skills.rest
Wyl-cmd
Wyl-cmdCOMMUNITY
Explore all skills by this author →
GitHub

cross-wave-delta-analysis

Compare recon wave outputs to classify new, regressed, and persistent findings.

6|Updated Jan 31, 2026
Search Tags:#penetration testing#cors#attack surface#recon#delta analysis#xmlrpc#wave comparison
One-click install
npx skills add https://github.com/Wyl-cmd/kxns-cli --skill cross-wave-delta-analysis-wyl-cmd
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cross-wave-delta-analysis
Source: https://github.com/Wyl-cmd/kxns-cli/tree/main/src/kxns_cli/skills/cross-wave-delta-analysis
Command: npx skills add https://github.com/Wyl-cmd/kxns-cli --skill cross-wave-delta-analysis-wyl-cmd

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? When running repeated reconnaissance waves against the same targets, findings pile up across waves and it becomes unclear what is new, what was patched, and what persists. This Skill provides a methodology to diff wave outputs and classify every finding into actionable delta categories. ## Core Features & Use Cases - Delta Classification: Labels each finding as NEW, REGRESSION, PERSISTENT, CHANGE, or REVERSED based on comparison across waves. - Per-Target Comparison: Compares XMLRPC status, CORS headers, open ports, WordPress users, subdomains, and sensitive paths between wave output directories. - Use Case: After completing Wave 9 of a deep recon engagement, compare it against Wave 8 output to discover that MySQL port 3306 newly opened on one target, XMLRPC was hardened on another, and CORS findings were missed on two targets across three prior waves. ## Quick Start Compare the recon output in the wave6 directory against wave7 and produce a per-target delta report classifying each finding as new, regressed, persistent, or changed.

Frequently Asked Questions about cross-wave-delta-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I compare recon results between two scan waves?▼

Gather the output directories from both waves, then compare each target's XMLRPC status, CORS headers, open ports, WordPress users, and subdomains. Classify each difference as NEW, REGRESSION, PERSISTENT, or CHANGE in a per-target delta table.

What is a regression in penetration testing recon?▼

A regression is a service or vulnerability that was previously accessible but is now blocked, such as XMLRPC changing from HTTP 200 to 405 after hardening. Regressions indicate the target's security team applied mitigations between waves.

How can I tell if a 403 response is a real patch or rate limiting?▼

A 403 may be rate limiting rather than an actual fix, causing a false regression. Retry the request three times with different source IPs and delays to confirm the block is consistent before classifying it.

Why do recon waves miss findings like CORS misconfigurations?▼

Findings are missed when only a single endpoint such as /wp/v2/users is tested instead of all endpoints. Consistent methodology across waves is required, otherwise deltas reflect testing gaps rather than real changes.

What does a REVERSED finding mean in delta analysis?▼

A REVERSED finding is a regression that later reverted to the vulnerable state, such as a WAF rule being removed. These targets are high-priority because their protection is unreliable or inconsistently maintained.

Related Skills

Explore More Software Engineering Skills→
stanz-stanzstanz-stanz

network-security

Execute and validate authorized vulnerability scans with structured JSON output.

Community
Advanced
HazaVVIPHazaVVIP

fable-5-report

Compiles red team campaign phase data into an evidence-based assessment report.

Community
Advanced
EntroVyxEntroVyx
3

wordpress-cors-xmlrpc-rce-chain

Identify and exploit WordPress CORS, XMLRPC, and registration chains.

Community
Advanced
HPI-Jimmy-ChiuHPI-Jimmy-Chiu

pt-wave-loop

Automates wave-based C/C++ translation campaigns with census-driven target selection and build gates.

Community
Advanced