Attack Patterns Reference

This catalog maps observed web and WordPress behavior to the skill that owns its validation. Pattern IDs are navigation labels. They do not establish exploitability, severity, prevalence, or a confirmed attack path.

When to Use

• A recon result needs to be classified before focused testing.
• Several verified behaviors may form a candidate attack path.
• A WordPress, CORS, XML-RPC, source-leak, or exposed-service signal needs an owning validation procedure.

Do not use the catalog as a scanner finding list or a substitute for the verification section of the owning skill.

Prerequisites