{"id":51490135,"url":"https://github.com/uphiago/recon-skills","last_synced_at":"2026-07-26T07:00:44.680Z","repository":{"id":367150595,"uuid":"1279480946","full_name":"uphiago/recon-skills","owner":"uphiago","description":"162 offensive security skills for recon and pentest. Field-validated techniques from 600+ targets across 45+ sectors. Updated with origin IP discovery, subdomain takeover, GitHub secret hunting, browser fingerprint evasion, SCADA enumeration, and automated CMS detection. Full write-up at hiago.sh","archived":false,"fork":false,"pushed_at":"2026-07-25T03:49:49.000Z","size":4979,"stargazers_count":940,"open_issues_count":1,"forks_count":169,"subscribers_count":7,"default_branch":"main","last_synced_at":"2026-07-25T05:12:12.079Z","etag":null,"topics":["bug-bounty","cloud-security","cors-exploitation","firebase-hacking","hermes-agent","jwt-attacks","offensive-security","penetration-testing","reconnaissance","red-team","security-automation","ssrf","subdomain-enumeration","supabase","wordpress-security"],"latest_commit_sha":null,"homepage":"https://hiago.sh","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/uphiago.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":"AGENTS.md","dco":null,"cla":null}},"created_at":"2026-06-24T18:19:06.000Z","updated_at":"2026-07-25T04:40:15.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/uphiago/recon-skills","commit_stats":null,"previous_names":["uphiago/recon-skills"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/uphiago/recon-skills","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uphiago%2Frecon-skills","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uphiago%2Frecon-skills/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uphiago%2Frecon-skills/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uphiago%2Frecon-skills/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/uphiago","download_url":"https://codeload.github.com/uphiago/recon-skills/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/uphiago%2Frecon-skills/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35904303,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-07-20T02:08:10.276Z","status":"online","status_checked_at":"2026-07-26T02:00:06.503Z","response_time":89,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bug-bounty","cloud-security","cors-exploitation","firebase-hacking","hermes-agent","jwt-attacks","offensive-security","penetration-testing","reconnaissance","red-team","security-automation","ssrf","subdomain-enumeration","supabase","wordpress-security"],"created_at":"2026-07-07T11:00:27.940Z","updated_at":"2026-07-26T07:00:44.675Z","avatar_url":"https://github.com/uphiago.png","language":"Python","funding_links":[],"categories":["Python"],"sub_categories":[],"readme":"# Recon \u0026 Pentest Skill Pack\n\n\u003cp align=\"center\"\u003e\n  \u003cimg src=\"banner.png\" alt=\"Recon \u0026 Pentest Skill Pack\" width=\"800\"\u003e\n\u003c/p\u003e\n\nField-validated offensive security skills for authorized reconnaissance, vulnerability hunting, and exploit chaining. Terminal-native. Research-backed. MIT licensed.\n\n\u003e **Disclaimer**: These skills are for authorized security testing only. Only test targets you own or have explicit written permission to test. Unauthorized scanning may violate computer fraud laws. The author assumes no liability for misuse.\n\n\u003e **Blog \u0026 research**: [hiago.sh](https://hiago.sh) — Pentest Playbook, field notes, and tooling.\n\n---\n\n## License\n\nMIT — see [LICENSE](./LICENSE)\n\n---\n\n## What's Inside\n\n```\nrecon-skills/\n├── SOUL.md              — Philosophy \u0026 agent operating instructions\n├── AGENTS.md            — Complete catalog + skill standards\n├── STYLE.md             — Skill quality baseline (pitfalls, verification, rate limits)\n├── LICENSE              — MIT license\n├── recon/               — WordPress/CORS/XMLRPC recon, source leaks, JS secrets, web enum,\n│                          email sec, staging hunt, port scans, hardcoded creds, S3/MinIO XSS,\n│                          API exploitation, MCP security, LLM attacks, browser evasion, origin IP\n│                          discovery, subdomain takeover, vhost enum, GitHub secrets, ASN mapping,\n│                          visual recon, CMS detection\n├── redteam/             — hunt-* skills (XSS, SQLi, SSRF, RCE, ATO, IDOR, CORS, Firebase,\n│                          Supabase, MCP security, LLM attacks, schema-enum, write-gap, metrics, K8s, mass-assignment,\n│                          prototype-pollution, BFLA, info-disclosure, Django, FastAPI, NestJS),\n│                          plus recon-sector (parametrized, sectors.yaml database),\n│                          plus methodology/ops tools\n├── meta/                — Recon playbook, sector methodology, attack patterns, wave delta,\n│                          Google dorks, pentest playbook\n├── chains/              — Cross-attack chaining, WordPress full compromise\n├── auth/                — SAML SSO attacks\n├── infra/               — Docker privilege escalation\n├── controller           — Agent orchestration\n└── worker               — Multi-worker cluster (recon, heavy/RE, Tor)\n```\n\n## Key Skills\n\n| Category | Skill | What It Does |\n|----------|-------|-------------|\n| **meta** | `recon-playbook` | 4-phase pipeline: target gen -\u003e quick filter -\u003e WP deep check -\u003e deep invade |\n| **recon** | `cors-credential-wordpress` | 8 CORS variants (V1-V8) |\n| **recon** | `xmlrpc-exploitation` | System.multicall, pingback SSRF, IMDS role guessing, wp.uploadFile |\n| **recon** | `web-enumeration` | 200+ sensitive file paths, .env extraction, path traversal, vhost enum |\n| **recon** | `js-secrets-extraction` | 12 regex patterns for API keys, JWTs, Firebase, Supabase in JS bundles |\n| **recon** | `email-security` | DMARC/SPF/DKIM checks, SMTP spoofing, header analysis |\n| **chains** | `cross-attack-chains` | Attack chain methodology: CORS+XMLRPC-\u003eRCE, SSRF-\u003eIMDS, etc |\n| **chains** | `wordpress-full-compromise` | Kill chains for full WordPress takeover |\n| **meta** | `attack-patterns-reference` | 25 patterns (P-01 to P-25), 18 WP abuse patterns, 8 CORS variants |\n| **meta** | `cross-wave-delta-analysis` | Compare waves: NEW / REGRESSION / PERSISTENT / CHANGE |\n| **meta** | `sector-recon-methodology` | Tier-based sector selection + per-sector vulnerability baselines |\n| **meta** | `google-dorks-catalog` | 100+ dork patterns by service type + GitHub code search |\n| **redteam** | `recon-sector` | Parameterized sector recon: sectors.yaml database |\n\n\n## Research\n\nIncorporates external security research:\n\n- **AI Agent Framework Audit** (2026): 56+ vulns across 13 frameworks, 7 CVEs (CVE-2026-2287)\n- **HuntBook Methodology** (su6osec): XSS, SQLi, SSRF modern techniques\n- **PortSwigger Research** (2025): SAML bypass, WebSocket attacks, HTTP anomaly detection\n- **Tool Benchmarks**: dnsx 2x, httpx 5.6x, naabu 8x, ffuf vs curl rate-limit reality\n\nSee  and  for details.\n\n## Quick Start\n\nClone into your agent's skills directory and reference via skill name:\n\n```bash\ngit clone https://github.com/uphiago/recon-skills.git\n```\n\nSkills are self-contained markdown files with YAML frontmatter. Each skill documents trigger conditions, commands, verification steps, and pitfalls. See [STYLE.md](./STYLE.md) for the quality baseline and writing guidelines.\n\n## Skill Standards\n\nEvery skill follows the [STYLE.md](./STYLE.md) baseline:\n\n- **Conditions**: Trigger rules for when to use the skill\n- **Commands**: Terminal-native commands with `--max-time` and rate limiting\n- **Verification**: How to confirm findings\n- **Pitfalls**: Known gotchas and edge cases\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fuphiago%2Frecon-skills","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fuphiago%2Frecon-skills","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fuphiago%2Frecon-skills/lists"}