What problem does it solve?
It helps you detect and document meaningful security-state changes that occur during an authorized red-team engagement, so you can produce auditable findings instead of retracting or dismissing evidence when signals disappear after a client patch or active defense deployment.
Core Features & Use Cases
- Baseline-before / diff-after capture: Records timing, response size, headers/cookies, and lockout-state indicators prior to active testing, then computes deltas observed mid-session.
- Mid-engagement mitigation finding templates: Classifies what changed (e.g., WAF rule deployment vs deeper code mitigation) by rechecking and validating whether WAF-evasion variants restore signals.
- Active attacker detection via identity/lockout behavior: Uses differential lockout accumulation to infer concurrent external credential-spray activity during your engagement window.
- Rate limiting / IP block operational notes: Identifies per-IP defensive controls like 403/429/handshake issues and captures rotation-based confirmations for low to informational reporting.
- Use Case: If a confirmed SQLi stops reproducing after the client applies a fix within minutes, you can keep the original vulnerability evidence and add a second deliverable about the defensive action and its likely depth.
Quick Start
Use this skill when your confirmed-vulnerable behavior no longer reproduces during active engagement and your target’s timing, headers/cookies, response sizes, or lockout rates change mid-session, and then run a recheck while capturing a before/after state diff for evidence.
