attack-patterns-reference

1# Attack Patterns Reference
2 
3This catalog maps observed web and WordPress behavior to the skill that owns
4its validation. Pattern IDs are navigation labels. They do not establish
5exploitability, severity, prevalence, or a confirmed attack path.
6 
7## When to Use
8 
9- A recon result needs to be classified before focused testing.
10- Several verified behaviors may form a candidate attack path.
11- A WordPress, CORS, XML-RPC, source-leak, or exposed-service signal needs an
12  owning validation procedure.
13 
14Do not use the catalog as a scanner finding list or a substitute for the
15verification section of the owning skill.
16 
17## Prerequisites
18 
19- An authorized target and current scope constraints.
20- Captured evidence for the observation being classified.
21- The tools and identities required by the selected follow-up skill.
22 
23## How to Run
24 
251. Match the observed behavior to the closest pattern.
262. Open the owning skill listed in the table.
273. Check its prerequisites and side effects.
284. Run the smallest validation and negative control that can falsify the
29   hypothesis.
305. Record the result as observed, inferred, confirmed, or not tested.
31 
32## Procedure
33 
34### General Web Patterns
35 
36| Pattern | Initial signal | Owning skill |
37|---|---|---|
38| WordPress user exposure | REST or author route returns user metadata | `wp-mass-recon` |
39| Credentialed CORS | Untrusted origin reflected with credentials | `cors-credential-wordpress` |
40…