uphiago/recon-skills

401-403-bypass-techniques

Use when protected HTTP routes return 401 or 403.

subdomain-enumeration

Map subdomains via crt.sh and subfinder at recon kickoff.

hunt-xss

Hunting skill for xss vulnerabilities. Built from 174 public bug bounty reports. Use when hunting xss on any target.

wstg-web-pentest

Full WSTG-aligned web application pentest — 12-phase methodology from information gathering through reporting, with concrete commands, expected outputs, pitfalls, and verification per phase.

offensive-osint

Operational arsenal for authorized external red-team and bug-bounty recon. Concrete probes, wordlists, regexes, dorks, curl one-liners for: subdomain enum, GraphQL/Swagger/REST discovery, identity fabric (Entra/Okta/ADFS/Google/SAML/M365 deep —…

saml-sso-attack

Attack SAML SSO via XSW, signature strip, metadata extract.

cross-attack-chains

Use when two or more verified findings may combine into a higher-impact authorized attack path.

wordpress-full-compromise

Use when verified WordPress findings may combine into an authorized path to administrative or server control.

docker-privesc

Escape Docker containers to host root via 5 techniques.

attack-patterns-reference

Use when classifying a verified web or WordPress behavior and selecting a related validation skill.

cross-wave-delta-analysis

Compare recon waves to find NEW, REGRESSED, PERSISTENT findings.

recon-playbook

Use when starting or restructuring an authorized external web and API assessment.

api-noauth-hunt

Use when an API may expose data or privileged operations without authentication.

deep-invade

Deep pentest WP: SSRF, plugin CVE, JS mine, port scan chain.

error-log-mining

Mine error_log for creds, paths, SQL when leak hunt finds.

exchange-owa-attack

Exchange/OWA NTLM AD leak, spray attack when mail subdomain.

firebase-supabase-attack

Exploit Firebase/Supabase for data via JS config leak probe.

flask-werkzeug-attack

Exploit Flask/Werkzeug debugger exposure for traceback and SECRET leaks.

gitlab-public-recon

Mine GitLab for secrets, CI tokens when subdomain found.

iot-camera-recon

Attack cameras via RTSP, ONVIF, Axis config when 554 open.

js-secrets-extraction

Analyze JS bundles and source maps for hardcoded secrets, API keys, JWTs, and internal endpoints

jwt-attack

Decode, forge, brute JWTs when Bearer auth header is seen.

phpinfo-to-rce

Chain phpinfo to RCE via exec check when info.php exposed.

port-mass-scan

Port scan /8-/24 with Masscan+RustScan and nmap banners.

port-service-discovery

Nmap scan for MySQL, Redis, FTP, SSH, internal API services.

staging-subdomain-hunt

Hunt staging via crt.sh when production is WAF-hardened.

web-enumeration

Sensitive file scanning, path traversal bypass, vHost enum, .env extract, log mining, Varnish detect

wordpress-plugin-hunt

Hunt WP plugins via REST, exploit CVEs when version known.

wp-mass-recon

Batch WP recon: users, CORS, XMLRPC, leaks across domains.

wp-plugin-rest-auth-bypass

Scan WordPress REST API plugin endpoints for unauthenticated state-changing operations — discover write endpoints (POST/PUT/PATCH/DELETE) exposed without auth, enumerate all plugin routes, and test for unauthorized content publishing, settings modification,…

xmlrpc-exploitation

Exploit XMLRPC multicall, pingback for brute force and SSRF.

zimbra-attack

Zimbra SOAP user enum, CVE-2022-37042, SSRF when webmail.

cors-chain-automation

Use when a bounded list of authorized API endpoints needs consistent CORS triage before browser validation.

evidence-hygiene

Evidence-capture and PoC-redaction discipline for bug-bounty submissions: cookie redaction protocol (which fields to mask, Preview annotation / Burp panel hiding / DevTools workflow), PII black-bar discipline (what to mask in other-user data — names, emails,…

hunt-cors

Hunt CORS Misconfiguration — origin-reflection with credentials, null-origin trust, subdomain-regex bypass (unanchored vs unescaped-dot vs prefix-only), pre-flight (OPTIONS) gating bypass, postMessage origin checks. High only when an attacker-controlled…

hunt-wordpress

Use when an authorized target exposes WordPress core, plugin, theme, REST, or XML-RPC behavior.

llm-prompt-injection

Use when testing an authorized LLM application for prompt injection, system-prompt exposure, unsafe tool use, or RAG data-boundary failures.

recon-sector-expansion

Multi-sector batch domain expansion — identify untested/under-tested sectors, generate candidate company domains (national chains, franchises, regionals), filter against existing test coverage, probe alive domains, and run the full testing pipeline across 20+…

recon-sector

Parameterized sector recon using sector database.

report-writing

Bug bounty report writing for H1/Bugcrowd/Intigriti/Immunefi — report templates, human tone guidelines, impact-first writing, CVSS 3.1 scoring, title formula, impact statement formula, severity decision guide, downgrade counters, pre-submit checklist. Use…