sector-recon-methodology – Security skill for AI agents

Sector Recon Methodology Skill

Methodology for selecting non-regulated industry sectors with the highest WordPress vulnerability rates, compiling company domain lists, and running batch reconnaissance within authorized engagements. Distilled from surveying 600+ US company domains across 28 sectors under bug bounty and authorized testing programs.

When to Use

• Planning a new recon campaign and need to choose sectors.
• Expanding from tested sectors into new ones.
• Building target lists from sector keywords via crt.sh.
• After recon-playbook Phase 0 — this skill provides the sector intelligence.
• Comparing your findings against baseline vulnerability rates per sector.

Prerequisites

• curl, jq, httpx, and subfinder.
• Understanding of the US regulatory landscape (HIPAA, GLBA, PCI-DSS) — regulated sectors have near-zero vulnerability rates.
• An execution environment with explicit concurrency and rate limits.

How to Run

# Generate targets for a sector
SECTOR="landscaping"
curl --max-time 30 --connect-timeout 10 -sk "https://crt.sh/?q=%25.${SECTOR}%25&output=json" | jq -r '.[].name_value' | \
  sed 's/\*\.//g' | sed 's/^www\.//' | sort -u > ${SECTOR}_targets.txt

Script: scripts/parallel_sector_probe.py — OPSEC-controlled batch probe with random delays, generates per-domain findings files. Run python3 scripts/parallel_sector_probe.py targets.txt output_dir/ for a full WP/CORS/XMLRPC/leak scan.

Quick Reference

| Tier | Sectors | Typical WP Rate | Best Pattern | Notes |

|------|---------|----------------|--------------|-------|

| 1 | Law, Landscaping, Pools, Pest, Roofing, Dental, Gyms, Real Estate, HVAC, Property, Auto Repair, Photography | 30-50% | CORS + WP users | Minimal WAF, GoDaddy/Bluehost |

| 2 | Cleaning, Moving, Accounting, Septic, Window, Car Wash, Bakery, Locksmith, Solar, Chimney, Fire, Pet Grooming | 20-40% | Source leaks, CORS | Mixed hosting, some WAF |

| 3 | Car Dealers, Insurance, Travel, Banks, Healthcare | 0-5% | N/A | Enterprise WAF, regulated, no WP |

Sector Vulnerability Rankings

Tier 1 — High Yield (15-25% vulnerability rate)

| Sector | Vuln Rate | Top Pattern | WordPress Rate | WAF Protection | Best Targets |

|--------|-----------|-------------|----------------|----------------|-------------|

| Law Firms | 25% | P-06 (CORS auth) | ~30% | Minimal | Solo/small firm, GoDaddy-hosted |

| Landscaping | 20% | WP-01 (user enum) | ~50% | Minimal | Local SMB, franchise model |

| Pool Services | 20% | WP-01 (user enum) | ~45% | Minimal | Summer-seasonal businesses |

| Pest Control | 20% | P-02 (CORS) | ~40% | Minimal | Franchise-heavy |

| Roofing | 15% | WP-01, P-17 | ~45% | Minimal | Local contractors |

| Dental Clinics | 15% | WP-01 (user enum) | ~35% | Some | Single-dentist practices |

| Gyms/Fitness | 15% | WP-01 (user enum) | ~40% | Some | CrossFit, yoga, martial arts |

| Real Estate | 15% | P-02 (CORS) | ~40% | Some | Independent brokerages |

| HVAC/Plumbing | 14% | WP-01, P-02 | ~35% | Some | Franchise-heavy, staging common |

| Property Management | 15% | P-02 (CORS) | ~30% | Some | PII-heavy sector |\n| Auto Repair | 11% | WP-01 | ~30% | Some | Independent shops |

| Photography | 10% | WP-01 (user enum) | ~50% | Some | Portfolio sites, often WP |

| Funeral Homes | 10% | WP-01 (user enum) | ~33% | Minimal | WordPress + user enum found on 2 targets (funeral.example.com, memorial.example.com) |

| Senior Living | 17% | P-02 (CORS) + XMLRPC | ~33% | Cloudflare | senior-living.example.com (80 XMLRPC methods + CORS + multicall), senior-living2.example.com (CORS) — 2/12 tested = CRITICAL findings |\n\nPrioritize these sectors in authorized engagements. Small to medium businesses, typically self-managed WordPress on shared hosting.

Tier 2 — Medium Yield (5-14% vulnerability rate)

| Sector | Vuln Rate | Notes |

|--------|-----------|-------|

| Cleaning Services | 13% | Carpet, window, mold remediation |

| Moving Companies | 6% | Fewer WP, more SaaS platforms |

| Accounting/CPA | 5% | Some regulated, some not — financial data at risk |

| Septic Services | 25% source leaks | Massive source leak rate (.env, .git, wp-config) |

| Window Cleaning | 25% CORS | Small operations, DIY WP |

| Car Washes | 20% source leaks | Dockerfile, swagger, actuator endpoints common |

| Bakeries | 18% CORS wildcard | 28 leaked files on one target |

| Locksmiths | 20% WP users + XMLRPC | 38 subdomains on one target |

| Solar Installers | Minimal | Major brands use enterprise platforms |

| Chimney Sweeps | ~10% CORS + XMLRPC | Small family businesses, WP common |

| Fire Restoration | ~10% | Franchise model (Servpro, Belfor) |

| Pet Grooming | 20% WP users | Dogtopia, Camp Bow Wow — WP detected |

Critical Finding Example (from 248-target new sector expansion)

pool-company.example.com — Critical (Score 9):

• 3 users exposed via REST API (wpadmin ID=1 — default admin account)
• CORS credential reflection confirmed
• XMLRPC system.multicall active
• Attack chain: CORS phishing → exfiltrate user data → brute force wpadmin via XMLRPC multicall → full site takeover

Tier 3 — Zero/Low Yield (0-3% vulnerability rate)

| Sector | Vuln Rate | Why |

|--------|-----------|-----|

| Car Dealerships | 0% | Enterprise CDK/Dealertrack platforms, not WordPress |\n| Furniture Retail | 0% | Major brands (Ashley, Wayfair, Crate&Barrel, Pottery Barn) behind Cloudflare/WAF — 11/15 returned 403/429 |\n| Insurance | 0% | Enterprise portals, heavily WAF'd |

| Travel Agencies | 0% | SaaS (Sabre, Amadeus), not self-hosted |

| Banks/Credit Unions | 0% | GLBA regulated, mandatory security |

| Major Healthcare | 0% | HIPAA regulated, HITRUST certified |

| Home Services | 0% | Angi/Thumbtack platforms, not self-hosted |

Skip these sectors unless you have specific intelligence suggesting WordPress usage.

Procedure

Step 1 — Sector Selection

OUTDIR="$OUTDIR/sectors"
mkdir -p "$OUTDIR"

echo "[*] Sector vulnerability potential assessment:"
echo ""

# Run quick sector probe: crt.sh → httpx → WP detection → user count
probe_sector() {
  local sector="$1"
  local file="$OUTDIR/${sector}_probe.txt"

  echo "[*] Probing sector: $sector"

  # Get domains from crt.sh
  curl -sk --max-time 20 --connect-timeout 10 "https://crt.sh/?q=%25.${sector}%25&output=json" 2>/dev/null | \
    jq -r '.[].name_value' 2>/dev/null | sed 's/\*\.//g' | sed 's/^www\.//' | \
    grep -E '^[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$' | sort -u | head -50 > "$OUTDIR/${sector}_domains.txt"

  # Option C: Manual known-company list (when crt.sh/subfinder time out)
  if [[ ! -s "$OUTDIR/${sector}_domains.txt" ]]; then
    echo "  crt.sh empty — using manual known-company list"
    # Generate known US companies in this sector
    # Example: for "vet" or "pet_care" sector, known chains include:
    cat > "$OUTDIR/${sector}_domains.txt" << 'EOF'
[VET_CLINIC]
[VET_CHAIN]
[PET_RETAILER]
[VET_CORPORATE]
[VET_HOSPITAL]
[VET_SPECIALIST]
[ANIMAL_CLINIC]
[VET_CLINIC]
[TRADE_PUBLICATION]
EOF
  fi

  local total=$(wc -l < "$OUTDIR/${sector}_domains.txt")
  echo "  Domains: $total"

  # Probe with httpx
  httpx -silent -l "$OUTDIR/${sector}_domains.txt" -threads 30 -status-code -tech-detect \
    -o "$OUTDIR/${sector}_alive.txt" 2>/dev/null

  local alive=$(wc -l < "$OUTDIR/${sector}_alive.txt")
  echo "  Live: $alive"

  # WordPress count
  local wp=$(grep -ci 'wordpress' "$OUTDIR/${sector}_alive.txt" 2>/dev/null || echo 0)
  echo "  WordPress: $wp"

  # Quick user enumeration on WP targets
  local users=0
  grep -i 'wordpress' "$OUTDIR/${sector}_alive.txt" 2>/dev/null | awk '{print $1}' | head -10 | while read -r url; do
    ucount=$(curl -sk --max-time 5 --connect-timeout 5 "$url/wp-json/wp/v2/users" 2>/dev/null | python3 -c "import sys,json; d=json.load(sys.stdin); print(len(d) if isinstance(d,list) else 0)" 2>/dev/null || echo 0)
    [[ "$ucount" -gt 0 ]] && echo "    $url: $ucount users" >> "$OUTDIR/${sector}_users.txt"
  done

  local user_targets=$(wc -l < "$OUTDIR/${sector}_users.txt" 2>/dev/null || echo 0)
  echo "  User leaks: $user_targets"

  # Score the sector
  echo "$sector | domains=$total | alive=$alive | wp=$wp | user_leaks=$user_targets" >> "$OUTDIR/sector_scores.txt"
}

# Probe top candidate sectors
for sector in "landscaping" "roofing" "hvac" "pools" "plumbing" "lawn-care" \
  "pest-control" "law-firm" "dentist" "gym" "real-estate" "auto-repair" \
  "moving-company" "photography" "cleaning-service" "church"; do
  probe_sector "$sector"
  sleep 3  # Rate limit
done

echo ""
echo "[*] Sector scores:"
sort -t'|' -k5 -rn "$OUTDIR/sector_scores.txt" 2>/dev/null | head -15

Step 2 — Target List Compilation

OUTDIR="$OUTDIR/sectors"

# For selected high-yield sectors, compile full target lists
SELECTED_SECTORS=("landscaping" "roofing" "pools" "plumbing" "pest-control" "law-firm")

echo "[*] Compiling target lists for selected sectors..."

> "$OUTDIR/all_targets.txt"

for sector in "${SELECTED_SECTOR

… (full content is in the download package)