What problem does it solve? During an authorized red-team engagement, the target's security state changes in response to your testing — a confirmed vulnerability stops reproducing, lockout counts spike, or new WAF headers appear. Without a disciplined methodology, testers misread these shifts as false positives and lose both the original finding and the valuable incident-response observations. ## Core Features & Use Cases - Baseline Fingerprinting and State Diffing: Capture pre-test fingerprints (timing, response size, headers, cookies, lockout counts) and diff them against post-test state to surface significant deltas. - Three IR Observation Patterns: Detect mid-engagement WAF rule deployment, concurrent external password-spray attackers (via AADSTS50053 Smart Lockout analysis), and detection-induced rate limiting or IP blocks. - Finding Templates: Convert each observed state change into a report-ready finding with subject, observation, impact, and recommendation sections, including mitigation-depth assessment (WAF-layer vs code-level fix). - Use Case: You confirm a SQL injection at 14:24, but by 14:55 the payload no longer reproduces. Instead of retracting the finding, you test WAF-evasion variants, document the mitigation timeline, and deliver both the original vulnerability and a positive finding about the client's SOC responsiveness. ## Quick Start Ask the AI to capture a pre-engagement baseline fingerprint of the target and set up state-change monitoring so any mid-engagement patches or attacker activity become documented findings.
