skills.rest
EntroVyx
EntroVyxCOMMUNITY
Explore all skills by this author →
GitHub

recon-smb-services

Scan WordPress and shared hosting sites for security misconfigurations and PII exposure.

3|1|Updated Jul 2, 2026
Search Tags:#security#vulnerability#reconnaissance#wordpress#pii#smb
One-click install
npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill recon-smb-services-entrovyx
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: recon-smb-services
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/redteam/recon-smb-services
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill recon-smb-services-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires curl, grep, python3, jq, exiftool, and includes references (resource) components.

What problem does it solve?

This skill addresses the lack of automated, sector-specific reconnaissance for small business websites, which often suffer from poor security hygiene, exposed debug logs, and PII leakage.

Core Features & Use Cases

  • CMS Fingerprinting: Identifies WordPress, Wix, and other common platforms used by trade contractors.
  • Vulnerability Discovery: Automatically scans for exposed debug logs, directory listings, and outdated plugins that are common in SMB web environments.
  • Use Case: Use this skill to quickly audit a list of local HVAC or plumbing company websites to identify potential PII exposure in contact form uploads or misconfigured WordPress REST APIs.

Quick Start

Execute the recon-smb-services skill against the target domain list provided in smb-targets.txt to perform a full security triage.

Frequently Asked Questions about recon-smb-services

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan small business websites for exposed PII and security misconfigurations?▼

Small business website reconnaissance scans for security misconfigurations and PII exposure by targeting WordPress and shared hosting environments to detect exposed debug logs, directory listings, and vulnerable plugin patterns.

What is the best way to find exposed debug logs and directory listings on trade contractor sites?▼

Finding exposed debug logs and directory listings on trade contractor sites involves automated shell-based enumeration that detects common attack surfaces like XMLRPC, REST API endpoints, and exposed backup files.

Can I use this to audit a list of local plumbing or HVAC company websites for WordPress vulnerabilities?▼

You can audit a list of local HVAC or plumbing company websites by executing the skill against a target domain list to perform a full security triage for PII exposure in contact form uploads or misconfigured REST APIs.

Do I need curl and python3 to perform CMS fingerprinting on small business service sites?▼

CMS fingerprinting for small business service sites requires curl, python3, grep, jq, and exiftool to identify WordPress, Wix, and other common platforms used by trade contractors.

Does this reconnaissance tool detect outdated plugins in shared hosting environments?▼

Reconnaissance in shared hosting environments automatically scans for outdated plugins and common SMB web vulnerabilities by utilizing shell-based enumeration to identify vulnerable plugin patterns and misconfigurations.

What limitations exist when scanning for XMLRPC and REST API endpoints on small business domains?▼

Limitations when scanning for XMLRPC and REST API endpoints include targeting only WordPress and shared hosting environments, focusing on common attack surfaces rather than deep vulnerability exploitation.

Related Skills

Explore More Software Engineering Skills→
EntroVyxEntroVyx
3

recon-carpet-cleaning

Identifies exposed data and insecure configurations in WordPress-based service sites.

Community
Intermediate
EntroVyxEntroVyx
3

recon-breweries

Probe brewery websites for exposed APIs and misconfigured e-commerce platforms.

Community
Intermediate
EntroVyxEntroVyx
3

recon-dentists

Automates WordPress-based dental website vulnerability discovery including PHI exposure risks.

Community
Intermediate
EntroVyxEntroVyx
3

recon-plumbing

Automate reconnaissance of WordPress plumbing sites for PII exposure and misconfigurations.

Community
Intermediate