用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/uphiago/recon-skills --skill cross-wave-delta-analysis命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | cross-wave-delta-analysis |
| description | Compare recon waves to find NEW, REGRESSED, PERSISTENT findings. |
| version | 1.1.0 |
| revision_date | "2026-07-25T00:00:00.000Z" |
| license | MIT |
| platforms | ["linux"] |
| compatibility | N/A (analysis methodology) |
| tags | ["meta","wave","delta","comparison","analysis"] |
| category | meta |
| related_skills | ["recon-playbook","cross-attack-chains","cors-credential-wordpress","xmlrpc-exploitation","attack-patterns-reference"] |
Methodology for comparing findings across multiple recon waves on the same target set. Detects NEW findings, REGRESSIONS (previously open now blocked), PERSISTENT vulnerabilities, and CHANGES over time. Distilled from 9 waves across 7 deep targets that revealed missed CORS findings, new port exposures, and infrastructure drift.
${OUTPUT_DIR:-./output}/baseline/.${OUTPUT_DIR:-./output}/current/.# Produce a delta report comparing WaveN to WaveN+1
# Read wave outputs, compare per-target, classify findings
| Category | Label | Meaning | Example |
|---|---|---|---|
| NEW | ++ | Finding that didn't exist in any prior wave | Port 3306 (MySQL) now OPEN |
| REGRESSION | -- | Service that was accessible but is now blocked | XMLRPC 200 -> 405 (hardened) |
| PERSISTENT | == | Vulnerability unchanged across all waves | CORS still reflecting since wave6 |
| CHANGE | ~ | Configuration changed but not a regression | WP users: 10 in wave7, 9 in wave9 |
| REVERSED | -> | A regression that was later undone (mitigation removed) | XMLRPC 405 (W9) -> 200 active (W10) |
Reversed findings are regressions that later reverted to the original vulnerable state. This happens when:
Treat REVERSED as actionable: the security team either doesn't know or doesn't care. These targets are high-priority because their protection is unreliable.
| Field | How to Check | What Delta Means |
|---|---|---|
| XMLRPC status | HTTP status of POST /xmlrpc.php | 200 -> 405 = REGRESSION (hardened) |
| CORS headers | ACAO + ACAC on /wp/v2/users | Reflecting -> No headers = REGRESSION |
| WP Users | Count from /wp/v2/users | Count change = CHANGE |
| Open ports | nmap or naabu output | New port = NEW (surface expanded) |
| Subdomains | subfinder output | New subs = NEW |
| Sensitive paths | HTTP status for .env, info.php, etc | Previously 200 -> 403 = REGRESSION |
WAVE_OLD="${OUTPUT_DIR:-./output}/baseline"
WAVE_NEW="${OUTPUT_DIR:-./output}/current"
echo "=== Comparing $WAVE_OLD vs $WAVE_NEW ==="
For each target present in both waves, compare XMLRPC status, CORS headers, open ports, WP users, and subdomains. Flag findings as NEW (not in prior wave), REGRESSION (previously working, now blocked), PERSISTENT (unchanged), or CHANGE (different but not blocked).
Signal critical deltas: new port 3306 (MySQL), new CORS credential reflections, new WP install pages, new subdomains with admin/staging patterns.
attack-patterns-reference — match findings to pattern IDs (P-01 to P-25)recon-playbook — the 4-phase pipeline that produces wave datacross-attack-chains — chain NEW findings into critical impactcors-credential-wordpress — verify CORS findings classificationxmlrpc-exploitation — verify XMLRPC regression status