sector-recon-methodology

1# Sector Recon Methodology Skill
2 
3Methodology for selecting non-regulated industry sectors with the highest WordPress vulnerability rates, compiling company domain lists, and running batch reconnaissance within authorized engagements. Distilled from surveying 600+ US company domains across 28 sectors under bug bounty and authorized testing programs.
4 
5## When to Use
6 
7- Planning a new recon campaign and need to choose sectors.
8- Expanding from tested sectors into new ones.
9- Building target lists from sector keywords via crt.sh.
10- After `recon-playbook` Phase 0 — this skill provides the sector intelligence.
11- Comparing your findings against baseline vulnerability rates per sector.
12 
13## Prerequisites
14 
15- `curl`, `jq`, `httpx`, and `subfinder`.
16- Understanding of the US regulatory landscape (HIPAA, GLBA, PCI-DSS) — regulated sectors have near-zero vulnerability rates.
17- An execution environment with explicit concurrency and rate limits.
18 
19## How to Run
20 
21```bash
22# Generate targets for a sector
23SECTOR="landscaping"
24curl --max-time 30 --connect-timeout 10 -sk "https://crt.sh/?q=%25.${SECTOR}%25&output=json" | jq -r '.[].name_value' | \
25  sed 's/\*\.//g' | sed 's/^www\.//' | sort -u > ${SECTOR}_targets.txt
26```
27 
28**Script**: `scripts/parallel_sector_probe.py` — OPSEC-controlled batch probe with random delays, generates per-domain findings files. Run `python3 scripts/parallel_sector_probe.py targets.txt output_dir/` for a full WP/CORS/XMLRPC/leak scan.
29 
30## Quick Reference
31…