attack-patterns-reference

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Attack Patterns Reference

攻击模式参考

This catalog maps observed web and WordPress behavior to the skill that owns its validation. Pattern IDs are navigation labels. They do not establish exploitability, severity, prevalence, or a confirmed attack path.

本目录将观察到的Web和WordPress行为映射到负责其验证的技能。模式ID为导航标签，它们不代表可利用性、严重性、普遍性或已确认的攻击路径。

When to Use

使用场景

A recon result needs to be classified before focused testing.
Several verified behaviors may form a candidate attack path.
A WordPress, CORS, XML-RPC, source-leak, or exposed-service signal needs an owning validation procedure.

Do not use the catalog as a scanner finding list or a substitute for the verification section of the owning skill.

侦察结果需要在针对性测试前进行分类。
多个已验证的行为可能构成候选攻击路径。
WordPress、CORS、XML-RPC、源代码泄露或暴露服务的信号需要对应的验证流程。

请勿将本目录用作扫描结果列表，或替代所属技能的验证章节。

Prerequisites

前提条件

An authorized target and current scope constraints.
Captured evidence for the observation being classified.
The tools and identities required by the selected follow-up skill.

已授权的目标和当前范围限制。
待分类观察结果的捕获证据。
所选后续技能所需的工具和身份。

How to Run

执行步骤

Match the observed behavior to the closest pattern.
Open the owning skill listed in the table.
Check its prerequisites and side effects.
Run the smallest validation and negative control that can falsify the hypothesis.
Record the result as observed, inferred, confirmed, or not tested.

将观察到的行为与最匹配的模式对应。
打开表格中列出的所属技能。
检查其前提条件和副作用。
运行能够证伪假设的最小验证和阴性对照。
将结果记录为已观察、已推断、已确认或未测试。

Procedure

流程

General Web Patterns

通用Web模式

Pattern	Initial signal	Owning skill
WordPress user exposure	REST or author route returns user metadata	`wp-mass-recon`
Credentialed CORS	Untrusted origin reflected with credentials	`cors-credential-wordpress`
XML-RPC methods	Protocol-valid `system.listMethods` response	`xmlrpc-exploitation`
XML-RPC SSRF	`pingback.ping` reaches a controlled callback	`xmlrpc-exploitation`
Public registration	Registration is enabled	`wp-mass-recon`
Plugin surface	REST namespace, asset, or version marker	`wordpress-plugin-hunt`
Staging difference	Non-production host has weaker controls	`staging-subdomain-hunt`
Exposed error log	Response contains real application errors	`error-log-mining`
PHPInfo exposure	PHP configuration page is reachable	`phpinfo-to-rce`
Source or backup leak	Response contains repository, configuration, or database content	`source-leak-hunt`
JavaScript secret candidate	Bundle contains a credential-shaped value	`js-secrets-extraction`
Public service	Non-HTTP or administrative service is internet reachable	`port-service-discovery`

See

references/p-patterns.md

for the extended pattern notes.

模式	初始信号	所属技能
WordPress用户信息暴露	REST或作者路由返回用户元数据	`wp-mass-recon`
带凭证的CORS	不受信任的源被反射并携带凭证	`cors-credential-wordpress`
XML-RPC方法	协议有效的 `system.listMethods` 响应	`xmlrpc-exploitation`
XML-RPC SSRF	`pingback.ping` 到达受控回调地址	`xmlrpc-exploitation`
公开注册	注册功能已启用	`wp-mass-recon`
插件暴露面	REST命名空间、资源或版本标记	`wordpress-plugin-hunt`
Staging环境差异	非生产主机的控制措施更弱	`staging-subdomain-hunt`
错误日志暴露	响应包含真实应用错误	`error-log-mining`
PHPInfo暴露	PHP配置页面可访问	`phpinfo-to-rce`
源代码或备份泄露	响应包含仓库、配置或数据库内容	`source-leak-hunt`
JavaScript密钥候选	代码包包含凭证格式的值	`js-secrets-extraction`
公开服务	非HTTP或管理服务可通过互联网访问	`port-service-discovery`

扩展模式说明请参见

references/p-patterns.md

。

CORS Variants

CORS变体

Variant	Initial signal	Required validation
Origin reflection with credentials	Untrusted origin plus `ACAC: true`	Credentialed browser reads non-public data
Null-origin trust	`ACAO: null` plus `ACAC: true`	Sandboxed browser reads non-public data
Wildcard without credentials	`ACAO: *`	Determine whether the response is already public
Credentialed preflight	OPTIONS accepts origin, method, and headers	Actual request succeeds and browser exposes response
Auth-route CORS	CORS headers appear on a protected route	Approved session returns readable protected data
Plugin-specific CORS	Only one plugin namespace accepts the origin	Response contains protected data or performs an authorized test action
Environment-specific CORS	Staging and production policies differ	Demonstrate impact in the authorized environment
Third-party allowlist	One external service origin is trusted	Establish control of that origin and protected-data access

变体	初始信号	所需验证
带凭证的源反射	不受信任的源加上 `ACAC: true`	带凭证的浏览器读取非公开数据
信任Null源	`ACAO: null` 加上 `ACAC: true`	沙箱化浏览器读取非公开数据
无凭证的通配符	`ACAO: *`	判断响应是否已公开
带凭证的预检	OPTIONS请求接受源、方法和头	实际请求成功且浏览器暴露响应
认证路由CORS	CORS头出现在受保护路由上	已授权会话返回可读的受保护数据
插件特定CORS	仅一个插件命名空间接受该源	响应包含受保护数据或执行授权测试操作
环境特定CORS	Staging和生产环境的策略不同	在授权环境中证明影响
第三方允许列表	信任一个外部服务源	获得该源的控制权并访问受保护数据

Candidate Attack Paths

候选攻击路径

These are composition templates, not confirmed findings:

Path	Preconditions that must be verified
CORS to protected-data read	Approved session, untrusted origin, browser-readable non-public response
XML-RPC SSRF to cloud metadata	Controlled callback, reachable metadata service, usable secondary impact
Open registration to upload	Approved synthetic account, upload-capable role, executable file path
Exposed log to account access	Current credential material, approved identity, valid authentication control
Staging exposure to production impact	Shared trust boundary, reusable secret or deployment path, explicit scope

Use

cross-attack-chains

only after every prerequisite is independently verified.

这些是组合模板，而非已确认的发现：

路径	必须验证的前提条件
CORS到受保护数据读取	已授权会话、不受信任的源、浏览器可读的非公开响应
XML-RPC SSRF到云元数据	受控回调地址、可访问的元数据服务、可用的二次影响
公开注册到文件上传	已授权的合成账号、具备上传权限的角色、可执行文件路径
暴露日志到账号访问	当前凭证材料、已授权身份、有效的认证控制
Staging环境暴露到生产环境影响	共享信任边界、可复用的密钥或部署路径、明确的范围

仅在所有前提条件都独立验证后，才可使用

cross-attack-chains

。

Pitfalls

注意事项

Historical frequency is not evidence about the current target.
A product name, version, status code, or header does not prove impact.
A catch-all route can make sensitive paths appear reachable.
Public client identifiers and intentionally public APIs are not automatically credentials or authorization failures.
Pattern prerequisites change across product and plugin versions.
An attack path inherits the uncertainty of its weakest step.

历史出现频率不能作为当前目标的证据。
产品名称、版本、状态码或头信息不能证明影响。
通配路由可能使敏感路径看起来可访问。
公开客户端标识符和有意公开的API并非自动视为凭证或授权失败。
模式前提条件会随产品和插件版本变化。
攻击路径的不确定性继承自其最薄弱的环节。

Verification

验证要求

Match every pattern to captured request and response evidence.
Run a negative control that distinguishes the result from public or generic behavior.
Use a browser for CORS impact; headers alone are insufficient.
Use a controlled callback for blind SSRF; a protocol status alone is insufficient.
Use exact component and prerequisite checks before associating a CVE.
Report only the impact reproduced within scope.

将每个模式与捕获的请求和响应证据匹配。
运行阴性对照，区分结果与公开或通用行为。
使用浏览器验证CORS影响；仅靠头信息不足以证明。
使用受控回调验证盲SSRF；仅靠协议状态不足以证明。
在关联CVE前，使用精确的组件和前提条件检查。
仅报告在范围内复现的影响。