uphiago/recon-skills

---

name: saml-sso-attack

description: Attack SAML SSO via XSW, signature strip, metadata extract.

---

name: cross-attack-chains

description: Use when two or more verified findings may combine into a higher-impact authorized attack path.

---

name: wordpress-full-compromise

description: Use when verified WordPress findings may combine into an authorized path to administrative or server control.

---

name: docker-privesc

description: Escape Docker containers to host root via 5 techniques.

---

name: attack-patterns-reference

description: Use when classifying a verified web or WordPress behavior and selecting a related validation skill.

---

name: cross-wave-delta-analysis

description: Compare recon waves to find NEW, REGRESSED, PERSISTENT findings.

---

name: google-dorks-catalog

description: High-precision Google dorks for exposed configs, secrets, and credentials -- real-world validated

---

name: pentest-playbook

description: 7-phase pentest pipeline from passive recon to exploitation.

---

name: recon-playbook

description: Use when starting or restructuring an authorized external web and API assessment.

---

name: sector-recon-methodology

description: Pick sectors, compile targets, batch recon for campaigns.

---

name: 401-403-bypass-techniques

description: Use when protected HTTP routes return 401 or 403.

---

name: api-noauth-hunt

description: Use when an API may expose data or privileged operations without authentication.

---

name: asn-infrastructure-mapping

description: Map organization IP infrastructure via ASN, CIDR, TLD expansion, and reverse DNS.

---

name: cache-attack

description: Poison CDN cache or deceive when X-Cache header is detected.

---

name: cms-detection

description: Identify CMS, frameworks, and server technology stacks on live hosts.

---

name: cors-credential-wordpress

description: Exploit WP CORS credential reflection for data theft.

---

name: deep-invade

description: Deep pentest WP: SSRF, plugin CVE, JS mine, port scan chain.

---

name: email-security

description: DMARC/SPF/DKIM check, email spoofing, SMTP test, and security header analysis

---

name: error-log-mining

description: Mine error_log for creds, paths, SQL when leak hunt finds.

---

name: exchange-owa-attack

description: Exchange/OWA NTLM AD leak, spray attack when mail subdomain.

---

name: firebase-supabase-attack

description: Exploit Firebase/Supabase for data via JS config leak probe.

---

name: flask-werkzeug-attack

description: Exploit Flask/Werkzeug debugger exposure for traceback and SECRET leaks.

---

name: github-secret-hunting

description: Find leaked API keys, tokens, and credentials in public GitHub repositories.

---

name: gitlab-public-recon

description: Mine GitLab for secrets, CI tokens when subdomain found.

---

name: hardcoded-credential-hunt

description: Detect hardcoded passwords in HTML forms, JavaScript, and API responses.

---

name: http2-header-impersonation

description: Spoof HTTP/2 SETTINGS frames and pseudo-header order per browser profile.

---

name: humanize-automation

description: Human-like mouse, keyboard and scroll behavior for behavioral bot bypass.

---

name: iot-camera-recon

description: Attack cameras via RTSP, ONVIF, Axis config when 554 open.

---

name: js-secrets-extraction

description: Analyze JS bundles and source maps for hardcoded secrets, API keys, JWTs, and internal endpoints

---

name: jwt-attack

description: Decode, forge, brute JWTs when Bearer auth header is seen.