cross-wave-delta-analysis

name	cross-wave-delta-analysis
description	Compare recon waves to find NEW, REGRESSED, PERSISTENT findings.
version	1.1.0
revision_date	"2026-07-25T00:00:00.000Z"
license	MIT
platforms	["linux"]
compatibility	N/A (analysis methodology)
tags	["meta","wave","delta","comparison","analysis"]
category	meta
related_skills	["recon-playbook","cross-attack-chains","cors-credential-wordpress","xmlrpc-exploitation","attack-patterns-reference"]

Cross-Wave Delta Analysis Skill

Methodology for comparing findings across multiple recon waves on the same target set. Detects NEW findings, REGRESSIONS (previously open now blocked), PERSISTENT vulnerabilities, and CHANGES over time. Distilled from 9 waves across 7 deep targets that revealed missed CORS findings, new port exposures, and infrastructure drift.

When to Use

• Running repeated recon on the same target set (Wave N+1 after Wave N).
• You want to know if a vulnerability was PATCHED since last wave.
• You want to know if a NEW surface appeared (new ports, new subdomains, new endpoints).
• After completing a deep recon wave — produce the delta report before next wave.
• Before reporting — confirm findings are still valid (not regressed).

Prerequisites

• Prior assessment output beneath ${OUTPUT_DIR:-./output}/baseline/.
• Current assessment output beneath ${OUTPUT_DIR:-./output}/current/.
• Structured findings per target (at minimum: ports, CORS status, WP users, XMLRPC status, sensitive paths).

How to Run

# Produce a delta report comparing WaveN to WaveN+1
# Read wave outputs, compare per-target, classify findings

Quick Reference

Delta Categories

Category	Label	Meaning	Example
NEW	++	Finding that didn't exist in any prior wave	Port 3306 (MySQL) now OPEN
REGRESSION	--	Service that was accessible but is now blocked	XMLRPC 200 -> 405 (hardened)
PERSISTENT	==	Vulnerability unchanged across all waves	CORS still reflecting since wave6
CHANGE	~	Configuration changed but not a regression	WP users: 10 in wave7, 9 in wave9
REVERSED	->	A regression that was later undone (mitigation removed)	XMLRPC 405 (W9) -> 200 active (W10)

REVERSED — Special Category

Reversed findings are regressions that later reverted to the original vulnerable state. This happens when: