recon-skills

In the author's own words, from each skill's SKILL.md — showing the first 30 of 146 files.

• saml-sso-attack

  Attack SAML SSO via XSW, signature strip, metadata extract.

  auth/saml-sso-attack/SKILL.md on GitHub (opens in a new tab)

• cross-attack-chains

  Use when two or more verified findings may combine into a higher-impact authorized attack path.

  chains/cross-attack-chains/SKILL.md on GitHub (opens in a new tab)

• wordpress-full-compromise

  Use when verified WordPress findings may combine into an authorized path to administrative or server control.

  chains/wordpress-full-compromise/SKILL.md on GitHub (opens in a new tab)

• docker-privesc

  Escape Docker containers to host root via 5 techniques.

  infra/docker-privesc/SKILL.md on GitHub (opens in a new tab)

• attack-patterns-reference

  Use when classifying a verified web or WordPress behavior and selecting a related validation skill.

  meta/attack-patterns-reference/SKILL.md on GitHub (opens in a new tab)

• cross-wave-delta-analysis

  Compare recon waves to find NEW, REGRESSED, PERSISTENT findings.

  meta/cross-wave-delta-analysis/SKILL.md on GitHub (opens in a new tab)

• google-dorks-catalog

  High-precision Google dorks for exposed configs, secrets, and credentials -- real-world validated

  meta/google-dorks-catalog/SKILL.md on GitHub (opens in a new tab)

• pentest-playbook

  7-phase pentest pipeline from passive recon to exploitation.

  meta/pentest-playbook/SKILL.md on GitHub (opens in a new tab)

• recon-playbook

  Use when starting or restructuring an authorized external web and API assessment.

  meta/recon-playbook/SKILL.md on GitHub (opens in a new tab)

• sector-recon-methodology

  Pick sectors, compile targets, batch recon for campaigns.

  meta/sector-recon-methodology/SKILL.md on GitHub (opens in a new tab)

• 401-403-bypass-techniques

  Use when protected HTTP routes return 401 or 403.

  recon/401-403-bypass/SKILL.md on GitHub (opens in a new tab)

• api-noauth-hunt

  Use when an API may expose data or privileged operations without authentication.

  recon/api-noauth-hunt/SKILL.md on GitHub (opens in a new tab)

• asn-infrastructure-mapping

  Map organization IP infrastructure via ASN, CIDR, TLD expansion, and reverse DNS.

  recon/asn-infrastructure-mapping/SKILL.md on GitHub (opens in a new tab)

• cache-attack

  Poison CDN cache or deceive when X-Cache header is detected.

  recon/cache-attack/SKILL.md on GitHub (opens in a new tab)

• cms-detection

  Identify CMS, frameworks, and server technology stacks on live hosts.

  recon/cms-detection/SKILL.md on GitHub (opens in a new tab)

• cors-credential-wordpress

  Exploit WP CORS credential reflection for data theft.

  recon/cors-credential-wordpress/SKILL.md on GitHub (opens in a new tab)

• deep-invade

  Deep pentest WP: SSRF, plugin CVE, JS mine, port scan chain.

  recon/deep-invade/SKILL.md on GitHub (opens in a new tab)

• email-security

  DMARC/SPF/DKIM check, email spoofing, SMTP test, and security header analysis

  recon/email-security/SKILL.md on GitHub (opens in a new tab)

• error-log-mining

  Mine error_log for creds, paths, SQL when leak hunt finds.

  recon/error-log-mining/SKILL.md on GitHub (opens in a new tab)

• exchange-owa-attack

  Exchange/OWA NTLM AD leak, spray attack when mail subdomain.

  recon/exchange-owa-attack/SKILL.md on GitHub (opens in a new tab)

• firebase-supabase-attack

  Exploit Firebase/Supabase for data via JS config leak probe.

  recon/firebase-supabase-attack/SKILL.md on GitHub (opens in a new tab)

• flask-werkzeug-attack

  Exploit Flask/Werkzeug debugger exposure for traceback and SECRET leaks.

  recon/flask-werkzeug-attack/SKILL.md on GitHub (opens in a new tab)

• github-secret-hunting

  Find leaked API keys, tokens, and credentials in public GitHub repositories.

  recon/github-secret-hunting/SKILL.md on GitHub (opens in a new tab)

• gitlab-public-recon

  Mine GitLab for secrets, CI tokens when subdomain found.

  recon/gitlab-public-recon/SKILL.md on GitHub (opens in a new tab)

• hardcoded-credential-hunt

  Detect hardcoded passwords in HTML forms, JavaScript, and API responses.

  recon/hardcoded-credential-hunt/SKILL.md on GitHub (opens in a new tab)

• http2-header-impersonation

  Spoof HTTP/2 SETTINGS frames and pseudo-header order per browser profile.

  recon/http2-header-impersonation/SKILL.md on GitHub (opens in a new tab)

• humanize-automation

  Human-like mouse, keyboard and scroll behavior for behavioral bot bypass.

  recon/humanize-automation/SKILL.md on GitHub (opens in a new tab)

• iot-camera-recon

  Attack cameras via RTSP, ONVIF, Axis config when 554 open.

  recon/iot-camera-recon/SKILL.md on GitHub (opens in a new tab)

• js-secrets-extraction

  Analyze JS bundles and source maps for hardcoded secrets, API keys, JWTs, and internal endpoints

  recon/js-secrets-extraction/SKILL.md on GitHub (opens in a new tab)

• jwt-attack

  Decode, forge, brute JWTs when Bearer auth header is seen.

  recon/jwt-attack/SKILL.md on GitHub (opens in a new tab)

No skill matches that filter.

Similar skills

• Anthropic-Cybersecurity-Skillsby mukul975 817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF &… 35.6k stars · 30 skills
• hermes-workspaceby outsourc-e Native web workspace for Hermes Agent — chat, terminal, memory, skills, inspector. 6.8k stars · 1 skill
• reaby morluto Reverse engineer anything with agents, from app behavior down to native binaries. 431k stars · 5 skills
• skillsby mattpocock Skills for Real Engineers. Straight from my .agents directory. 313k stars · 30 skills
• superpowersby obra An agentic skills framework & software development methodology that works. 312k stars · 15 skills
• ECCby affaan-m The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Cod… 297k stars · 30 skills