Attack Patterns Reference
This catalog maps observed web and WordPress behavior to the skill that owns
its validation. Pattern IDs are navigation labels. They do not establish
exploitability, severity, prevalence, or a confirmed attack path.
When to Use
- A recon result needs to be classified before focused testing.
- Several verified behaviors may form a candidate attack path.
- A WordPress, CORS, XML-RPC, source-leak, or exposed-service signal needs an
owning validation procedure.
Do not use the catalog as a scanner finding list or a substitute for the
verification section of the owning skill.
Prerequisites
- An authorized target and current scope constraints.
- Captured evidence for the observation being classified.
- The tools and identities required by the selected follow-up skill.
How to Run
- Match the observed behavior to the closest pattern.
- Open the owning skill listed in the table.
- Check its prerequisites and side effects.
- Run the smallest validation and negative control that can falsify the
hypothesis.
- Record the result as observed, inferred, confirmed, or not tested.
Procedure
General Web Patterns
| Pattern |
Initial signal |
Owning skill |
| WordPress user exposure |
REST or author route returns user metadata |
wp-mass-recon |
| Credentialed CORS |
Untrusted origin reflected with credentials |
cors-credential-wordpress |
| XML-RPC methods |
Protocol-valid system.listMethods response |
xmlrpc-exploitation |
| XML-RPC SSRF |
pingback.ping reaches a controlled callback |
xmlrpc-exploitation |
| Public registration |
Registration is enabled |
wp-mass-recon |
| Plugin surface |
REST namespace, asset, or version marker |
wordpress-plugin-hunt |
| Staging difference |
Non-production host has weaker controls |
staging-subdomain-hunt |
| Exposed error log |
Response contains real application errors |
error-log-mining |
| PHPInfo exposure |
PHP configuration page is reachable |
phpinfo-to-rce |
| Source or backup leak |
Response contains repository, configuration, or database content |
source-leak-hunt |
| JavaScript secret candidate |
Bundle contains a credential-shaped value |
js-secrets-extraction |
| Public service |
Non-HTTP or administrative service is internet reachable |
port-service-discovery |
See references/p-patterns.md for the extended
pattern notes.
CORS Variants
| Variant |
Initial signal |
Required validation |
| Origin reflection with credentials |
Untrusted origin plus ACAC: true |
Credentialed browser reads non-public data |
| Null-origin trust |
ACAO: null plus ACAC: true |
Sandboxed browser reads non-public data |
| Wildcard without credentials |
ACAO: * |
Determine whether the response is already public |
| Credentialed preflight |
OPTIONS accepts origin, method, and headers |
Actual request succeeds and browser exposes response |
| Auth-route CORS |
CORS headers appear on a protected route |
Approved session returns readable protected data |
| Plugin-specific CORS |
Only one plugin namespace accepts the origin |
Response contains protected data or performs an authorized test action |
| Environment-specific CORS |
Staging and production policies differ |
Demonstrate impact in the authorized environment |
| Third-party allowlist |
One external service origin is trusted |
Establish control of that origin and protected-data access |
Candidate Attack Paths
These are composition templates, not confirmed findings:
| Path |
Preconditions that must be verified |
| CORS to protected-data read |
Approved session, untrusted origin, browser-readable non-public response |
| XML-RPC SSRF to cloud metadata |
Controlled callback, reachable metadata service, usable secondary impact |
| Open registration to upload |
Approved synthetic account, upload-capable role, executable file path |
| Exposed log to account access |
Current credential material, approved identity, valid authentication control |
| Staging exposure to production impact |
Shared trust boundary, reusable secret or deployment path, explicit scope |
Use cross-attack-chains only after every prerequisite is independently
verified.
Pitfalls
- Historical frequency is not evidence about the current target.
- A product name, version, status code, or header does not prove impact.
- A catch-all route can make sensitive paths appear reachable.
- Public client identifiers and intentionally public APIs are not automatically
credentials or authorization failures.
- Pattern prerequisites change across product and plugin versions.
- An attack path inherits the uncertainty of its weakest step.
Verification
- Match every pattern to captured request and response evidence.
- Run a negative control that distinguishes the result from public or generic
behavior.
- Use a browser for CORS impact; headers alone are insufficient.
- Use a controlled callback for blind SSRF; a protocol status alone is
insufficient.
- Use exact component and prerequisite checks before associating a CVE.
- Report only the impact reproduced within scope.
1---2name: attack-patterns-reference3description: Use when classifying a verified web or WordPress behavior and selecting a related validation skill.4license: MIT5---67# Attack Patterns Reference89This catalog maps observed web and WordPress behavior to the skill that owns10its validation. Pattern IDs are navigation labels. They do not establish11exploitability, severity, prevalence, or a confirmed attack path.1213## When to Use1415- A recon result needs to be classified before focused testing.16- Several verified behaviors may form a candidate attack path.17- A WordPress, CORS, XML-RPC, source-leak, or exposed-service signal needs an18 owning validation procedure.1920Do not use the catalog as a scanner finding list or a substitute for the21verification section of the owning skill.2223## Prerequisites2425- An authorized target and current scope constraints.26- Captured evidence for the observation being classified.27- The tools and identities required by the selected follow-up skill.2829## How to Run30311. Match the observed behavior to the closest pattern.322. Open the owning skill listed in the table.333. Check its prerequisites and side effects.344. Run the smallest validation and negative control that can falsify the35 hypothesis.365. Record the result as observed, inferred, confirmed, or not tested.3738## Procedure3940### General Web Patterns4142| Pattern | Initial signal | Owning skill |43|---|---|---|44| WordPress user exposure | REST or author route returns user metadata | `wp-mass-recon` |45| Credentialed CORS | Untrusted origin reflected with credentials | `cors-credential-wordpress` |46| XML-RPC methods | Protocol-valid `system.listMethods` response | `xmlrpc-exploitation` |47| XML-RPC SSRF | `pingback.ping` reaches a controlled callback | `xmlrpc-exploitation` |48| Public registration | Registration is enabled | `wp-mass-recon` |49| Plugin surface | REST namespace, asset, or version marker | `wordpress-plugin-hunt` |50| Staging difference | Non-production host has weaker controls | `staging-subdomain-hunt` |51| Exposed error log | Response contains real application errors | `error-log-mining` |52| PHPInfo exposure | PHP configuration page is reachable | `phpinfo-to-rce` |53| Source or backup leak | Response contains repository, configuration, or database content | `source-leak-hunt` |54| JavaScript secret candidate | Bundle contains a credential-shaped value | `js-secrets-extraction` |55| Public service | Non-HTTP or administrative service is internet reachable | `port-service-discovery` |5657See [`references/p-patterns.md`](references/p-patterns.md) for the extended58pattern notes.5960### CORS Variants6162| Variant | Initial signal | Required validation |63|---|---|---|64| Origin reflection with credentials | Untrusted origin plus `ACAC: true` | Credentialed browser reads non-public data |65| Null-origin trust | `ACAO: null` plus `ACAC: true` | Sandboxed browser reads non-public data |66| Wildcard without credentials | `ACAO: *` | Determine whether the response is already public |67| Credentialed preflight | OPTIONS accepts origin, method, and headers | Actual request succeeds and browser exposes response |68| Auth-route CORS | CORS headers appear on a protected route | Approved session returns readable protected data |69| Plugin-specific CORS | Only one plugin namespace accepts the origin | Response contains protected data or performs an authorized test action |70| Environment-specific CORS | Staging and production policies differ | Demonstrate impact in the authorized environment |71| Third-party allowlist | One external service origin is trusted | Establish control of that origin and protected-data access |7273### Candidate Attack Paths7475These are composition templates, not confirmed findings:7677| Path | Preconditions that must be verified |78|---|---|79| CORS to protected-data read | Approved session, untrusted origin, browser-readable non-public response |80| XML-RPC SSRF to cloud metadata | Controlled callback, reachable metadata service, usable secondary impact |81| Open registration to upload | Approved synthetic account, upload-capable role, executable file path |82| Exposed log to account access | Current credential material, approved identity, valid authentication control |83| Staging exposure to production impact | Shared trust boundary, reusable secret or deployment path, explicit scope |8485Use `cross-attack-chains` only after every prerequisite is independently86verified.8788## Pitfalls8990- Historical frequency is not evidence about the current target.91- A product name, version, status code, or header does not prove impact.92- A catch-all route can make sensitive paths appear reachable.93- Public client identifiers and intentionally public APIs are not automatically94 credentials or authorization failures.95- Pattern prerequisites change across product and plugin versions.96- An attack path inherits the uncertainty of its weakest step.9798## Verification99100- Match every pattern to captured request and response evidence.101- Run a negative control that distinguishes the result from public or generic102 behavior.103- Use a browser for CORS impact; headers alone are insufficient.104- Use a controlled callback for blind SSRF; a protocol status alone is105 insufficient.106- Use exact component and prerequisite checks before associating a CVE.107- Report only the impact reproduced within scope.
uphiago