cross-wave-delta-analysis

What problem does it solve?

When running repeated reconnaissance on the same target set across multiple assessment waves, security teams struggle to track changes in discovered vulnerabilities and infrastructure, identify if flaws have been patched, spot new attack surfaces that emerged between waves, and confirm if existing findings are still valid without manually comparing large volumes of unstructured recon data.

Core Features & Use Cases

• Delta Classification: Automatically categorize changes between recon waves as NEW (previously undiscovered findings), REGRESSION (previously accessible services now blocked), PERSISTENT (unchanged vulnerabilities), CHANGE (configuration shifts without security impact), or REVERSED (previously hardened services reverted to vulnerable states).
• Per-Target Comparison: Compare key recon data points including XMLRPC status, CORS header configurations, open ports, WordPress user counts, and subdomain lists for each target to generate granular change reports.
• Pitfall Mitigation: Includes field-validated guidance to avoid common errors like false regressions from rate limiting, false persistent findings from disabled but live endpoints, and missed findings from incomplete prior wave testing.
• Use Case: After running two waves of recon against a set of e-commerce targets, use this skill to quickly identify that a previously open MySQL port on one target is now closed (regression), that CORS reflections were missed on two targets in prior waves (new findings), and that a hardened XMLRPC endpoint on a third target has been reverted to a vulnerable state (reversed).

Quick Start

Use the cross-wave-delta-analysis skill to compare the structured output files from your two most recent recon waves and generate a categorized report of all new, regressed, persistent, and changed findings.