Identify sector-specific security vulnerabilities in car wash business websites.
npx skills add https://github.com/uphiago/recon-skills --skill recon-carwashes
Please help me install this Agent Skill. Skill: recon-carwashes Source: https://github.com/uphiago/recon-skills/tree/main/redteam/recon-carwashes Command: npx skills add https://github.com/uphiago/recon-skills --skill recon-carwashes
This skill addresses the gap in generic reconnaissance workflows for car wash and auto detailing business websites, which are often small-to-medium operations running WordPress, membership portals, and booking systems that store sensitive customer PII and are frequently targeted by attackers.
Use the recon-carwashes skill to perform full sector-specific reconnaissance on a target car wash company domain, including membership portal discovery, WordPress vulnerability checks, and booking system analysis.
High-intent search queries and answers about installing and using this skill.
To find vulnerabilities in car wash websites, scan for exposed WordPress debug logs containing customer PII, directory listing on upload directories, and outdated booking plugin versions. This targets membership portals and booking systems common to auto detailing operations.
Common flaws include CORS misconfigurations on REST APIs, exposed debug logs with customer PII, directory listing on photo galleries, EXIF data exposure in public photos, and outdated booking plugin versions that enable data theft.
Generic workflows frequently miss sector-specific flaws in auto detailing websites. Targeted reconnaissance is needed to enumerate subdomains for membership portals, staging environments, and booking pages unique to car wash operations.
To scan for EXIF data exposure, check directory listing on photo gallery upload directories. This identifies unpatched WordPress configurations leaking sensitive metadata from public customer photos during penetration testing.
Yes, small-to-medium car wash operators need sector-specific checks for exposed membership data and vulnerable third-party booking integrations. Standard scans often miss these targeted WordPress and REST API misconfigurations.
autostay-krGenerates dual-sided user stories for an O2O car wash subscription service.
uphiagoIdentify exposed PII, payment endpoints, and misconfigurations on plumbing company websites.
EntroVyxEnumerate WordPress landscaping sites for misconfigurations and vulnerable plugins.
EntroVyxAutomate sector-specific reconnaissance for WordPress pool service websites to detect security misconfigurations.
