skills.rest
uphiago
uphiagoCOMMUNITY
Explore all skills by this author →
Website𝕏@uphiagoGitHub

recon-smb-services

Run a 7-phase reconnaissance workflow on small business service websites.

1.1k|191|Updated Jun 24, 2026
Search Tags:#wordpress#pentest#recon#vulnerability-scan#attack-chains#smb-sites#pii-leak
One-click install
npx skills add https://github.com/uphiago/recon-skills --skill recon-smb-services
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: recon-smb-services
Source: https://github.com/uphiago/recon-skills/tree/main/redteam/recon-smb-services
Command: npx skills add https://github.com/uphiago/recon-skills --skill recon-smb-services

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Small business service provider websites (plumbers, HVAC technicians, electricians, landscapers, etc.) are frequently built on low-budget, poorly maintained stacks with minimal security, making them easy targets for common, high-impact vulnerabilities that standard recon workflows often miss. This skill provides a targeted, sector-specific workflow to efficiently identify these overlooked flaws without wasting time on irrelevant checks.

Core Features & Use Cases

  • 7-phase targeted recon workflow: Covers domain discovery, CMS fingerprinting, contact form PII leak detection, plugin vulnerability scanning, booking tool SSRF surface identification, EXIF geolocation analysis, and pre-built attack chain guidance.
  • Sector-specific vulnerability patterns: Focuses on flaws unique to SMB service sites including exposed debug logs with customer PII, directory listing on uploads with invoices/estimates, outdated booking plugins with webhook SSRF, CORS credential reflection on WordPress REST API, and EXIF geolocation data in work gallery photos.
  • Use Case: A red teamer scoping a local HVAC company can use this skill to quickly find exposed debug logs containing customer names and addresses, outdated Bookly booking plugins with modifiable webhook URLs, and CORS flaws enabling user enumeration in minutes instead of hours.

Quick Start

Use the recon-smb-services skill to perform a full reconnaissance of a target small business service provider website and identify all high-yield common vulnerabilities for authorized penetration testing.

Frequently Asked Questions about recon-smb-services

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find security vulnerabilities on small business service websites?▼

To find security vulnerabilities on small business service sites, use a 7-phase recon workflow covering domain discovery, CMS fingerprinting, contact form PII leak detection, plugin scanning, booking tool SSRF identification, and EXIF geolocation analysis.

What common vulnerabilities are found on WordPress sites for local contractors?▼

Common vulnerabilities on local contractor WordPress sites include exposed debug logs with customer PII, directory listing on invoice uploads, outdated booking plugins with webhook SSRF, and CORS credential reflection on the REST API.

What is the best way to detect PII leaks during a pentest of an HVAC or plumbing site?▼

The best way to detect PII leaks during a pentest of an HVAC or plumbing site is checking for exposed debug logs, directory listing on invoice uploads, and EXIF geolocation data in work gallery photos.

Does this reconnaissance workflow work on Wix and Squarespace sites?▼

Yes, this reconnaissance workflow works on Wix and Squarespace sites, alongside low-budget custom PHP and WordPress installations on shared hosting commonly used by small business service providers.

Can I identify SSRF attack surfaces on booking tools for red team engagements?▼

Yes, you can identify SSRF attack surfaces on booking tools by targeting outdated plugins with modifiable webhook URLs, a specific flaw combination covered in the pre-built attack chain guidance.

When should I not use a sector-specific workflow for vulnerability scanning?▼

You should not use a sector-specific vulnerability scanning workflow when targeting enterprise environments or non-service business sites, as the checks for SMB flaws like shared hosting misconfigurations will waste time.

Related Skills

Explore More Software Engineering Skills→
jassicsjassics
6

recon

Coordinates passive and active enumeration of authorized attack surfaces for penetration testing.

Community
Intermediate
TykoDevTykoDev
9

mr-robot

Identify attack surfaces and entry points in codebases for adversarial analysis.

Community
Advanced
macaughmacaugh
5

Service Fingerprinting

Detect network services and versions on discovered hosts via active probing.

Community
Advanced
uphiagouphiago
1.1k

recon-bakeries

Fingerprint bakery e-commerce platforms and probe exposed ordering APIs.

Community
Intermediate