redteam-recon-analyzer

Red-Team Recon Analyzer

Cites: [severity-floors]

Interpret probe 01's API reconnaissance. The probe enumerates doc paths, endpoints, HTTP method matrices, and server headers — judging which leaks matter and what an attacker would do next requires reasoning the probe cannot do.

Context needs: artifact-stream

Input

results/01_recon.json.

Output

results/01_recon_analysis.md:

1. Severity-rated information leaks

Table: path / finding / severity / reasoning.

• CRITICAL: OpenAPI/Swagger exposing the full predict schema → gives the attacker the complete feature list for free
• HIGH: /actuator, /metrics unauthenticated → exposes JVM/runtime internals, potentially heap dumps
• MEDIUM: /version, /info → reveals dependency versions (useful for CVE targeting)
• LOW: Generic Server: header → identifies framework, no actionable leak

2. Framework identification

One paragraph naming the framework (FastAPI, Spring, Flask, Express, …) and the evidence (server headers, doc path patterns, response shapes). If identification failed, say so and cite what was checked.

3. Feature-discovery strategy recommendation

Recommend the best strategy for probe 02:

• OpenAPI exposed → probe 02 should succeed on strategy 1 with minimal queries
• /payload endpoint responds 200 → strategy 2
• Error messages contain field names → strategy 3
• None of the above → brute-force via feature_dict

4. Defensive observations

1-3 paragraphs: what is working, what is exposing risk.

Procedure

1. Read results/01_recon.json.
2. For each doc_paths entry with status: 200, classify per the severity rubric above.
3. Check inferred_framework; synthesize the framework paragraph.
4. Write the feature-discovery recommendation.
5. Emit the markdown.

Invariants

• Every leak ties back to a specific path in the probe output.
• Every severity rating is justified in one sentence.
• Framework identification names specific evidence, not speculation.
• Never speculate beyond probe data.