recon-sector-expansion

Automate pentest target discovery by using a batch workflow that queries certificate transparency logs and Google to find 20+ untested domains across local service and national chain verticals. This replaces manual searches with a repeatable pipeline for fresh coverage.

You can run CORS and WordPress vulnerability scanning in a single batch session. The pipeline automatically probes discovered domains with httpx, then executes WordPress enumeration, CORS testing, XMLRPC checks, and port scanning across all alive targets.

The best way to avoid retesting already scanned domains is to run an automated coverage audit before discovery. This checks existing target lists against newly found domains from certificate transparency and Google searches to ensure your batch expansion only targets fresh assets.

This batch recon workflow uses different discovery methods based on sector type. It queries crt.sh certificate transparency logs for local service sectors like roofing and HVAC, while using Google search to find national chain domains across dental, gym, and auto body verticals.

Score vulnerability severity for newly discovered domains by running a full 6-step testing pipeline that includes httpx probing, WordPress enumeration, CORS testing, XMLRPC checks, and port scanning. The workflow automatically calculates severity scores to identify high and medium findings.

Limitations when using Google search for domain discovery include relying on search engine indexing and query limits for national chain sectors. To ensure comprehensive batch coverage across 20+ business verticals, the workflow pairs Google search with crt.sh certificate transparency log queries.