What problem does it solve? During an authorized red-team engagement, the target's security state changes in response to your testing — SOC teams deploy WAF rules, patch confirmed vulnerabilities, and rate-limit your IPs, while unrelated attackers may be spraying credentials concurrently. Without a disciplined methodology, testers misread these changes as false positives, lose confirmed findings, or miss critical incident-response observations that belong in the final report. ## Core Features & Use Cases - Baseline Fingerprinting and State Diffing: Capture pre-test fingerprints (response timing, sizes, headers, WAF cookies, lockout counts) and diff them against post-test state to surface mid-engagement changes. - Three IR Observation Patterns: Detect mid-engagement WAF rule deployment, active concurrent password-spray attackers (via AADSTS50053 Smart Lockout math), and detection-induced rate limiting or IP blocks. - Finding Templates: Convert each observed state change into a reportable finding with subject, observation, impact, and recommendation sections, including positive client-capability metrics. - Use Case: You confirm a SQL injection at 14:24, but at 14:55 the payload stops reproducing. Instead of retracting the finding, you capture the new state, test WAF-evasion variants, and report both the original vulnerability and the client's 31-minute mitigation response. ## Quick Start Ask the AI to capture a pre-test baseline fingerprint of the target and set up state-change monitoring for the engagement.
