Testing playbook · intermediate

Archive to Live Surface Delta

Reconcile historical URLs, parameters, JavaScript, and screenshots with the current in-scope surface while preserving source time, present behavior, and a control for every promoted lead.

waybackcommon-crawlurlscanhistorical-urlssurface-diff

Stable IDplaybook:archive-to-live-surface-deltaSource record date2026-08-20Human reviewNot recordedProvenanceCurated workflow

Detection firstStop as soon as the evidence decisively supports or falsifies the hypothesis.

Every step requires authorization. Review side effects before running commands against a live system.

Method contract

Define the boundary before the test.

Preconditions: Current scope, observed technology, reachable feature, controlled identities or data, and a recovery plan.
Expected evidence: One observable response, state, or callback that distinguishes the hypothesis from normal behavior.
Negative control: The same action with the security-sensitive variable removed, replaced, or bound to its rightful owner.
False-positive checks: Cache, retry, race, reflection, proxy rewriting, stale sessions, and unrelated asynchronous activity.
Chain gate: Record the proven primitive and the next missing prerequisite. Do not expand impact until scope and authorization still permit the next step.

Alternative methods

Choose the evidence path that fits the boundary.

No lane is automatically stronger. Pick the least intrusive path that can distinguish the hypothesis, then confirm through an independent method before reporting.

Passive source merge

The asset graph is incomplete or stale.

Combine certificate transparency, passive DNS or approved APIs, archives, public repositories, and first-party documentation into an append-only source ledger.

Tradeoff: Low target traffic, but historical names, shared infrastructure, and vendor data are candidates rather than current scope.
Advance when: Every candidate retains source and time, then survives live brief, ownership, DNS, and wildcard checks.

Low-rate active confirmation

The live program permits resolution or probing of already approved candidates.

Resolve explicit DNS record types, then probe the current DNS view at a bounded rate for TLS and HTTP state with known wildcard controls.

Tradeoff: Establishes current behavior, but sends traffic and can misclassify shared edges or transient failures.
Advance when: A second resolver or repeat observation supports the state and the asset remains in scope.

Source assisted

Public docs, client code, contracts, archives, or authorized local source can narrow the test.

Extract operation names, routes, fields, versions, and trust decisions without executing untrusted artifacts, then test only the supported live hypothesis.

Tradeoff: Low traffic and high context, but sources can be stale, client-only, generic, or unrelated to the deployed product area.
Advance when: A current in-scope response or operation corroborates the source claim.

Independent replay

A candidate survives its first control and is nearing report status.

Repeat the smallest claim in a fresh session, browser profile, account pair, token set, or second tool while keeping the security-sensitive variable constant.

Tradeoff: Costs another clean setup, but catches cache, session, extension, proxy, and operator confounders.
Advance when: Fresh evidence supports the same primitive without relying on the first tool's interpretation.

Lock scope and archive the query manifest

Record approved roots, exclusions, query time, source URL, source index, filters, and rate budget before collection. Historical presence is evidence that a URL existed in an archive, not that it is live, owned, vulnerable, or currently authorized.

mkdir -p recon/archive/{raw,normalized,current,state}; printf 'source	query	retrieved_at	file
' > recon/archive/state/query-manifest.tsv