uphiago/recon-skills

wstg-web-pentest

Full WSTG-aligned web application pentest — 12-phase methodology from information gathering through reporting, with concrete commands, expected outputs, pitfalls, and verification per phase.

原文语言：英语

saml-sso-attack

Attack SAML SSO via XSW, signature strip, metadata extract.

原文语言：英语

cross-attack-chains

Use when two or more verified findings may combine into a higher-impact authorized attack path.

原文语言：英语

wordpress-full-compromise

Use when verified WordPress findings may combine into an authorized path to administrative or server control.

原文语言：英语

docker-privesc

Escape Docker containers to host root via 5 techniques.

原文语言：英语

attack-patterns-reference

Use when classifying a verified web or WordPress behavior and selecting a related validation skill.

原文语言：英语

cross-wave-delta-analysis

Compare recon waves to find NEW, REGRESSED, PERSISTENT findings.

原文语言：英语

recon-playbook

Use when starting or restructuring an authorized external web and API assessment.

原文语言：英语

api-noauth-hunt

Use when an API may expose data or privileged operations without authentication.

原文语言：英语

deep-invade

Deep pentest WP: SSRF, plugin CVE, JS mine, port scan chain.

原文语言：英语

error-log-mining

Mine error_log for creds, paths, SQL when leak hunt finds.

原文语言：英语

exchange-owa-attack

Exchange/OWA NTLM AD leak, spray attack when mail subdomain.

原文语言：英语

firebase-supabase-attack

Exploit Firebase/Supabase for data via JS config leak probe.

原文语言：英语

flask-werkzeug-attack

Exploit Flask/Werkzeug debugger exposure for traceback and SECRET leaks.

原文语言：英语

gitlab-public-recon

Mine GitLab for secrets, CI tokens when subdomain found.

原文语言：英语

iot-camera-recon

Attack cameras via RTSP, ONVIF, Axis config when 554 open.

原文语言：英语

js-secrets-extraction

Analyze JS bundles and source maps for hardcoded secrets, API keys, JWTs, and internal endpoints

原文语言：英语

jwt-attack

Decode, forge, brute JWTs when Bearer auth header is seen.

原文语言：英语

phpinfo-to-rce

Chain phpinfo to RCE via exec check when info.php exposed.

原文语言：英语

port-mass-scan

Port scan /8-/24 with Masscan+RustScan and nmap banners.

原文语言：英语

port-service-discovery

Nmap scan for MySQL, Redis, FTP, SSH, internal API services.

原文语言：英语

staging-subdomain-hunt

Hunt staging via crt.sh when production is WAF-hardened.

原文语言：英语

web-enumeration

Sensitive file scanning, path traversal bypass, vHost enum, .env extract, log mining, Varnish detect

原文语言：英语

wordpress-plugin-hunt

Hunt WP plugins via REST, exploit CVEs when version known.

原文语言：英语

wp-mass-recon

Batch WP recon: users, CORS, XMLRPC, leaks across domains.

原文语言：英语

wp-plugin-rest-auth-bypass

Scan WordPress REST API plugin endpoints for unauthenticated state-changing operations — discover write endpoints (POST/PUT/PATCH/DELETE) exposed without auth, enumerate all plugin routes, and test for unauthorized content publishing, settings modification,…

原文语言：英语

xmlrpc-exploitation

Exploit XMLRPC multicall, pingback for brute force and SSRF.

原文语言：英语

zimbra-attack

Zimbra SOAP user enum, CVE-2022-37042, SSRF when webmail.

原文语言：英语

cors-chain-automation

Use when a bounded list of authorized API endpoints needs consistent CORS triage before browser validation.

原文语言：英语

evidence-hygiene

Evidence-capture and PoC-redaction discipline for bug-bounty submissions: cookie redaction protocol (which fields to mask, Preview annotation / Burp panel hiding / DevTools workflow), PII black-bar discipline (what to mask in other-user data — names, emails,…

原文语言：英语

hunt-cors

Hunt CORS Misconfiguration — origin-reflection with credentials, null-origin trust, subdomain-regex bypass (unanchored vs unescaped-dot vs prefix-only), pre-flight (OPTIONS) gating bypass, postMessage origin checks. High only when an attacker-controlled…

原文语言：英语

hunt-wordpress

Use when an authorized target exposes WordPress core, plugin, theme, REST, or XML-RPC behavior.

原文语言：英语

llm-prompt-injection

Use when testing an authorized LLM application for prompt injection, system-prompt exposure, unsafe tool use, or RAG data-boundary failures.

原文语言：英语

recon-sector-expansion

Multi-sector batch domain expansion — identify untested/under-tested sectors, generate candidate company domains (national chains, franchises, regionals), filter against existing test coverage, probe alive domains, and run the full testing pipeline across 20+…

原文语言：英语

recon-sector

Parameterized sector recon using sector database.

原文语言：英语

report-writing

Bug bounty report writing for H1/Bugcrowd/Intigriti/Immunefi — report templates, human tone guidelines, impact-first writing, CVSS 3.1 scoring, title formula, impact statement formula, severity decision guide, downgrade counters, pre-submit checklist. Use…

原文语言：英语

web2-recon

Web2 recon pipeline — subdomain enumeration (subfinder, Chaos API, assetfinder), live host discovery (dnsx, httpx), URL crawling (katana, waybackurls, gau), directory fuzzing (ffuf), JS analysis (LinkFinder, SecretFinder), continuous monitoring (new subdomain…

原文语言：英语

wordpress-cors-xmlrpc-rce-chain

Use when verified WordPress CORS, XML-RPC, role, upload, and execution behaviors may form one authorized attack path.

原文语言：英语

wp-plugin-cve-hunt

Systematic approach to finding and testing CVEs for identified WordPress plugins. Covers plugin discovery, version extraction from multiple sources (readme.txt, assets, inline JS), CVE database cross-referencing with WPScan/Patchstack/NVD/NVD API,…

原文语言：英语

hunt-llm-ai

Hunt LLM/AI feature bugs — prompt injection, indirect injection, exfiltration viatool-use/markdown, ASCII smuggling, agentic AI security (OWASP Agentic Apps 2026, ASI01-ASI10). Patterns: direct injection ('ignore previous instructions'), indirect injection…

原文语言：英语