An attack path is a chain of related misconfigurations across layers that, together, represent a more exploitable risk than any individual finding in isolation.
Why Attack Paths Matter
A single FAIL result tells you one thing is wrong. An attack path tells you that two or more wrong things combine into something an attacker can realistically use. This is the difference between a finding and a threat.
How Detection Works
The attack_paths method in ScanResult evaluates predefined chains using set intersection on the set of failing check IDs. If all checks in a chain are failing, the chain is reported as an active attack path.
Defined Attack Paths
| Path Name | Chain | Risk Level |
|---|---|---|
| Session Hijack / Account Takeover | APP-DEBUG-001 + APP-COOKIE-001 + APP-RATE-001 | MEDIUM |
| Information Leakage via Debug | APP-DEBUG-001 + WS-SRV-001 | LOW |
| Container Escape to Host | CONT-USER-001 + HOST-SSH-001 | HIGH |
| Credential Exposure | CONT-SEC-001 + HOST-SSH-001 | HIGH |
| TLS Downgrade | WS-HSTS-001 + WS-TLS-001 | MEDIUM |
| Brute Force Path | APP-RATE-001 + APP-PASS-001 + HOST-FW-001 | MEDIUM |
Reading an Attack Path Warning
⚠️ ACTIVE ATTACK PATH [MEDIUM]
APP-DEBUG-001 Debug mode enabled
↓ exposes internal routes and stack traces
APP-COOKIE-001 Session cookies lack HttpOnly flag
↓ XSS can steal session token if triggered
APP-RATE-001 No rate limiting
↓ login endpoint can be brute-forced
Combined risk: credible path to account takeover
After Remediation
On the controlled evaluation target (Target 1), fixing the Day 1 checks reduced the active attack path count from 1 to 0. The path count is displayed prominently in the scan header and PDF executive summary precisely because it is more actionable than a raw score — zero attack paths means no credible exploit chain exists, regardless of what else is still failing.