wp-mass-recon – Security skill for AI agents

WP Mass Recon Skill

Batch WordPress vulnerability detection pipeline for scanning dozens to hundreds of domains in parallel. Detects WordPress presence, REST API user enumeration, CORS credential reflection, XMLRPC exposure, open registration, and sensitive file leaks in a single pass. Proven on 600+ US company domains across 28 sectors.

When to Use

• You have an authorized target list from a bug bounty program, pentest engagement, or red team with signed RoE.
• Sector-wide recon within authorized scope.
• After subfinder/crt.sh produces a target list and you need to triage.
• You want maximum findings per minute with a parallelizable pipeline.

Prerequisites

• curl, httpx, python3, and jq.
• A target list in domain|company|sector format, one target per line.
• A writable OUTPUT_DIR; examples default to ./output.
• The bundled scanner or the inline commands below.

How to Run

# Phase 1: Live host discovery + tech detection
httpx -silent -l targets.txt -threads 50 -tech-detect -status-code -title -o $OUTDIR/alive.txt

# Phase 2: WP detection, user enum, CORS, XMLRPC (20 workers)
python3 parallel_batch.py "${OUTPUT_DIR:-./output}/targets.txt" 20

Or run the 4-phase pipeline manually using the commands in Procedure.

Quick Reference

| Check | Command | Positive Signal |

|-------|---------|-----------------|

| WP detection | curl -skI "https://TARGET/wp-login.php" | HTTP 200/301/302 |

| User enum | curl --max-time 30 --connect-timeout 10 -sk "https://TARGET/wp-json/wp/v2/users" | JSON with id, name, slug |

| CORS | curl -skI "https://TARGET/wp-json/wp/v2/users" -H "Origin: https://evil.com" | Access-Control-Allow-Credentials: true |

| XMLRPC | curl --max-time 30 --connect-timeout 10 -sk -X POST "https://TARGET/xmlrpc.php" -d '<methodCall><methodName>demo.sayHello</methodName></methodCall>' | Hello! in body |

| Open reg | curl --max-time 30 --connect-timeout 10 -sk "https://TARGET/wp-login.php?action=register" | Form with user_login field |

| Source leaks | Parallel curl for .env, wp-config.php.bak, .git/config, debug.log, backup.sql | Real content (not SPA catch-all) |

Procedure

Phase 1 — Target Preparation

# Generate target list from crt.sh sector keywords
for sector in "landscaping" "roofing" "hvac" "pools" "plumbing"; do
  curl --max-time 30 --connect-timeout 10 -sk "https://crt.sh/?q=%25.${sector}%25&output=json" | jq -r '.[].name_value' | sed 's/\*\.//g' | sort -u >> $OUTDIR/discovered.txt
done

# Filter to unique domains, remove www prefix
cat $OUTDIR/discovered.txt | sed 's/^www\.//' | sort -u > $OUTDIR/unique_domains.txt

Phase 2 — Live Host Discovery

# httpx with tech detection, 50 threads
httpx -silent -l $OUTDIR/unique_domains.txt -threads 50 -tech-detect -status-code -title \
  -o $OUTDIR/alive.txt

# Parse to URL list
awk '{print $1}' $OUTDIR/alive.txt | grep -E '^https?://' > $OUTDIR/urls.txt

Phase 3 — Parallel Vulnerability Scan

For each live target, run in parallel (20 workers):

while read -r url; do
  domain=$(echo "$url" | sed 's|https\?://||')
  (
    echo "# $domain Findings" > "$OUTDIR/findings/${domain}_findings.md"

    # WP detection
    wp_code=$(curl -sk -o /dev/null -w "%{http_code}" --max-time 10 --connect-timeout 10 "$url/wp-login.php")
    [[ "$wp_code" =~ ^(200|301|302|403)$ ]] && echo "- WordPress: YES (wp-login: $wp_code)" >> "$OUTDIR/findings/${domain}_findings.md"

    # User enumeration
    users=$(curl -sk --max-time 10 --connect-timeout 10 "$url/wp-json/wp/v2/users" | python3 -c "import sys,json; d=json.load(sys.stdin); print(len(d) if isinstance(d,list) else 0)" 2>/dev/null)
    [[ "$users" -gt 0 ]] && echo "- Users exposed: $users" >> "$OUTDIR/findings/${domain}_findings.md"

    # CORS credential reflection
    cors=$(curl -skI --max-time 10 --connect-timeout 10 "$url/wp-json/wp/v2/users" -H "Origin: https://evil.com" 2>/dev/null | grep -i "access-control-allow-credentials: true")
    [[ -n "$cors" ]] && echo "- CORS: CREDENTIAL REFLECTION CONFIRMED" >> "$OUTDIR/findings/${domain}_findings.md"

    # XMLRPC
    xmlrpc=$(curl -sk -o /dev/null -w "%{http_code}" --max-time 10 --connect-timeout 10 -X POST "$url/xmlrpc.php" \
      -d '<?xml version="1.0"?><methodCall><methodName>demo.sayHello</methodName></methodCall>')
    [[ "$xmlrpc" == "200" ]] && echo "- XMLRPC: OPEN" >> "$OUTDIR/findings/${domain}_findings.md"

    # Open registration
    reg=$(curl -sk --max-time 10 --connect-timeout 10 "$url/wp-login.php?action=register" | grep -o 'user_login')
    [[ -n "$reg" ]] && echo "- Open Registration: YES" >> "$OUTDIR/findings/${domain}_findings.md"

    # Source leaks (parallel)
    for path in ".env" "wp-config.php.bak" ".git/config" "debug.log" "backup.sql" "info.php" "phpinfo.php" "wp-config.php~" ".env.backup" ".env.local" "docker-compose.yml" "Dockerfile"; do
      leak_code=$(curl -sk -o /dev/null -w "%{http_code}" --max-time 5 --connect-timeout 5 "$url/$path")
      if [[ "$leak_code" == "200" ]]; then
        content=$(curl -sk --max-time 5 --connect-timeout 5 "$url/$path" | head -c 500)
        # False positive filter: skip SPA catch-alls
        if echo "$content" | grep -qiE 'DB_|APP_|_KEY|_SECRET|password|mysql|\[core\]|PHP Version|CREATE TABLE'; then
          echo "- Source leak: /$path (VERIFIED)" >> "$OUTDIR/findings/${domain}_findings.md"
        fi
      fi
    done
  ) &
  # Limit to 20 parallel workers
  while [[ $(jobs -r | wc -l) -ge 20 ]]; do sleep 0.5; done
done < $OUTDIR/urls.txt
wait

Phase 4 — Consolidation

# Generate summary
echo "## Mass Recon Summary" > $OUTDIR/mass_summary.md
echo "" >> $OUTDIR/mass_summary.md
for f in $OUTDIR/findings/*_findings.md; do
  domain=$(basename "$f" _findings.md)
  criticals=$(grep -c "CRITICAL\|CREDENTIAL REFLECTION\|XMLRPC: OPEN\|Source leak: VERIFIED" "$f" || true)
  [[ "$criticals" -gt 0 ]] && echo "- **$domain**: $criticals findings" >> $OUTDIR/mass_summary.md
done

# Rank targets by finding count
grep "^\- \*\*" $OUTDIR/mass_summary.md | sort -t: -k2 -rn | head -20

Production Scanner (Python — parallel_batch.py pattern)

The production-proven approach uses concurrent.futures.ThreadPoolExecutor with 20 workers. Each worker calls curl via subprocess.run. This is 10x faster than bash while loops.

import concurrent.futures, subprocess, json

def curl_code(url, timeout=8):
    cmd = ["curl", "-sk", "-m", str(timeout), "-o", "/dev/null", "-w", "%{http_code}", url]
    r = subprocess.run(cmd, capture_output=True, timeout=timeout+5)
    return r.stdout.decode().strip()

def test_target(domain):
    # Determine protocol
    proto = None
    for p in ["https", "http"]:
        code = curl_code(f"{p}://{domain}/")
        if code not in ["000", ""]: proto = p; break
    if not proto: return None

    # WP detection (v2 strict: check login OR json)
    login_code = curl_code(f"{proto}://{domain}/wp-login.php")
    json_code = curl_code(f"{proto}://{domain}/wp-json/")
    is_wp = login_code not in ["000","404",""] or json_code not in ["000","404",""]

    if not is_wp: return {"domain":domain, "is_wp":False}

    score = 1  # WordPress detected
    findings = ["wordpress"]

    # Users (v2 pattern: parse JSON, check list length)
    body, _ = curl_raw(f"{proto}://{domain}/wp-json/wp/v2/users")
    try:
        data = json.loads(body.decode())
        if isinstance(data, list) and len(data) > 0:
            findings.append(f"wp_users_{len(data)}")
            score += 2
    except: pass

    # CORS (v2 pattern: explicit -I header check)
    cmd = ["curl","-sk","-m","8","-I","-H","Origin: https://evil.com",
           f"{proto}://{domain}/wp-json/wp/v2/users"]
    r = subprocess.run(cmd, capture_output=True, timeout=10)
    hdrs = r.stdout.decode().lower()
    acao = [l.split(":",1)[1].strip() for l in hdrs.split('\n') if 'access-control-allow-origin:' in l]
    acac = [l.split(":",1)[1].strip() for l in hdrs.split('\n') if 'access-control-allow-credentials:' in l]
    if acao and "evil.com" in acao[0] and acac and acac[0] == "true":
        findings.append("cors_credentialed")
        score += 3

    # XMLRPC (v2 pattern: system.listMethods, check for multicall string)
    xml = '<?xml version="1.0"?><methodCall><methodName>system.listMethods</methodName></methodCall>'
    body, _ = curl_raw(f"{proto}://{domain}/xmlrpc.php", method="POST", data=xml)
    txt = body.decode()
    if "system.multicall" in txt:
        findings.append("xmlrpc_multicall")
        score += 3
    elif "methodName" in txt:
        findings.append("xmlrpc_active")

    # Open registration (v2 pattern: three-string check avoids false positives)
    body, _ = curl_raw(f"{proto}://{domain}/wp-login.php?action=register")
    rt = body.decode().lower()
    if "register" in rt and "user_login" in rt and "wp-submit" in rt:
        findings.append("registration_open")
        score += 2

    # Severity (

… (full content is in the download package)