skills.rest
EntroVyx
EntroVyxCOMMUNITY
Explore all skills by this author →
GitHub

recon-churches

Scan church websites for WordPress vulnerabilities and misconfigurations.

3|1|Updated Jul 2, 2026
Search Tags:#vulnerability#web-security#enumeration#wordpress#recon#offsec
One-click install
npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill recon-churches-entrovyx
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: recon-churches
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/redteam/recon-churches
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill recon-churches-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires curl, jq, python3.

What problem does it solve?

This skill addresses the high vulnerability density found in church and religious organization websites, which are typically under-resourced, lack security infrastructure, and rely on outdated WordPress installations.

Core Features & Use Cases

  • Automated Vulnerability Triage: Rapidly identifies WordPress-specific risks like CORS credential reflection, open XMLRPC endpoints, and exposed debug logs.
  • Targeted Reconnaissance: Streamlines the discovery of subdomains and staging environments common in volunteer-maintained web infrastructure.
  • Use Case: Use this skill when performing authorized security assessments on non-profit or community domains to quickly map the attack surface and identify low-hanging fruit like misconfigured plugins or exposed configuration files.

Quick Start

Execute the recon-churches skill by providing the target domain to initiate a comprehensive scan of WordPress endpoints and common misconfigurations.

Frequently Asked Questions about recon-churches

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan a church website for WordPress vulnerabilities?▼

Scanning church websites for WordPress vulnerabilities involves checking for CORS credential reflection, XMLRPC exposure, and sensitive file leakage to identify misconfigurations common in volunteer-managed infrastructure.

What is the best way to enumerate misconfigurations on non-profit WordPress sites?▼

Enumerating misconfigurations on non-profit WordPress sites requires sector-specific reconnaissance to map attack surfaces and identify low-hanging fruit like misconfigured plugins or exposed configuration files.

How do I check for CORS credential reflection and XMLRPC exposure?▼

Checking for CORS credential reflection and XMLRPC exposure requires executing automated vulnerability triage scripts that send targeted requests to WordPress endpoints and analyze responses for insecure configurations.

Does this reconnaissance approach work for shared hosting environments without a WAF?▼

This reconnaissance approach is designed for shared hosting environments without WAF protection, targeting the specific characteristics of volunteer-maintained web infrastructure common to religious organizations.

Do I need curl and jq to perform automated WordPress vulnerability triage?▼

You need curl, jq, and python3 installed to perform automated WordPress vulnerability triage, as these dependencies are required to execute reconnaissance checks and process resulting data.

When should I not use automated vulnerability scanning on community domains?▼

You should not use automated vulnerability scanning on community domains without explicit authorization, as these reconnaissance techniques target live WordPress endpoints and can trigger security alerts or disrupt services.

Related Skills

Explore More Software Engineering Skills→
woohyun212woohyun212
21

cert-transparency

Query crt.sh Certificate Transparency logs to extract deduplicated subdomains.

Community
Intermediate
jinyimeng01jinyimeng01
54

exploit-agent

Validate suspected web vulnerabilities and generate structured exploit reports.

Community
Advanced
Mikacr1138Mikacr1138
2

web2-recon

Automate web2 reconnaissance from subdomain enumeration to JS analysis.

Community
Intermediate
EntroVyxEntroVyx
3

recon-dentists

Automates WordPress-based dental website vulnerability discovery including PHI exposure risks.

Community
Intermediate