deep-invade

What problem does it solve?

Bridges the gap between initial surface reconnaissance of WordPress targets and deep exploitation, where standard recon fails to uncover high-impact attack vectors like SSRF flaws, unpatched plugin CVEs, and exposed credentials in error logs.

Core Features & Use Cases

• 7-Phase Deep Pentest Workflow: Executes extended SSRF probing via XMLRPC pingback, error log credential mining, plugin CVE matrix scanning, JavaScript secret extraction, subdomain/staging discovery, fast port scanning, and API endpoint enumeration.
• Wave-Aligned Progression: Builds on prior recon waves 5-9, with proven results across 7 US company targets, to systematically uncover chains leading to RCE or data breaches.
• Use Case: Assigned to a high-value WordPress target that scored 6 or higher in wp-mass-recon, this skill eliminates manual guesswork by automating deep probes for the most common high-severity WordPress vulnerabilities.

Quick Start

Use the deep-invade skill to run a complete deep pentest assessment on your high-value WordPress target that passed initial wp-mass-recon scoring, including all SSRF, credential mining, plugin CVE, and enumeration steps.