Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1595.003_wordlist-scanning
Adversaries may iteratively probe infrastructure using brute-forcing and crawling techniques.
Passed 15 of 23 test cases with the skill, and 7 of 23 without it.
and 9 more in the full report
8 fixed7 passed either way8 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 8 test cases the skill fixed. Same model, same prompt, with and without the skill.
When hardening external web applications against directory enumeration tools like GoBuster or Dirb, security engineers often rely on rate-limiting web application firewalls or IP blocking as primary mitigations. According to standard MITRE ATT&CK mitigation mappings for T1595.003, what specific mitigation codes are assigned to this sub-technique?
| Checked | Without skill | With skill |
|---|---|---|
| The response identifies mitigation code M1042. | Missed | Passed |
| The response identifies mitigation code M1056. | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1595
Adversaries may iteratively probe infrastructure using brute-forcing and crawling techniques. While this technique employs similar methods to Brute Force, its goal is the identification of content and infrastructure rather than the discovery of valid credentials. Wordlists used in these scans may contain generic, commonly used names and file extensions or terms specific to a particular software. Adversaries may also create custom, target-specific wordlists using data gathered from other Reconnaissance techniques (ex: Gather Victim Org Information, or Search Victim-Owned Websites).
For example, adversaries may use web content discovery tools such as Dirb, DirBuster, and GoBuster and generic or custom wordlists to enumerate a website’s pages and directories. This can help them to discover old, vulnerable pages or hidden administrative portals that could become the target of further operations (ex: Exploit Public-Facing Application or Brute Force).
As cloud storage solutions typically use globally unique names, adversaries may also use target-specific wordlists and tools such as s3recon and GCPBucketBrute to enumerate public and private buckets on cloud infrastructure. Once storage objects are discovered, adversaries may leverage Data from Cloud Storage to access valuable information that can be exfiltrated or used to escalate privileges and move laterally.
Platforms: PRE
Identify Attack Surface: Determine if the target environment is susceptible to Wordlist Scanning by examining the target platforms (PRE).
Assess Existing Defenses: Review whether mitigations for T1595.003 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
test cases passed, vs 7 / 23 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.