Menu
Compare recon waves to find NEW, REGRESSED, PERSISTENT findings.
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/uphiago/recon-skills --skill cross-wave-delta-analysisThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Showing SKILL.md
| name | cross-wave-delta-analysis |
| description | Compare recon waves to find NEW, REGRESSED, PERSISTENT findings. |
| version | 1.1.0 |
| revision_date | "2026-07-25T00:00:00.000Z" |
| license | MIT |
| platforms | ["linux"] |
| compatibility | N/A (analysis methodology) |
| tags | ["meta","wave","delta","comparison","analysis"] |
| category | meta |
| related_skills | ["recon-playbook","cross-attack-chains","cors-credential-wordpress","xmlrpc-exploitation","attack-patterns-reference"] |
Methodology for comparing findings across multiple recon waves on the same target set. Detects NEW findings, REGRESSIONS (previously open now blocked), PERSISTENT vulnerabilities, and CHANGES over time. Distilled from 9 waves across 7 deep targets that revealed missed CORS findings, new port exposures, and infrastructure drift.
${OUTPUT_DIR:-./output}/baseline/.${OUTPUT_DIR:-./output}/current/.# Produce a delta report comparing WaveN to WaveN+1
# Read wave outputs, compare per-target, classify findings
| Category | Label | Meaning | Example |
|---|---|---|---|
| NEW | ++ | Finding that didn't exist in any prior wave | Port 3306 (MySQL) now OPEN |
| REGRESSION | -- | Service that was accessible but is now blocked | XMLRPC 200 -> 405 (hardened) |
| PERSISTENT | == | Vulnerability unchanged across all waves | CORS still reflecting since wave6 |
| CHANGE | ~ | Configuration changed but not a regression | WP users: 10 in wave7, 9 in wave9 |
| REVERSED | -> | A regression that was later undone (mitigation removed) | XMLRPC 405 (W9) -> 200 active (W10) |
Reversed findings are regressions that later reverted to the original vulnerable state. This happens when:
Treat REVERSED as actionable: the security team either doesn't know or doesn't care. These targets are high-priority because their protection is unreliable.
| Field | How to Check | What Delta Means |
|---|---|---|
| XMLRPC status | HTTP status of POST /xmlrpc.php | 200 -> 405 = REGRESSION (hardened) |
| CORS headers | ACAO + ACAC on /wp/v2/users | Reflecting -> No headers = REGRESSION |
| WP Users | Count from /wp/v2/users | Count change = CHANGE |
| Open ports | nmap or naabu output | New port = NEW (surface expanded) |
| Subdomains | subfinder output | New subs = NEW |
| Sensitive paths | HTTP status for .env, info.php, etc | Previously 200 -> 403 = REGRESSION |
WAVE_OLD="${OUTPUT_DIR:-./output}/baseline"
WAVE_NEW="${OUTPUT_DIR:-./output}/current"
echo "=== Comparing $WAVE_OLD vs $WAVE_NEW ==="
For each target present in both waves, compare XMLRPC status, CORS headers, open ports, WP users, and subdomains. Flag findings as NEW (not in prior wave), REGRESSION (previously working, now blocked), PERSISTENT (unchanged), or CHANGE (different but not blocked).
Signal critical deltas: new port 3306 (MySQL), new CORS credential reflections, new WP install pages, new subdomains with admin/staging patterns.
attack-patterns-reference — match findings to pattern IDs (P-01 to P-25)recon-playbook — the 4-phase pipeline that produces wave datacross-attack-chains — chain NEW findings into critical impactcors-credential-wordpress — verify CORS findings classificationxmlrpc-exploitation — verify XMLRPC regression statusFull WSTG-aligned web application pentest — 12-phase methodology from information gathering through reporting, with concrete commands, expected outputs, pitfalls, and verification per phase.
Attack SAML SSO via XSW, signature strip, metadata extract.
Use when two or more verified findings may combine into a higher-impact authorized attack path.
Based on SOC occupation classification
