What problem does it solve? During an authorized red-team engagement, the target's security state changes in response to your testing — SOC teams deploy WAF rules, patch confirmed vulnerabilities, and rate-limit your IPs. Without a disciplined methodology, testers misinterpret these changes as false positives, lose valid findings, and miss the opportunity to report the client's incident-response capability as a deliverable. ## Core Features & Use Cases - Baseline Fingerprinting: Capture pre-test response timing, sizes, headers, cookies, and lockout counts, then diff against post-test state to surface significant deltas. - Three IR Observation Patterns: Detect mid-engagement WAF rule deployment, concurrent external password-spray attackers (via AADSTS50053 Smart Lockout math), and detection-induced rate limiting or IP blocks. - Finding Templates: Convert each observed state change into a structured report finding covering the original vulnerability, the mitigation timeline, and mitigation depth (WAF-layer vs in-code fix). - Use Case: You confirm a SQL injection at 14:24, but at 14:55 the payload stops reproducing. Instead of retracting the finding, you test WAF-evasion variants, document the mitigation deployment, and report both the original vulnerability and the client's 31-minute detection-to-mitigation response. ## Quick Start Ask the agent to capture a pre-test baseline fingerprint of the target endpoints and monitor for response timing, header, or lockout-count shifts during the engagement, converting any detected changes into findings.
