sector-recon-methodology

Pick sectors, compile targets, batch recon for campaigns.

설치로 이동

저장소: uphiago/recon-skills
최근 소스 활동: 2026년 7월 29일 23:32
감지된 SKILL.md 언어: 영어
스타: 1,158
포크: 205

설치 방법

기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.

소스 파일 검토

설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.

검색으로 돌아가기 설치로 돌아가기

name	sector-recon-methodology
description	Pick sectors, compile targets, batch recon for campaigns.
version	1.1.0
revision_date	"2026-07-25T00:00:00.000Z"
license	MIT
platforms	["linux"]
compatibility	Requires curl, nmap, python3, masscan, subfinder, httpx, nuclei
tags	["meta","sector","methodology","target-selection","us-companies"]
category	meta
related_skills	["recon-playbook","wp-mass-recon","attack-patterns-reference","subdomain-enumeration","cross-wave-delta-analysis","web-enumeration"]

Sector Recon Methodology Skill

Methodology for selecting non-regulated industry sectors with the highest WordPress vulnerability rates, compiling company domain lists, and running batch reconnaissance within authorized engagements. Distilled from surveying 600+ US company domains across 28 sectors under bug bounty and authorized testing programs.

When to Use

Planning a new recon campaign and need to choose sectors.
Expanding from tested sectors into new ones.
Building target lists from sector keywords via crt.sh.
After recon-playbook Phase 0 — this skill provides the sector intelligence.
Comparing your findings against baseline vulnerability rates per sector.

Prerequisites

curl, jq, httpx, and subfinder.
Understanding of the US regulatory landscape (HIPAA, GLBA, PCI-DSS) — regulated sectors have near-zero vulnerability rates.
An execution environment with explicit concurrency and rate limits.

How to Run

# Generate targets for a sector
SECTOR="landscaping"
curl --max-time 30 --connect-timeout 10 -sk "https://crt.sh/?q=%25.${SECTOR}%25&output=json" | jq -r '.[].name_value' | \
  sed 's/\*\.//g' | sed 's/^www\.//' | sort -u > ${SECTOR}_targets.txt

Script: scripts/parallel_sector_probe.py — OPSEC-controlled batch probe with random delays, generates per-domain findings files. Run python3 scripts/parallel_sector_probe.py targets.txt output_dir/ for a full WP/CORS/XMLRPC/leak scan.

Quick Reference

Tier	Sectors	Typical WP Rate	Best Pattern	Notes
1	Law, Landscaping, Pools, Pest, Roofing, Dental, Gyms, Real Estate, HVAC, Property, Auto Repair, Photography	30-50%	CORS + WP users	Minimal WAF, GoDaddy/Bluehost
2	Cleaning, Moving, Accounting, Septic, Window, Car Wash, Bakery, Locksmith, Solar, Chimney, Fire, Pet Grooming

Sector	Vuln Rate	Top Pattern	WordPress Rate	WAF Protection	Best Targets
Law Firms	25%	P-06 (CORS auth)	~30%	Minimal	Solo/small firm, GoDaddy-hosted
Landscaping	20%	WP-01 (user enum)	~50%	Minimal	Local SMB, franchise model
Pool Services	20%	WP-01 (user enum)	~45%	Minimal	Summer-seasonal businesses
Pest Control	20%	P-02 (CORS)	~40%	Minimal	Franchise-heavy
Roofing	15%	WP-01, P-17	~45%	Minimal	Local contractors
Dental Clinics	15%	WP-01 (user enum)	~35%	Some	Single-dentist practices
Gyms/Fitness	15%	WP-01 (user enum)	~40%	Some	CrossFit, yoga, martial arts
Real Estate	15%	P-02 (CORS)	~40%	Some	Independent brokerages
HVAC/Plumbing	14%	WP-01, P-02	~35%	Some	Franchise-heavy, staging common
Property Management	15%	P-02 (CORS)	~30%	Some	PII-heavy sector
Photography	10%	WP-01 (user enum)	~50%	Some	Portfolio sites, often WP
Funeral Homes	10%	WP-01 (user enum)	~33%	Minimal	WordPress + user enum found on 2 targets (funeral.example.com, memorial.example.com)
Senior Living	17%	P-02 (CORS) + XMLRPC	~33%	Cloudflare	senior-living.example.com (80 XMLRPC methods + CORS + multicall), senior-living2.example.com (CORS) — 2/12 tested = CRITICAL findings

Sector	Vuln Rate	Notes
Cleaning Services	13%	Carpet, window, mold remediation
Moving Companies	6%	Fewer WP, more SaaS platforms
Accounting/CPA	5%	Some regulated, some not — financial data at risk
Septic Services	25% source leaks	Massive source leak rate (.env, .git, wp-config)
Window Cleaning	25% CORS	Small operations, DIY WP
Car Washes	20% source leaks	Dockerfile, swagger, actuator endpoints common
Bakeries	18% CORS wildcard	28 leaked files on one target
Locksmiths	20% WP users + XMLRPC	38 subdomains on one target
Solar Installers	Minimal	Major brands use enterprise platforms
Chimney Sweeps	~10% CORS + XMLRPC	Small family businesses, WP common
Fire Restoration	~10%	Franchise model (Servpro, Belfor)
Pet Grooming	20% WP users	Dogtopia, Camp Bow Wow — WP detected

Sector	Vuln Rate	Why
Car Dealerships	0%	Enterprise CDK/Dealertrack platforms, not WordPress
Travel Agencies	0%	SaaS (Sabre, Amadeus), not self-hosted
Banks/Credit Unions	0%	GLBA regulated, mandatory security
Major Healthcare	0%	HIPAA regulated, HITRUST certified
Home Services	0%	Angi/Thumbtack platforms, not self-hosted

OUTDIR="$OUTDIR/sectors"
mkdir -p "$OUTDIR"

echo "[*] Sector vulnerability potential assessment:"
echo ""

# Run quick sector probe: crt.sh → httpx → WP detection → user count
probe_sector() {
  local sector="$1"
  local file="$OUTDIR/${sector}_probe.txt"

  echo "[*] Probing sector: $sector"

  # Get domains from crt.sh
  curl -sk --max-time 20 --connect-timeout 10 "https://crt.sh/?q=%25.${sector}%25&output=json" 2>/dev/null | \
    jq -r '.[].name_value' 2>/dev/null | sed 's/\*\.//g' | sed 's/^www\.//' | \
    grep -E '^[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$' | sort -u | head -50 > "$OUTDIR/${sector}_domains.txt"

  # Option C: Manual known-company list (when crt.sh/subfinder time out)
  if [[ ! -s "$OUTDIR/${sector}_domains.txt" ]]; then
    echo "  crt.sh empty — using manual known-company list"
    # Generate known US companies in this sector
    # Example: for "vet" or "pet_care" sector, known chains include:
    cat > "$OUTDIR/${sector}_domains.txt" << 'EOF'
[VET_CLINIC]
[VET_CHAIN]
[PET_RETAILER]
[VET_CORPORATE]
[VET_HOSPITAL]
[VET_SPECIALIST]
[ANIMAL_CLINIC]
[VET_CLINIC]
[TRADE_PUBLICATION]
EOF
  fi

  local total=$(wc -l < "$OUTDIR/${sector}_domains.txt")
  echo "  Domains: $total"

  # Probe with httpx
  httpx -silent -l "$OUTDIR/${sector}_domains.txt" -threads 30 -status-code -tech-detect \
    -o "$OUTDIR/${sector}_alive.txt" 2>/dev/null

  local alive=$(wc -l < "$OUTDIR/${sector}_alive.txt")
  echo "  Live: $alive"

  # WordPress count
  local wp=$(grep -ci 'wordpress' "$OUTDIR/${sector}_alive.txt" 2>/dev/null || echo 0)
  echo "  WordPress: $wp"

  # Quick user enumeration on WP targets
  local users=0
  grep -i 'wordpress' "$OUTDIR/${sector}_alive.txt" 2>/dev/null | awk '{print $1}' | head -10 | while read -r url; do
    ucount=$(curl -sk --max-time 5 --connect-timeout 5 "$url/wp-json/wp/v2/users" 2>/dev/null | python3 -c "import sys,json; d=json.load(sys.stdin); print(len(d) if isinstance(d,list) else 0)" 2>/dev/null || echo 0)
    [[ "$ucount" -gt 0 ]] && echo "    $url: $ucount users" >> "$OUTDIR/${sector}_users.txt"
  done

  local user_targets=$(wc -l < "$OUTDIR/${sector}_users.txt" 2>/dev/null || echo 0)
  echo "  User leaks: $user_targets"

  # Score the sector
  echo "$sector | domains=$total | alive=$alive | wp=$wp | user_leaks=$user_targets" >> "$OUTDIR/sector_scores.txt"
}

# Probe top candidate sectors
for sector in "landscaping" "roofing" "hvac" "pools" "plumbing" "lawn-care" \
  "pest-control" "law-firm" "dentist" "gym" "real-estate" "auto-repair" \
  "moving-company" "photography" "cleaning-service" "church"; do
  probe_sector "$sector"
  sleep 3  # Rate limit
done

echo ""
echo "[*] Sector scores:"
sort -t'|' -k5 -rn "$OUTDIR/sector_scores.txt" 2>/dev/null | head -15

OUTDIR="$OUTDIR/sectors"

# For selected high-yield sectors, compile full target lists
SELECTED_SECTORS=("landscaping" "roofing" "pools" "plumbing" "pest-control" "law-firm")

echo "[*] Compiling target lists for selected sectors..."

> "$OUTDIR/all_targets.txt"

for sector in "${SELECTED_SECTORS[@]}"; do
  echo "  Sector: $sector"

  # crt.sh wildcard search
  curl -sk --max-time 20 --connect-timeout 10 "https://crt.sh/?q=%25.${sector}%25&output=json" 2>/dev/null | \
    jq -r '.[].name_value' 2>/dev/null | sed 's/\*\.//g' | sed 's/^www\.//' | \
    grep -E '^[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$' | sort -u > "$OUTDIR/${sector}_all.txt"

  # Also try subfinder
  subfinder -d "${sector}.com" -silent 2>/dev/null >> "$OUTDIR/${sector}_all.txt"

  # Add to master list with sector label
  while read -r domain; do
    echo "$domain|$sector" >> "$OUTDIR/all_targets.txt"
  done < "$OUTDIR/${sector}_all.txt"

  sleep 2
done

# Clean: remove CDN domains, parking pages, known false positives
echo "[*] Cleaning target list..."

# Remove common false positives
grep -viE 'cloudflare|akamai|fastly|awsdns|googleusercontent|azurewebsites' "$OUTDIR/all_targets.txt" | \
  sort -u > "$OUTDIR/all_targets_clean.txt"

total=$(wc -l < "$OUTDIR/all_targets_clean.txt")
echo "[+] $total clean targets across ${#SELECTED_SECTORS[@]} sectors"

OUTDIR="$OUTDIR/sectors"
FINDINGS_DIR="$OUTDIR/playbook/phase2_findings"

echo "[*] Computing sector statistics..."

# Extract sector from target list
declare -A SECTOR_WP
declare -A SECTOR_CORS
declare -A SECTOR_XMLRPC
declare -A SECTOR_LEAKS
declare -A SECTOR_TOTAL

# Read target list
while IFS='|' read -r domain sector; do
  [[ -z "$sector" ]] && continue
  ((SECTOR_TOTAL[$sector]++))

  findings_file="$FINDINGS_DIR/${domain}_p2.md"
  if [[ -f "$findings_file" ]]; then
    grep -q "WordPress:" "$findings_file" && ((SECTOR_WP[$sector]++))
    grep -q "CORS:" "$findings_file" && ((SECTOR_CORS[$sector]++))
    grep -q "XMLRPC:" "$findings_file" && ((SECTOR_XMLRPC[$sector]++))
    grep -q "Source leak:" "$findings_file" && ((SECTOR_LEAKS[$sector]++))
  fi
done < "$OUTDIR/all_targets_clean.txt"

# Print sector report
echo ""
echo "## Sector Vulnerability Report"
echo ""
echo "| Sector | Targets | WP | CORS | XMLRPC | Leaks | Rate |"
echo "|--------|---------|-----|------|--------|-------|------|"

for sector in "${!SECTOR_TOTAL[@]}"; do
  total=${SECTOR_TOTAL[$sector]}
  wp=${SECTOR_WP[$sector]:-0}
  cors=${SECTOR_CORS[$sector]:-0}
  xmlrpc=${SECTOR_XMLRPC[$sector]:-0}
  leaks=${SECTOR_LEAKS[$sector]:-0}
  vulns=$((cors + xmlrpc + leaks))
  rate=$(python3 -c "print(f'{$vulns/$total*100:.1f}%')" 2>/dev/null || echo "0%")

  echo "| $sector | $total | $wp | $cors | $xmlrpc | $leaks | $rate |"
done

---
name: recon-SECTORNAME
description: Reconnaissance workflow for SECTOR NAME companies.
version: 1.1.0
revision_date: 2026-07-25
license: MIT
platforms: [linux]
tags: [recon, sector, SECTORNAME]
category: recon
---

# SECTOR NAME Recon Skill

[2-3 sentence description of sector-specific attack surface]

## When to Use

- Targeting SECTOR NAME companies for recon.
- [Sector-specific trigger]

## Quick Reference

| Attack Surface | Expected Prevalence | Top Pattern |
|----------------|---------------------|-------------|
| WordPress | XX% | WP-01 |
| CORS | XX% | V1 |
| XMLRPC | XX% | WP-05 |
| Source leaks | XX% | P-17 |

## Attack Surface Signals

- [Sector-specific CMS/platform signals]
- [Common third-party integrations]
- [Typical infrastructure patterns]
- [PII/regulated data vectors]

## Sector-Specific Bypasses

- [WAF/CDN patterns for this sector]
- [Rate limiting characteristics]
- [Common security gaps]

## Real Examples

- [Target name]: [finding] (severity)
- [Target name]: [finding] (severity)

## Related Skills

- wp-mass-recon
- cors-credential-wordpress
- xmlrpc-exploitation
- source-leak-hunt