القائمة
Use when classifying a verified web or WordPress behavior and selecting a related validation skill.
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/uphiago/recon-skills --skill attack-patterns-referenceيبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
Full WSTG-aligned web application pentest — 12-phase methodology from information gathering through reporting, with concrete commands, expected outputs, pitfalls, and verification per phase.
Attack SAML SSO via XSW, signature strip, metadata extract.
Use when two or more verified findings may combine into a higher-impact authorized attack path.
استنادا إلى تصنيف SOC المهني
عرض SKILL.md
| name | attack-patterns-reference |
| description | Use when classifying a verified web or WordPress behavior and selecting a related validation skill. |
| version | 1.2.0 |
| license | MIT |
| platforms | ["linux"] |
| compatibility | N/A (reference catalog) |
| tags | ["meta","reference","patterns","validation"] |
| category | meta |
| related_skills | ["cors-credential-wordpress","cross-attack-chains","error-log-mining","js-secrets-extraction","phpinfo-to-rce","port-service-discovery","source-leak-hunt","staging-subdomain-hunt","wordpress-plugin-hunt","wp-mass-recon","xmlrpc-exploitation"] |
This catalog maps observed web and WordPress behavior to the skill that owns its validation. Pattern IDs are navigation labels. They do not establish exploitability, severity, prevalence, or a confirmed attack path.
Do not use the catalog as a scanner finding list or a substitute for the verification section of the owning skill.
| Pattern | Initial signal | Owning skill |
|---|---|---|
| WordPress user exposure | REST or author route returns user metadata | wp-mass-recon |
| Credentialed CORS | Untrusted origin reflected with credentials | cors-credential-wordpress |
| XML-RPC methods | Protocol-valid system.listMethods response | xmlrpc-exploitation |
| XML-RPC SSRF | pingback.ping reaches a controlled callback | xmlrpc-exploitation |
| Public registration | Registration is enabled | wp-mass-recon |
| Plugin surface | REST namespace, asset, or version marker | wordpress-plugin-hunt |
| Staging difference | Non-production host has weaker controls | staging-subdomain-hunt |
| Exposed error log |
| Response contains real application errors |
error-log-mining |
| PHPInfo exposure | PHP configuration page is reachable | phpinfo-to-rce |
| Source or backup leak | Response contains repository, configuration, or database content | source-leak-hunt |
| JavaScript secret candidate | Bundle contains a credential-shaped value | js-secrets-extraction |
| Public service | Non-HTTP or administrative service is internet reachable | port-service-discovery |
See references/p-patterns.md for the extended
pattern notes.
| Variant | Initial signal | Required validation |
|---|---|---|
| Origin reflection with credentials | Untrusted origin plus ACAC: true | Credentialed browser reads non-public data |
| Null-origin trust | ACAO: null plus ACAC: true | Sandboxed browser reads non-public data |
| Wildcard without credentials | ACAO: * | Determine whether the response is already public |
| Credentialed preflight | OPTIONS accepts origin, method, and headers | Actual request succeeds and browser exposes response |
| Auth-route CORS | CORS headers appear on a protected route | Approved session returns readable protected data |
| Plugin-specific CORS | Only one plugin namespace accepts the origin | Response contains protected data or performs an authorized test action |
| Environment-specific CORS | Staging and production policies differ | Demonstrate impact in the authorized environment |
| Third-party allowlist | One external service origin is trusted | Establish control of that origin and protected-data access |
These are composition templates, not confirmed findings:
| Path | Preconditions that must be verified |
|---|---|
| CORS to protected-data read | Approved session, untrusted origin, browser-readable non-public response |
| XML-RPC SSRF to cloud metadata | Controlled callback, reachable metadata service, usable secondary impact |
| Open registration to upload | Approved synthetic account, upload-capable role, executable file path |
| Exposed log to account access | Current credential material, approved identity, valid authentication control |
| Staging exposure to production impact | Shared trust boundary, reusable secret or deployment path, explicit scope |
Use cross-attack-chains only after every prerequisite is independently
verified.
