: data.cve_watchlist ?? [] };
 }
@@ -36776,7 +36778,7 @@ function loadChains() {
   if (_chainsCache)
     return _chainsCache;
   try {
-    const dir = join13(fileURLToPath6(new URL(".", import.meta.url)), "..");
+    const dir = join13(fileURLToPath7(new URL(".", import.meta.url)), "..");
     const path = join13(dir, "chains.json");
     const raw = JSON.parse(readFileSync11(path, "utf8"));
     _chainsCache = raw.chains ?? [];
@@ -37559,7 +37561,7 @@ var CHAIN_ID_TO_ESCALATION = {
 };
 function loadChainLinks() {
   try {
-    const dir = join13(fileURLToPath6(new URL(".", import.meta.url)), "..");
+    const dir = join13(fileURLToPath7(new URL(".", import.meta.url)), "..");
     const data = JSON.parse(readFileSync11(join13(dir, "intelligence", "chain_links.json"), "utf8"));
     return data.links ?? [];
   } catch {
@@ -37718,9 +37720,9 @@ function compactState(phase, findings) {
 // src/tasks.ts
 import { mkdirSync as mkdirSync6, readFileSync as readFileSync12, writeFileSync as writeFileSync3 } from "node:fs";
 import { join as join14 } from "node:path";
-import { fileURLToPath as fileURLToPath7 } from "node:url";
+import { fileURLToPath as fileURLToPath8 } from "node:url";
 function tasksDir() {
-  return join14(fileURLToPath7(new URL(".", import.meta.url)), "..", ".blitzstrike", "tasks");
+  return join14(fileURLToPath8(new URL(".", import.meta.url)), "..", ".blitzstrike", "tasks");
 }
 function taskPath(id) {
   return join14(tasksDir(), `${id}.json`);
@@ -58386,9 +58388,9 @@ function analyzePatchFiles(oldPath, newPath, language) {
 // src/frameworks.ts
 import { readFileSync as readFileSync18, existsSync as existsSync9 } from "node:fs";
 import { join as join17 } from "node:path";
-import { fileURLToPath as fileURLToPath8 } from "node:url";
-var ROOT4 = join17(fileURLToPath8(new URL(".", import.meta.url)), "..");
-var INTEL2 = join17(ROOT4, "intelligence");
+import { fileURLToPath as fileURLToPath9 } from "node:url";
+var ROOT5 = join17(fileURLToPath9(new URL(".", import.meta.url)), "..");
+var INTEL2 = join17(ROOT5, "intelligence");
 var cache = null;
 function load3() {
   if (cache)
@@ -59087,8 +59089,8 @@ async function validateLeakedKey(input) {
 // src/hackbot-arena.ts
 import { readFileSync as readFileSync19 } from "node:fs";
 import { join as join19, dirname as dirname3 } from "node:path";
-import { fileURLToPath as fileURLToPath9 } from "node:url";
-var __dirname3 = dirname3(fileURLToPath9(import.meta.url));
+import { fileURLToPath as fileURLToPath10 } from "node:url";
+var __dirname3 = dirname3(fileURLToPath10(import.meta.url));
 function load4() {
   try {
     return JSON.parse(readFileSync19(join19(__dirname3, "..", "intelligence", "hackbot-arena.json"), "utf8"));
@@ -59255,8 +59257,8 @@ function listSeverityMap() {
 // src/datarefresh.ts
 import { readFileSync as readFileSync20 } from "node:fs";
 import { join as join20, dirname as dirname4 } from "node:path";
-import { fileURLToPath as fileURLToPath10 } from "node:url";
-var __dirname4 = dirname4(fileURLToPath10(import.meta.url));
+import { fileURLToPath as fileURLToPath11 } from "node:url";
+var __dirname4 = dirname4(fileURLToPath11(import.meta.url));
 function loadJson2(rel) {
   try {
     return JSON.parse(readFileSync20(join20(__dirname4, "..", rel), "utf8"));
@@ -59296,11 +59298,11 @@ init_variants();
 // src/benchmark.ts
 import { readFileSync as readFileSync22, readdirSync as readdirSync5, writeFileSync as writeFileSync6, rmSync as rmSync3, mkdirSync as mkdirSync7 } from "node:fs";
 import { join as join22 } from "node:path";
-import { fileURLToPath as fileURLToPath12 } from "node:url";
+import { fileURLToPath as fileURLToPath13 } from "node:url";
 import { tmpdir as tmpdir3, homedir as homedir8 } from "node:os";
 init_complex_bugs();
-var ROOT5 = join22(fileURLToPath12(new URL(".", import.meta.url)), "..");
-var CORPUS = join22(ROOT5, "bench", "corpus");
+var ROOT6 = join22(fileURLToPath13(new URL(".", import.meta.url)), "..");
+var CORPUS = join22(ROOT6, "bench", "corpus");
 var CAPTURED_CORPUS_DIR = process.env.BLITZSTRIKE_CORPUS_DIR ?? join22(homedir8(), ".blitzstrike", "corpus");
 function parseCorpusFile(path) {
   let text;
@@ -61607,15 +61609,16 @@ solc = "0.8.20"
 // src/enterprise-benchmark.ts
 import { existsSync as existsSync15, readFileSync as readFileSync26, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
 import { join as join25, resolve } from "node:path";
+import { fileURLToPath as fileURLToPath14 } from "node:url";
 init_complex_bugs();
-var ROOT6 = resolve(process.cwd(), "bench", "enterprise");
+var ROOT7 = resolve(fileURLToPath14(new URL(".", import.meta.url)), "..", "bench", "enterprise");
 var ENTERPRISE_FIXTURES = [
-  { id: "php-laravel", dir: join25(ROOT6, "php-laravel"), expected_vulns: 4 },
-  { id: "js-express", dir: join25(ROOT6, "js-express"), expected_vulns: 2 },
-  { id: "py-django", dir: join25(ROOT6, "py-django"), expected_vulns: 2 },
-  { id: "java-spring", dir: join25(ROOT6, "java-spring"), expected_vulns: 2 },
-  { id: "wp-batch-route", dir: join25(ROOT6, "wp-batch-route"), expected_vulns: 3 },
-  { id: "php-complex", dir: join25(ROOT6, "php-complex"), expected_vulns: 4 }
+  { id: "php-laravel", dir: join25(ROOT7, "php-laravel"), expected_vulns: 4 },
+  { id: "js-express", dir: join25(ROOT7, "js-express"), expected_vulns: 2 },
+  { id: "py-django", dir: join25(ROOT7, "py-django"), expected_vulns: 2 },
+  { id: "java-spring", dir: join25(ROOT7, "java-spring"), expected_vulns: 2 },
+  { id: "wp-batch-route", dir: join25(ROOT7, "wp-batch-route"), expected_vulns: 3 },
+  { id: "php-complex", dir: join25(ROOT7, "php-complex"), expected_vulns: 4 }
 ];
 function sourceFiles(root) {
   const out = [];
@@ -63040,7 +63043,7 @@ ${statusLine}` : statusLine },
   });
   server.registerTool("technique_lookup", {
     title: "Detailed bug-hunting technique base",
-    description: "INTEL: return the DETAILED methodology + tricks for one vulnerability class (52 classes: ssrf, request smuggling, cache poisoning, race conditions, ssti, deserialization, prototype pollution, mass assignment, sql/nosql injection, xss, cors, csrf, jwt, oauth, host header, open redirect, subdomain takeover, idor, graphql, websocket, file upload, path traversal/LFI, command injection, xxe, crlf, ldap, xpath, xslt, ssi, xssi, email, formula/CSV, orm, rsql, unicode, dangling markup, account takeover, 2fa bypass, rate-limit, password reset, captcha, registration, payment bypass, timing, uuid, reverse tabnabbing, iframe traps, cookies, postMessage, ...). Each returns summary, objectives, how_to_test steps, concrete techniques, and verify (marker + negative control). Load before testing a class to hunt it in detail.",
+    description: "INTEL: return the DETAILED methodology + tricks for one vulnerability class (56 classes: ssrf, request smuggling, cache poisoning, race conditions, ssti, deserialization, prototype pollution, mass assignment, sql/nosql injection, xss, cors, csrf, jwt, oauth, host header, open redirect, subdomain takeover, broken link hijacking, dns rebinding, padding oracle, idor, graphql, websocket, file upload, path traversal/LFI, command injection, xxe, crlf, ldap, xpath, xslt, ssi, xssi, email, formula/CSV, orm, rsql, unicode, dangling markup, account takeover, 2fa bypass, rate-limit, password reset, captcha, registration, payment bypass, timing, uuid, reverse tabnabbing, iframe traps, cookies, postMessage, ...). Each returns summary, objectives, how_to_test steps, concrete techniques, and verify (marker + negative control). Load before testing a class to hunt it in detail.",
     inputSchema: {
       cls: string2().optional().describe("Optional class id or name (e.g. 'ssrf', 'request smuggling', 'ssti').")
     }
@@ -63857,11 +63860,11 @@ async function serve() {
 init_cli();
 import { readFileSync as readFileSync32, existsSync as existsSync18 } from "node:fs";
 import { join as join30 } from "node:path";
-import { fileURLToPath as fileURLToPath17 } from "node:url";
-var ROOT11 = join30(fileURLToPath17(new URL(".", import.meta.url)), "..");
+import { fileURLToPath as fileURLToPath19 } from "node:url";
+var ROOT12 = join30(fileURLToPath19(new URL(".", import.meta.url)), "..");
 function readVersion() {
   try {
-    const p = join30(ROOT11, "package.json");
+    const p = join30(ROOT12, "package.json");
     if (existsSync18(p))
       return JSON.parse(readFileSync32(p, "utf8")).version ?? "1.0.0";
   } catch {}