# Pentest Threat Modeling

> PTES Phase 3 - Threat modeling for AWS security assessments

- Skill: `bob-reis/pentest-threat-modeling` (Agent Skill)
- Install (CLI): `npx skillmds@latest add bob-reis/pentest-threat-modeling`
- Raw SKILL.md: https://api.skillmd.com/api/skills/bob-reis/pentest-threat-modeling/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: bob-reis (https://skillmd.com/u/bob-reis)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/bob-reis/pentest-threat-modeling

---


# PTES Phase 3: Threat Modeling

## 🎯 pfSense Detection & Routing

> **IMPORTANTE:** Se durante o threat modeling você identificar **pfSense** como alvo, **ATIVE A SKILL `pentest-pfsense`** para modelagem específica.

### pfSense Threat Modeling

#### Attack Surface Mapping
```
pfSense Attack Vectors:
├── Web GUI (443/tcp)
│   ├── Authentication bypass
│   ├── Command injection (diag_*.php)
│   ├── XSS (stored/reflected)
│   └── File read/write arbitrary
├── SSH (22/tcp)
│   ├── Brute force
│   └── Terrapin attack (CVE-2023-48795)
├── VPN Services
│   ├── OpenVPN (1194)
│   ├── IPsec (500/4500)
│   └── WireGuard (51820)
├── Packages
│   ├── pfBlockerNG (RCE CVE-2022-40624)
│   ├── Suricata (Path Traversal CVE-2025-12490)
│   └── Snort (File Oracle CVE-2025-34173)
└── HA/CARP
    ├── XMLRPC sync abuse
    └── Config sync injection
```

#### High-Value Targets
- [ ] `/cf/conf/config.xml` - Todas as credenciais e configurações
- [ ] OpenVPN/IPsec credentials - Acesso VPN
- [ ] HA sync credentials - Controle do cluster
- [ ] Package configurations - Persistência

### Ação Imediata
```
# Se pfSense identificado → ATIVAR pentest-pfsense skill
# Esta skill continua para threat modeling geral
# Use pentest-pfsense para:
# - Attack tree específico para firewall
# - Feature-based threat modeling (158 features)
# - CVE prioritization (EPSS/CVSS)
# - Privilege escalation paths
```

---

## Objetivo
Analisar dados coletados para identificar vetores de ataque, alvos de alto valor e caminhos de exploração prioritários, alinhado com PTES Section 3.3 (Attack Avenues) e Section 3.2 (Vulnerability Validation).

## Referências PTES para Threat Modeling

### PTES 3.3 - Attack Avenues
- **3.3.1 Creation of Attack Trees**: Mapear caminhos de exploração
- **3.3.2 Identify protection mechanisms**:
  - 3.3.2.1 Network protections (packet filters, traffic shaping, DLP)
  - 3.3.2.2 Host based protections (stack/heap, whitelisting, AV)
  - 3.3.2.3 Application level protections

### PTES 3.2 - Vulnerability Validation
- **3.2.1 Public Research**: Common/default passwords, CVE research
- **3.2.2 Establish target list**:
  - 3.2.2.1 Mapping Versions
  - 3.2.2.2 Identifying Patch Levels
  - 3.2.2.3 Looking for Weak Web Applications
  - 3.2.2.4 Identify Weak Ports and Services
  - 3.2.2.5 Identify Lockout threshold

---

## Análise de Dados com WorstAssume

### 1. Executar Security Assessment (PTES 3.1 - Vulnerability Testing)

```bash
# Rodar assessment completo (PTES 3.1.2 - Automated Tools)
worst assess

# Assessment com filtro de severidade (PTES 3.1.1 - Active)
worst assess --min-severity HIGH

# Assessment de conta específica
worst assess --account-id 123456789012

# Assessment focado em IAM (PTES 3.2.2.4 - Weak Services)
worst assess --focus iam
```

### 2. Categorias de Ameaças a Modelar (PTES 3.3 - Attack Avenues)

#### WEAK_TRUST - Trust Policies Problemáticas (PTES 3.3.2 - Protection Mechanisms)
- [ ] Roles com `Principal: "*"` (wildcard público)
- [ ] Cross-account trust sem ExternalId
- [ ] Service principals amplos (ex: `sts.amazonaws.com`)
- [ ] Federated trust sem condições sub/aud
- [ ] Root account trust de outras contas

#### PERMISSIVE_POLICY - Permissões Excessivas (PTES 3.2.2.4 - Weak Services)
- [ ] AdministratorAccess attached
- [ ] PowerUserAccess attached
- [ ] IAMFullAccess attached
- [ ] Políticas customizadas com `*:*`
- [ ] Group-based privilege inheritance

#### RESOURCE_WILDCARD - Recursos sem Restrição
- [ ] Write actions em `Resource: "*"`
- [ ] `iam:PassRole` sem restrição de recurso
- [ ] `s3:*` em todos os buckets
- [ ] `secretsmanager:GetSecretValue` global

#### USER_CONFIG - Misconfigurações de Usuário (PTES 3.2.2.5 - Lockout Threshold)
- [ ] Console access sem MFA
- [ ] Access keys > 90 dias
- [ ] Access keys > 365 dias (CRITICAL)
- [ ] Users com múltiplas access keys ativas

#### GROUP_CONFIG - Grupos Perigosos
- [ ] Grupos com AdministratorAccess
- [ ] Grupos com IAM manipulation permissions
- [ ] Group membership escalation paths

### 3. Modelagem de Ameaças por Categoria (PTES 3.3.1 - Attack Trees)

#### A. Ameaças de Identidade (IAM) - PTES 3.3.2.2 Host Based Protections

```
ATTACK VECTOR: IAM Policy Manipulation
├── PATH-001: CreatePolicyVersion → Admin em qualquer policy
├── PATH-002: SetDefaultPolicyVersion → Ativar versão permissiva
├── PATH-003: AttachUserPolicy → Attach admin policy em user
├── PATH-004: AttachRolePolicy → Attach admin policy em role
├── PATH-005: AttachGroupPolicy → Attach admin policy em group
├── PATH-006: PutUserPolicy → Inline policy em user
├── PATH-007: PutRolePolicy → Inline policy em role
├── PATH-008: PutGroupPolicy → Inline policy em group
├── PATH-009: AddUserToGroup → Herdar permissões do grupo
├── PATH-010: UpdateAssumeRolePolicy → Modificar trust policy
├── PATH-011: CreateAccessKey → Criar chave persistente
├── PATH-012: CreateLoginProfile → Criar console access
└── PATH-013: UpdateLoginProfile → Overwrite senha console
```

#### B. Ameaças de PassRole - PTES 3.3.2.3 Application Level Protections

```
ATTACK VECTOR: PassRole + Compute Services
├── PATH-015: EC2 RunInstances → Roubar creds via IMDS
├── PATH-016: Lambda CreateFunction → Executar como role
├── PATH-018: Lambda EventSourceMapping → Trigger automático
├── PATH-021: Glue CreateDevEndpoint → SSH + creds
├── PATH-023: CloudFormation CreateStack → Service role abuse
├── PATH-024: DataPipeline CreatePipeline → Shell activity
├── PATH-025: SageMaker CreateNotebook → Notebook com creds
└── PATH-027: CodeStar CreateProject → Project role abuse
```

#### C. Ameaças de Resource Abuse - PTES 3.3.2.1 Network Protections

```
ATTACK VECTOR: Resource-Based Lateral Movement
├── PATH-014: IMDSv1 → Roubar instance role
├── PATH-019: Lambda UpdateFunctionCode → Inject code
├── PATH-020: Lambda UpdateConfiguration → Malicious layer
├── PATH-022: Glue UpdateDevEndpoint → SSH key injection
├── PATH-026: SageMaker CreatePresignedUrl → Hijack session
├── PATH-030: AssumeRole (same-account) → Assumir role
├── PATH-031: AssumeRole (cross-account) → Pivot conta
├── PATH-032: SSM SendCommand → RCE via Run Command
├── PATH-033: EC2 Instance Connect → SSH via public key
├── PATH-035: S3 PutBucketPolicy → Access bucket externo
├── PATH-036: SecretsManager GetSecretValue → Harvest creds
└── PATH-037: ECS Task Metadata → Roubar task role
```

#### D. Ameaças de Defensive Blinding - PTES 3.3.2 - Identify Protection Mechanisms

```
ATTACK VECTOR: Blindar Defesas
└── PATH-042: CloudTrail StopLogging / GuardDuty DeleteDetector
```

#### E. Ameaças de Network-Based Attacks - PTES 3.3.2.1 Network Protections

```
ATTACK VECTOR: Network Scanning e Firewall Bypass (hping3)
├── Network Reconnaissance
│   ├── Host discovery via SYN scan
│   ├── Port scanning com flags customizadas
│   └── Firewall ruleset mapping
├── IDS/IPS Evasion
│   ├── XMAS scan (-FPU flags)
│   ├── NULL scan (sem flags)
│   ├── Fragmented packets (-f)
│   └── Random source IP (--rand-source)
├── Covert Channels
│   ├── ICMP tunneling (-1 -d <size>)
│   └── Beaconing simulation (-i <interval>)
└── Lateral Movement
    ├── Internal network pivoting
    ├── Database port discovery (3306, 5432, 1433)
    └── SMB/NetBIOS enumeration (445, 139)
```

### Network Threat Model com hping3 (PTES 3.3.1 - Attack Trees)

```
ATTACK TREE: Network Compromise via hping3
Root: Obter acesso à rede interna
├── Branch 1: Host Discovery
│   ├── SYN scan em subnet (-S -p <port> --scan)
│   ├── ICMP discovery (-1)
│   └── UDP scan (-2 -p 53)
├── Branch 2: Firewall Analysis
│   ├── ACK scan para stateless detection (-A)
│   ├── SYN scan para stateful detection (-S)
│   └── TTL analysis para OS fingerprinting (-t)
├── Branch 3: IDS Evasion
│   ├── Fragmentation (-f)
│   ├── XMAS scan (-F -P -U)
│   ├── NULL scan (-O)
│   └── Source spoofing (-a, --rand-source)
└── Branch 4: Lateral Movement
    ├── Internal port scanning
    ├── Database discovery
    └── SMB/NetBIOS enumeration
```

### 4. Criação de Attack Trees (PTES 3.3.1 - Creation of Attack Trees)

#### Attack Tree 1: Privilege Escalation to Admin
```
Root: Obter AdministratorAccess
├── Branch 1: IAM Policy Modification
│   ├── PATH-001: CreatePolicyVersion
│   ├── PATH-003: AttachUserPolicy
│   └── PATH-009: AddUserToGroup
├── Branch 2: Credential Creation
│   ├── PATH-011: CreateAccessKey
│   └── PATH-012: CreateLoginProfile
└── Branch 3: Role Assumption
    ├── PATH-030: AssumeRole (same-account)
    └── PATH-031: AssumeRole (cross-account)
```

#### Attack Tree 2: Cross-Account Compromise
```
Root: Comprometer Conta Secundária
├── Branch 1: Wildcard Trust Abuse
│   └── PATH-031: AssumeRole com Principal: *
├── Branch 2: Credential Harvesting
│   └── PATH-036: SecretsManager GetSecretValue
└── Branch 3: PassRole Attack
    ├── PATH-016: Lambda CreateFunction
    └── PATH-023: CloudFormation CreateStack
```

#### Attack Tree 3: Data Exfiltration
```
Root: Exfiltrar Dados Sensíveis
├── Branch 1: S3 Access
│   └── PATH-035: S3 PutBucketPolicy
├── Branch 2: Secret Access
│   └── PATH-036: SecretsManager GetSecretValue
└── Branch 3: Database Access
    └── PATH-032: SSM SendCommand → RDS access
```

### 5. Análise de Cadeias de Ataque (7 Famílias) - PTES 3.3.1

#### Family I - IAM Self-Modification
```
CreatePolicy + AttachUserPolicy → Self Admin Escalation
CreatePolicy + AttachRolePolicy → Role Privilege Escalation
```

#### Family II - PassRole + Compute Service
```
PassRole + Lambda → Steal Execution Role
PassRole + EC2 → IMDS Credential Theft
PassRole + CloudFormation → IAM User Creation
PassRole + ECS → Task Role Theft
PassRole + Glue → Code Execution
PassRole + SageMaker → Container Execution
PassRole + CodeBuild → Shell Execution
```

#### Family III - Compute Credential Theft
```
SSM SendCommand → Instance Profile Theft
EC2 ModifyUserData → Credential Exfil via UserData
Lambda UpdateCode → Execution Role Theft
ECS UpdateService → Task Role Theft
```

#### Family IV - Secret Exfiltration → Credential Reuse
```
SecretsManager GetSecretValue → IAM Key Reuse
SSM GetParameter → Credential Theft
Lambda GetFunction → Env Variable Secrets
S3 GetObject → Credential Files (.aws/credentials, id_rsa)
```

#### Family V - Account Takeover
```
UpdateLoginProfile → Console Takeover
MFA Bypass + UpdateLogin → Takeover sem MFA
CreateAccessKey → Persistent Admin Access
UpdateAssumeRolePolicy + AssumeRole → Role Takeover
```

#### Family VI - Group Membership
```
AddUserToGroup → Join High-Privilege Group
PutGroupPolicy + AddUserToGroup → Self-Escalation via Group
```

#### Family VII - Cross-Account Lateral Movement
```
WildcardTrust → Any Principal Assumes High-Priv Role
CrossAccount Trust → Dangerous Role → Lateral Movement
```

### 6. Identificação de Mecanismos de Proteção (PTES 3.3.2)

#### Network Protections (PTES 3.3.2.1)
- [ ] VPC Flow Logs habilitados
- [ ] Security Groups restritivos
- [ ] NACLs configurados
- [ ] VPC Endpoints para serviços AWS
- [ ] Transit Gateway com inspeção

#### Host Based Protections (PTES 3.3.2.2)
- [ ] IMDSv2 forçado (bloqueia IMDSv1)
- [ ] SSM Session Manager (sem SSH direto)
- [ ] GuardDuty habilitado
- [ ] CloudTrail em todas as regiões
- [ ] Config Rules ativas

#### Application Level Protections (PTES 3.3.2.3)
- [ ] SCPs (Service Control Policies)
- [ ] Permission Boundaries
- [ ] MFA obrigatório para ações críticas
- [ ] ExternalId para cross-account
- [ ] Resource-based policies restritivas

### 7. Priorização de Ameaças por Impacto (PTES 3.2 - Vulnerability Validation)

#### CRITICAL (Exploração Imediata) - PTES 3.2.2 Establish Target List
- [ ] Wildcard trust policies (`Principal: "*"`)
- [ ] IAMFullAccess + CreatePolicyVersion
- [ ] UpdateLoginProfile em admin users
- [ ] PassRole + CloudFormation/CreateStack
- [ ] Cross-account wildcard trust

#### HIGH (Exploração Prioritária)
- [ ] AdministratorAccess attached
- [ ] Console access sem MFA
- [ ] PassRole + Lambda/EC2/ECS
- [ ] SSM SendCommand em EC2
- [ ] SecretsManager GetSecretValue global

#### MEDIUM (Exploração Secundária)
- [ ] Access keys > 90 dias
- [ ] IMDSv1 habilitado
- [ ] Group-based escalation
- [ ] Resource wildcard permissions

### 8. Mapeamento de Alvos de Alto Valor (PTES 3.2.2 - Establish Target List)

#### Crown Jewels (Alvos Críticos) - PTES 3.2.2.1 Mapping Versions
- [ ] IAM Admin roles/users
- [ ] Root account equivalents
- [ ] Secrets Manager com creds produção
- [ ] KMS keys mestras
- [ ] Cross-account hub roles

#### Dados Sensíveis - PTES 3.2.2.3 Looking for Weak Applications
- [ ] S3 buckets com dados sensíveis
- [ ] RDS databases
- [ ] DynamoDB tables críticos
- [ ] EBS snapshots sensíveis

#### Controle de Infraestrutura - PTES 3.2.2.4 Identify Weak Ports/Services
- [ ] CloudFormation stacks
- [ ] Lambda functions críticas
- [ ] ECS/EKS clusters produção
- [ ] VPC networking core

### 9. Matriz de Ameaças por Serviço (PTES 3.3 - Attack Avenues)

| Serviço | Ameaça Principal | Impacto | Probabilidade | PATH-IDs |
|---------|------------------|---------|---------------|----------|
| IAM | Privilege Escalation | CRITICAL | Alta | 001-013 |
| EC2 | Instance Profile Theft | HIGH | Alta | 014, 015 |
| Lambda | Execution Role Abuse | HIGH | Alta | 016, 018-020 |
| S3 | Data Exfiltration | HIGH | Média | 035 |
| Secrets Manager | Credential Harvest | CRITICAL | Média | 036 |
| ECS | Task Role Theft | HIGH | Média | 037 |
| CloudFormation | Service Role Abuse | CRITICAL | Baixa | 023 |
| SSM | Lateral Movement | HIGH | Média | 032 |
| Glue | Code Execution | HIGH | Baixa | 021, 022 |
| SageMaker | Container Execution | HIGH | Baixa | 025, 026 |

### 10. Output da Fase de Threat Modeling (PTES Deliverables)

#### Documento de Threat Model (PTES 3.3.1 - Attack Trees)
```
1. IDENTIDADE INICIAL (PTES 2.5 - Footprinting)
   - ARN: arn:aws:iam::123456789012:user/auditor
   - Permissões: [Lista]
   - Restrições: [Lista]

2. VETORES PRIORITÁRIOS (PTES 3.3 - Attack Avenues)
   - Vetor 1: [Descrição + PATH-ID]
   - Vetor 2: [Descrição + PATH-ID]
   - Vetor 3: [Descrição + PATH-ID]

3. ALVOS DE ALTO VALOR (PTES 3.2.2 - Target List)
   - Alvo 1: [ARN + Justificativa]
   - Alvo 2: [ARN + Justificativa]

4. ATTACK TREES (PTES 3.3.1 - Creation of Attack Trees)
   - Tree 1: [Root + Branches]
   - Tree 2: [Root + Branches]

5. CADEIAS DE ATAQUE IDENTIFICADAS (7 Famílias)
   - Chain 1: [Family + Steps]
   - Chain 2: [Family + Steps]

6. MECANISMOS DE PROTEÇÃO (PTES 3.3.2)
   - Network: [Lista]
   - Host: [Lista]
   - Application: [Lista]

7. PRIORIZAÇÃO (PTES 3.2 - Vulnerability Validation)
   - Critical: [Lista]
   - High: [Lista]
   - Medium: [Lista]
```

## Próximos Passos
Após completar esta fase, prossiga para **pentest-vulnerability-analysis** (PTES Section 3)

---

## 🤖 AIRecon Integration for Threat Modeling

AIRecon é um agente autônomo de penetration testing (v0.1.7-beta) que pode ser invocado como ferramenta incremental durante threat modeling para automatizar análise de CVEs, construção de attack trees, e priorização de vulnerabilidades.

### Invocando AIRecon para Threat Modeling

```bash
# AIRecon com keywords de threat modeling e attack analysis
airecon "pentest threat modeling aws iam attack trees"

# AIRecon detectará keywords e carregará:
# - pentest-threat-modeling.md (skill primária)
# - pentest-vulnerability-analysis.md (para CVE analysis)
# - MCP tools: cve-mcp, hexstrike, worstassume

# Para pfSense-specific threat modeling:
airecon "pfsense threat modeling attack tree 2.7.0"

# Para attack chain analysis:
airecon "analyze attack chains privilege escalation aws"
```

### AIRecon Slash Commands Úteis para Threat Modeling

```bash
# CVE lookup e EPSS scoring
# AIRecon buscará CVEs relevantes e calculará risk scores
airecon "check CVE-2026-41940 risk score"

# Network scanning para identificar alvos
/naabu-scan --target target.com -p 443,8443

# API key discovery para credential exposure analysis
/api-keys --target ./src --recursive
```

### MCP Tool Integration via AIRecon

Durante threat modeling, AIRecon pode invocar MCP tools automaticamente:

```bash
# cve-mcp: CVE lookup, EPSS scores, KEV status, risk calculation
airecon "get CVE summary for CVE-2026-41940"
# → Usará mcp__cve-mcp__get_cve_summary

airecon "calculate risk score for CVE-2026-31431"
# → Usará mcp__cve-mcp__calculate_risk_score

airecon "check if CVE-2026-41940 is in CISA KEV catalog"
# → Usará mcp__cve-mcp__check_kev

airecon "get EPSS scores for CVE-2026-41940,CVE-2026-31431"
# → Usará mcp__cve-mcp__get_epss_score

airecon "compare CVEs CVE-2026-41940 and CVE-2026-31431"
# → Usará mcp__cve-mcp__compare_cves

# hexstrike-local: Vulnerability scanning para validation
airecon "run nuclei scan on target.com for CVE detection"
# → Usará mcp__hexstrike-local__nuclei_scan

airecon "run nikto vulnerability scan on https://target.com"
# → Usará mcp__hexstrike-local__nikto_scan

# pentestswarm-remote: Automated threat modeling campaigns
airecon "start threat modeling campaign for target.com"
# → Usará mcp__pentestswarm-remote__start_campaign
```

### Workflow Example: Threat Modeling com AIRecon + WorstAssume + CVE-MCP

```bash
# 1. Usar AIRecon para carregar threat modeling skill
airecon "pentest threat modeling aws"

# 2. AIRecon auto-carrega pentest-threat-modeling.md

# 3. Invocar WorstAssume para security assessment
airecon "run worst assume --min-severity HIGH"

# 4. Para cada CVE identificada, AIRecon buscará automaticamente:
#    - EPSS score (probabilidade de exploração)
#    - KEV status (CISA Known Exploited Vulnerabilities)
#    - PoC availability (GitHub, Exploit-DB)
#    - Risk score composto (0-100)

airecon "analyze CVEs found and prioritize by risk"

# 5. AIRecon gera attack trees baseados nas vulnerabilidades
# 6. Exportar threat model para relatório
airecon "export threat model to JSON"
```

### Workflow Example: pfSense Threat Modeling com AIRecon

```bash
# 1. Identificar versão do pfSense
airecon "shodan search product:pfsense org:target"

# 2. Buscar CVEs para versão detectada
airecon "search CVEs for pfSense 2.7.0 severity CRITICAL"
# → Usará mcp__cve-mcp__search_cves

# 3. Para cada CVE, calcular risk score
airecon "calculate risk score CVE-2022-40624"  # pfBlockerNG RCE
airecon "calculate risk score CVE-2025-12490"  # Suricata Path Traversal

# 4. Verificar exploit availability
airecon "check exploit availability CVE-2022-40624"
# → Usará mcp__cve-mcp__check_exploit_availability

# 5. Gerar attack tree específico para pfSense
airecon "generate attack tree for pfSense 2.7.0"

# 6. Exportar threat model
airecon "export pfsense threat model"
```

### AIRecon Auto-Skill Loading para Threat Modeling

| Keywords Detectadas | Skills Carregadas | MCP Tools Ativados |
|---------------------|-------------------|---------------------|
| `threat model` `attack tree` | pentest-threat-modeling | cve-mcp, hexstrike |
| `cve` `vulnerability` | pentest-vulnerability-analysis | cve-mcp, pentestswarm |
| `pfsense` `firewall` | pentest-pfsense, pentest-threat-modeling | cve-mcp, shodan |
| `privilege escalation` | pentest-threat-modeling, pentest-exploitation | worstassume, hexstrike |
| `lateral movement` | pentest-threat-modeling | worstassume, pentestswarm |
| `aws iam` | pentest-threat-modeling | worstassume, cve-mcp |

### AIRecon CVE Risk Prioritization

AIRecon usa o cve-mcp para priorizar vulnerabilidades automaticamente:

```bash
# AIRecon calcula risk score composto (0-100) baseado em:
# - CVSS score (severity base)
# - EPSS score (exploit probability)
# - KEV status (actively exploited)
# - PoC availability (exploit maturity)

airecon "prioritize CVEs by risk score"
# Output exemplo:
# 1. CVE-2026-41940 (cPanel) - Risk: 98/100 - CRITICAL
#    CVSS: 9.8, EPSS: 0.85, KEV: Yes, PoC: Available
# 2. CVE-2026-31431 (Linux LPE) - Risk: 92/100 - CRITICAL
#    CVSS: 8.4, EPSS: 0.72, KEV: No, PoC: Available
# 3. CVE-2022-40624 (pfBlockerNG) - Risk: 87/100 - HIGH
#    CVSS: 9.8, EPSS: 0.45, KEV: No, PoC: Available
```

### AIRecon Attack Chain Generation

```bash
# AIRecon gera attack chains automaticamente
airecon "discover attack chains for Apache HTTP Server 2.4"
# → Usará mcp__hexstrike-local__discover_attack_chains

# Output: Multi-stage attack chains com:
# - Vulnerability combinations
# - Success probability estimates
# - Exploit availability status
# - Recommended exploitation order
```

### AIRecon + WorstAssume Integration

```bash
# 1. WorstAssume enumera IAM e identifica vulnerabilidades
airecon "worst enumerate --profile my-profile --stealth"

# 2. AIRecon processa findings do WorstAssume
# 3. Para cada finding, AIRecon mapeia PATH-IDs
airecon "map findings to PATH-IDs"

# 4. AIRecon gera attack chains baseadas em PATH-IDs
airecon "generate attack chains from PATH-001,PATH-015,PATH-036"

# 5. Exportar attack chains para relatório
airecon "export attack chains to JSON"
```

---

## Referências PTES
- **PTES Section 3**: Vulnerability Analysis
- **PTES 3.1**: Vulnerability Testing (Active, Passive, Automated Tools)
- **PTES 3.2**: Vulnerability Validation (Public Research, Target List)
- **PTES 3.3**: Attack Avenues (Attack Trees, Protection Mechanisms)