recon-skills

Use when two or more verified findings may combine into a higher-impact authorized attack path.

Use when verified WordPress findings may combine into an authorized path to administrative or server control.

Escape Docker containers to host root via 5 techniques.

Use when classifying a verified web or WordPress behavior and selecting a related validation skill.

Compare recon waves to find NEW, REGRESSED, PERSISTENT findings.

Use when choosing which browser, TLS, HTTP/2, or behavior impersonation layer applies to a blocked probe.

High-precision Google dorks for exposed configs, secrets, and credentials -- real-world validated

7-phase pentest pipeline from passive recon to exploitation.

Use when starting or restructuring an authorized external web and API assessment.

Pick sectors, compile targets, batch recon for campaigns.

Use when protected HTTP routes return 401 or 403.

Use when an API may expose data or privileged operations without authentication.

Map organization IP infrastructure via ASN, CIDR, TLD expansion, and reverse DNS.

Identify CMS, frameworks, and server technology stacks on live hosts.

Exploit WP CORS credential reflection for data theft.

Deep pentest WP: SSRF, plugin CVE, JS mine, port scan chain.

DMARC/SPF/DKIM check, email spoofing, SMTP test, and security header analysis

Mine error_log for creds, paths, SQL when leak hunt finds.

Exchange/OWA NTLM AD leak, spray attack when mail subdomain.

Exploit Flask/Werkzeug debugger exposure for traceback and SECRET leaks.

Find leaked API keys, tokens, and credentials in public GitHub repositories.

Mine GitLab for secrets, CI tokens when subdomain found.

Detect hardcoded passwords in HTML forms, JavaScript, and API responses.

Spoof HTTP/2 SETTINGS frames and pseudo-header order per browser profile.

Human-like mouse, keyboard and scroll behavior for behavioral bot bypass.

Attack cameras via RTSP, ONVIF, Axis config when 554 open.

Analyze JS bundles and source maps for hardcoded secrets, API keys, JWTs, and internal endpoints

Decode, forge, brute JWTs when Bearer auth header is seen.

Discover origin IPs behind CDN/WAF via favicon hash, DNS history, and SSL certs.

Chain phpinfo to RCE via exec check when info.php exposed.

Port scan /8-/24 with Masscan+RustScan and nmap banners.

Nmap scan for MySQL, Redis, FTP, SSH, internal API services.

Exploit public bucket Content-Type override for stored XSS on target origin.

Enumerate Hikvision ISAPI endpoints on SCADA and IoT web interfaces.

Mass-scan live hosts for exposed sensitive files (.env, .git, wp-config backups, logs, dumps, phpinfo) with content-based verification, then extend into parameter discovery, URL categorization, WAF bypass, and historical recovery. Absorbs the former web-enumeration skill.

Hunt staging via crt.sh when production is WAF-hardened.

Launch stealth Chromium with C++ fingerprint patches for anti-bot bypass.

Map subdomains via crt.sh and subfinder at recon kickoff.

Detect and verify subdomain takeover via dangling CNAME to unclaimed services.

Spoof TLS ClientHello and JA4 fingerprints for browser impersonation.