{
 "schema_version": 1,
 "generated": "2026-10-20",
 "id": "shinthink-blitzstrike--verify-live-web-findings-before-reporting",
 "repo": "shinthink/blitzstrike",
 "repo_url": "https://github.com/shinthink/blitzstrike",
 "repo_slug": "shinthink-blitzstrike",
 "title": "Verify live web findings with marker and control tests",
 "page_title": "How to verify live web findings with marker and control tests with Blitzstrike",
 "summary": "Check a scope, then let the agent confirm live findings with marker reflection and a negative control.",
 "who": "A penetration tester with written authorization to test a specific web application.",
 "problem": "A scan hit on a live site may be a false positive, and an unverified finding should not reach a client report.",
 "outcome": "Each live finding carries a verdict from a live test, and out-of-scope targets are blocked before any request is sent.",
 "steps": [
  "Run `npx -y blitzstrike doctor` to confirm the environment is ready.",
  "Ask the agent to call scope_check with your target and written scope before any active testing.",
  "Ask the agent to audit the authorized URL, for example \"audit https://<target>\".",
  "Ask the agent to run strike_verify on each candidate, with a marker, a negative control, and a baseline.",
  "Use strike_resolve to record the verdict on each finding before it is written up."
 ],
 "agent_prompt": "Using the blitzstrike MCP server, call scope_check for target <authorized URL> with scope <written scope>, then run_engagement on that target. For each candidate, call strike_verify and report only the findings with a live verdict. Verify that no request was sent to a host outside the scope.",
 "agents": [
  "claude-code",
  "cursor",
  "codex",
  "gemini-cli"
 ],
 "difficulty": "Advanced",
 "time": "30 minutes",
 "basis": "readme",
 "caveat": "The README describes live verification and scope enforcement, but the exact scope format and mode values are not shown in the README excerpt, so check the docs before a real engagement.",
 "category": "Security and science",
 "tags": [
  "Security and science"
 ],
 "lang": "typescript",
 "requirements": [
  "Node.js (for npx) or Bun, plus an MCP-compatible agent such as Claude Code, Cursor, Codex, or Gemini CLI",
  "For source audits: a local source tree you are allowed to scan",
  "For live tests: written authorization for the target and a defined scope",
  "Optional: FOFA_EMAIL and FOFA_KEY if you want FOFA asset search"
 ],
 "risk": "dual-use",
 "seen_in_the_wild": false,
 "mentioned_publicly": false,
 "risks": [
  {
   "tag": "reverse-engineering",
   "notice": "Active live verification sends requests to a real system, so run it only against targets you are authorized to test and within the agreed scope."
  }
 ],
 "best": false,
 "score": 0.9,
 "evidence": [],
 "url": "https://dedupedai.com/use-cases/shinthink-blitzstrike/verify-live-web-findings-before-reporting/",
 "md": "https://dedupedai.com/use-cases/shinthink-blitzstrike/verify-live-web-findings-before-reporting/index.md",
 "disclaimer": "Deduped lists open-source repositories that belong to other people. We do not own, maintain, audit, or vouch for any of them, and a repo appearing here is not an endorsement or a safety check. The use cases, steps, and prompts are written by AI and may be incomplete, outdated, or just wrong. Where a use case is marked \"Seen in the wild\", we link to public posts where someone described something similar, but we have not verified those posts and the use case itself is still our AI's own write-up. Use all of this at your own risk. Only run code, commands, or agents on systems and accounts you are authorized to use, and read the code and every command before you run it, especially anything that touches credentials, files, or the network. Nothing here is professional, security, legal, or financial advice. All trademarks and project names belong to their respective owners, and their use here does not imply affiliation. Content is provided as is, without warranties of any kind. Found a mistake, a safety problem, or something you want removed? Email hello@dedupedai.com and we will look at it promptly.",
 "api": "https://dedupedai.com/api/v1/usecases/shinthink-blitzstrike--verify-live-web-findings-before-reporting.json",
 "api_version": "v1"
}