DEDUPED Hot AI repos, turned into use cases Get 5 a day

How to verify live web findings with marker and control tests with Blitzstrike

Check a scope, then let the agent confirm live findings with marker reflection and a negative control.

Authorization notice. Blitzstrike is dual-use. Only use it on software, sites and systems you own or have explicit permission to test.

Reverse engineering. Active live verification sends requests to a real system, so run it only against targets you are authorized to test and within the agreed scope.

Who it is forA penetration tester with written authorization to test a specific web application.

The problemA scan hit on a live site may be a false positive, and an unverified finding should not reach a client report.

The outcomeEach live finding carries a verdict from a live test, and out-of-scope targets are blocked before any request is sent.

What you need first

  • Node.js (for npx) or Bun, plus an MCP-compatible agent such as Claude Code, Cursor, Codex, or Gemini CLI
  • For source audits: a local source tree you are allowed to scan
  • For live tests: written authorization for the target and a defined scope
  • Optional: FOFA_EMAIL and FOFA_KEY if you want FOFA asset search

Steps

  1. Run npx -y blitzstrike doctor to confirm the environment is ready.
  2. Ask the agent to call scope_check with your target and written scope before any active testing.
  3. Ask the agent to audit the authorized URL, for example "audit https://<target>".
  4. Ask the agent to run strike_verify on each candidate, with a marker, a negative control, and a baseline.
  5. Use strike_resolve to record the verdict on each finding before it is written up.

Prompt for your agent

Using the blitzstrike MCP server, call scope_check for target <authorized URL> with scope <written scope>, then run_engagement on that target. For each candidate, call strike_verify and report only the findings with a live verdict. Verify that no request was sent to a host outside the scope.

Caveat. The README describes live verification and scope enforcement, but the exact scope format and mode values are not shown in the README excerpt, so check the docs before a real engagement.

Share: X LinkedIn Hacker News Email Copy link

Disclaimer

Deduped lists open-source repositories that belong to other people. We do not own, maintain, audit, or vouch for any of them, and a repo appearing here is not an endorsement or a safety check. The use cases, steps, and prompts are written by AI and may be incomplete, outdated, or just wrong. Where a use case is marked "Seen in the wild", we link to public posts where someone described something similar, but we have not verified those posts and the use case itself is still our AI's own write-up. Use all of this at your own risk. Only run code, commands, or agents on systems and accounts you are authorized to use, and read the code and every command before you run it, especially anything that touches credentials, files, or the network. Nothing here is professional, security, legal, or financial advice. All trademarks and project names belong to their respective owners, and their use here does not imply affiliation. Content is provided as is, without warranties of any kind. Found a mistake, a safety problem, or something you want removed? Email [email protected] and we will look at it promptly. Full disclaimer page