recon-automotive-dealers

Name: recon-automotive-dealers
Availability: InStock
Author: entrovyx

Automates reconnaissance and vulnerability discovery for automotive dealership websites.

3|1|Updated Jul 2, 2026

Search Tags:#vulnerability #api #wordpress #pentest #recon #automotive

Ready to run

npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill recon-automotive-dealers-entrovyx

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: recon-automotive-dealers
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/redteam/recon-automotive-dealers
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill recon-automotive-dealers-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill automates the discovery of security vulnerabilities across automotive dealership websites, which are often overlooked and prone to misconfigurations due to standardized, cookie-cutter CMS deployments.

Core Features & Use Cases

Automated Reconnaissance: Identifies subdomains, CMS versions, and exposed sensitive files like debug logs or credit application directories.
Vulnerability Assessment: Checks for common dealer-specific flaws including CORS misconfigurations, XMLRPC exposure, and unauthenticated inventory API access.
Use Case: Quickly audit a network of car dealership sites to identify exposed PII in credit applications or unauthorized access to vehicle inventory databases.

Quick Start

Use the recon-automotive-dealers skill to perform a full security audit on the target domain example-dealer.com.

Frequently Asked Questions about recon-automotive-dealers

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I find exposed PII in automotive dealership WordPress portals?▼

To find exposed PII in automotive dealership WordPress portals, you can automate reconnaissance to identify exposed credit application directories and inventory API misconfigurations. This approach scans standardized CMS deployments to locate sensitive files like debug logs.

Can I scan OEM-branded dealer websites for unauthenticated inventory API access?▼

Yes, you can scan OEM-branded dealer websites for unauthenticated inventory API access by checking discovery endpoints. The skill parses JSON responses from these endpoints to identify unauthorized access to vehicle inventory databases.

What is the best way to detect CORS misconfigurations and XMLRPC exposure on car dealer sites?▼

The best way to detect CORS misconfigurations and XMLRPC exposure on car dealer sites is through automated vulnerability assessment. It targets common dealer-specific flaws across standardized CMS deployments to quickly audit network security.

Do I need Python and standard Unix utilities to perform recon on automotive retail networks?▼

Yes, you need Python and standard Unix utilities to perform recon on automotive retail networks. Python is specifically required for parsing JSON responses returned from discovery endpoints during the automated reconnaissance process.

Why are automotive dealership websites prone to security misconfigurations during a pentest?▼

Automotive dealership websites are prone to security misconfigurations because they rely on standardized, cookie-cutter CMS deployments. These standardized deployments are frequently overlooked in security audits, leading to exposed sensitive files and API flaws.

What subdomains and CMS versions should I check when auditing automotive retail networks?▼

When auditing automotive retail networks, you should check subdomains and WordPress CMS versions to identify exposed sensitive files. Automated reconnaissance maps these components to uncover inventory API access issues and credit application directory exposures.