recon-hvac

What problem does it solve?

HVAC company websites are frequently built by local agencies using cookie-cutter WordPress configurations, have urgent emergency booking features with lax security validation, and store sensitive customer PII in maintenance plan portals and form uploads, making them high-value targets that require tailored recon techniques to identify common, sector-specific vulnerabilities that generic recon workflows miss.

Core Features & Use Cases

• Sector-specific domain discovery: Targets HVAC company naming conventions and SEO-driven domain patterns to find all associated assets.
• Feature-focused vulnerability checks: Specialized scans for common HVAC site features like emergency booking forms, maintenance plan portals, and smart thermostat integrations that often expose unauthenticated data or API keys.
• Pre-built WordPress and plugin checks: Tests for WordPress configurations, debug logs, and plugins commonly used across HVAC sites built by local agencies, with real-world examples of observed vulnerabilities in the sector. Use case: A pentester targeting an HVAC company can use this skill to quickly identify exposed debug logs with customer PII, directory listings with service invoices, or unauthenticated access to maintenance plan customer data, rather than running generic web recon that misses these sector-specific weaknesses.

Quick Start

Use the recon-hvac skill to perform a full sector-specific recon of the target HVAC company domain, including domain discovery, WordPress configuration checks, and feature-specific vulnerability scanning for common HVAC site assets.