Menu
SkillsMP has collected 145 skills from uphiago/recon-skills. Open a skill to review its source and details.
Showing 40 of 145 collected skills.
Full WSTG-aligned web application pentest — 12-phase methodology from information gathering through reporting, with concrete commands, expected outputs, pitfalls, and verification per phase.
Attack SAML SSO via XSW, signature strip, metadata extract.
Use when two or more verified findings may combine into a higher-impact authorized attack path.
Use when verified WordPress findings may combine into an authorized path to administrative or server control.
Escape Docker containers to host root via 5 techniques.
Use when classifying a verified web or WordPress behavior and selecting a related validation skill.
Compare recon waves to find NEW, REGRESSED, PERSISTENT findings.
Use when starting or restructuring an authorized external web and API assessment.
Use when an API may expose data or privileged operations without authentication.
Deep pentest WP: SSRF, plugin CVE, JS mine, port scan chain.
Mine error_log for creds, paths, SQL when leak hunt finds.
Exchange/OWA NTLM AD leak, spray attack when mail subdomain.
Exploit Firebase/Supabase for data via JS config leak probe.
Exploit Flask/Werkzeug debugger exposure for traceback and SECRET leaks.
Mine GitLab for secrets, CI tokens when subdomain found.
Attack cameras via RTSP, ONVIF, Axis config when 554 open.
Analyze JS bundles and source maps for hardcoded secrets, API keys, JWTs, and internal endpoints
Decode, forge, brute JWTs when Bearer auth header is seen.
Chain phpinfo to RCE via exec check when info.php exposed.
Port scan /8-/24 with Masscan+RustScan and nmap banners.
Nmap scan for MySQL, Redis, FTP, SSH, internal API services.
Hunt staging via crt.sh when production is WAF-hardened.
Sensitive file scanning, path traversal bypass, vHost enum, .env extract, log mining, Varnish detect
Hunt WP plugins via REST, exploit CVEs when version known.
Batch WP recon: users, CORS, XMLRPC, leaks across domains.
Scan WordPress REST API plugin endpoints for unauthenticated state-changing operations — discover write endpoints (POST/PUT/PATCH/DELETE) exposed without auth, enumerate all plugin routes, and test for unauthorized content publishing, settings modification,…
Exploit XMLRPC multicall, pingback for brute force and SSRF.
Zimbra SOAP user enum, CVE-2022-37042, SSRF when webmail.
Use when a bounded list of authorized API endpoints needs consistent CORS triage before browser validation.
Evidence-capture and PoC-redaction discipline for bug-bounty submissions: cookie redaction protocol (which fields to mask, Preview annotation / Burp panel hiding / DevTools workflow), PII black-bar discipline (what to mask in other-user data — names, emails,…
Hunt CORS Misconfiguration — origin-reflection with credentials, null-origin trust, subdomain-regex bypass (unanchored vs unescaped-dot vs prefix-only), pre-flight (OPTIONS) gating bypass, postMessage origin checks. High only when an attacker-controlled…
Use when an authorized target exposes WordPress core, plugin, theme, REST, or XML-RPC behavior.
Use when testing an authorized LLM application for prompt injection, system-prompt exposure, unsafe tool use, or RAG data-boundary failures.
Multi-sector batch domain expansion — identify untested/under-tested sectors, generate candidate company domains (national chains, franchises, regionals), filter against existing test coverage, probe alive domains, and run the full testing pipeline across 20+…
Parameterized sector recon using sector database.
Bug bounty report writing for H1/Bugcrowd/Intigriti/Immunefi — report templates, human tone guidelines, impact-first writing, CVSS 3.1 scoring, title formula, impact statement formula, severity decision guide, downgrade counters, pre-submit checklist. Use…
Web2 recon pipeline — subdomain enumeration (subfinder, Chaos API, assetfinder), live host discovery (dnsx, httpx), URL crawling (katana, waybackurls, gau), directory fuzzing (ffuf), JS analysis (LinkFinder, SecretFinder), continuous monitoring (new subdomain…
Use when verified WordPress CORS, XML-RPC, role, upload, and execution behaviors may form one authorized attack path.
Systematic approach to finding and testing CVEs for identified WordPress plugins. Covers plugin discovery, version extraction from multiple sources (readme.txt, assets, inline JS), CVE database cross-referencing with WPScan/Patchstack/NVD/NVD API,…
Hunt LLM/AI feature bugs — prompt injection, indirect injection, exfiltration viatool-use/markdown, ASCII smuggling, agentic AI security (OWASP Agentic Apps 2026, ASI01-ASI10). Patterns: direct injection ('ignore previous instructions'), indirect injection…