find_continuations
Read-only
When you're STUCK mid-hunt: describe your POSITION — the attacker state/capabilities you hold, stripped of product names — and get the CONTINUATIONS that worked from positions like it, matched against the full disclosed-report BODIES (the concrete step/payload/precondition), not just the distilled card. This is the "I have a messy pile of capabilities, what are my legal moves?" layer.
position: a product-free statement of what you can already do, e.g. "a backend fetches a
user-supplied URL during import/webhook and I can't read the response (blind)", or "I hold a
low-priv token and can store config that is later rendered to an admin". The richer/sharper the
position, the better — vague positions retrieve generic moves.
Optional program: restrict to one program's reports (substring match on handle).
Returns concrete 'move_step' techniques from real reports — including non-obvious cross-class moves
the by-card layer can't surface (e.g. credential-leak-on-redirect, request-smuggling desync). HARD
CONTRACT: every result is status=UNVERIFIED — a LEGAL MOVE, never a confirmed bug. Each carries a
'decisive_check' you must verify against the target (read its code / fire a test) before claiming
anything; the corpus generates the move, the TARGET decides if it survives. Complements
find_attack_approaches (by-card mechanism) — this is the by-step, full-body layer.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| program | No | ||
| position | Yes |