Security for Claude Code

Sector-specific recon for craft brewery, brewpub, and distillery websites — common e-commerce platforms (Untappd, Shopify, WooCommerce), age-gate patterns, event calendars, beer menu APIs, and online ordering systems. Typically WordPress, Shopify, or custom sites on shared hosting with taproom menus and merchandise stores.

Sector-specific recon for coffee shop, cafe, and tea house websites — typically WordPress on shared hosting with online ordering for pickup/delivery, loyalty/rewards programs, catering menus, and location/store finders. Common platforms include Toast POS, Square Online, ChowNow, and Olo for online ordering.

Sector-specific recon for carpet cleaning and water damage restoration company websites.

Sector-specific recon for car wash and auto detailing company websites — typically WordPress on shared hosting with membership plans, pricing menus, booking/scheduling tools, and customer account portals. Common platforms include EverWash, Washify, DRB Systems, and NTI for membership management.

Sector-specific recon for church/religious organization websites — WordPress on shared hosting with minimal security posture. Built from a 58-company mass recon dataset where church/religious org domains showed the highest rate of unpatched WordPress installs, CORS credential reflection, and exposed debug/config files. Use when the target scope includes non-profit, religious, or community organization domains — these are typically low-budget sites with no WAF, no security team, and shared hostin

Sector-specific recon for daycare/childcare organization websites — typically WordPress or custom PHP on shared hosting with minimal security posture. Built from sector analysis showing daycare sites have high rates of unpatched CMS installs, exposed contact-form entries with PII (child names, parent names, phone numbers, addresses), debug log exposure, directory listing on upload folders, and weak password policies. Use when the target scope includes daycare, childcare, preschool, or early-educ

Sector-specific recon for dentist, orthodontist, and dental practice websites — typically WordPress on shared hosting with online booking, patient portal integrations, and insurance verification pages. Common platforms include Dentrix Ascend, Eaglesoft, Open Dental, Curve Dental, and PatientConnect for practice management; typically WordPress or custom PHP on shared hosting with minimal security posture.

Sector-specific recon for gym, fitness center, and health club websites — common platforms include Mindbody, Mariana Tek, ClubReady, Glofox, PushPress, and Wodify for scheduling/booking; typically WordPress or custom PHP on shared hosting with member portals, class schedules, and payment integration.

Sector-specific recon for HVAC company websites — heating, cooling, AC repair, furnace installation. Typically WordPress on shared hosting with service booking, emergency contact forms, and seasonal maintenance plan pages.

Sector-specific recon for landscaping company websites — lawn care, tree service, irrigation, hardscaping, snow removal. Typically WordPress on shared hosting with photo galleries, booking tools, and seasonal service pages.

Sector-specific recon for laundromat, dry cleaning, and laundry service company websites — typically WordPress or custom PHP on shared hosting with pricing calculators, service area pages, pickup/delivery booking, and customer account portals. Common platforms include Cents, LaundryLocker, Washlava, and CleanCloud for POS/business management.

Sector-specific recon for mattress retailer and bedding store websites — common e-commerce platforms (Shopify, WooCommerce, BigCommerce), financing integration patterns (Affirm, Klarna, Bread, Synchrony), and mattress-in-a-box brand sites. Typically Shopify or WordPress/WooCommerce with product catalogs, financing calculators, and store locators.

Sector-specific recon for pet grooming, pet care, and dog walking company websites — typically WordPress on shared hosting with online booking, service menus, customer portals with pet profiles, and photo galleries. Common platforms include Gingr, PetExec, TimeToPet, PrecisePet for scheduling, and Rover/Wag! integration for pet-sitting.

Sector-specific recon for pool service and pool construction company websites — pool cleaning, repair, installation, hot tubs. Typically WordPress on shared hosting with booking systems, photo galleries, and seasonal service content.

Sector-specific recon for property management, apartment rental, and real estate management company websites — typically WordPress on shared hosting with rental listings, tenant portals, maintenance request systems, and online rent payment integrations. Built from a 20-target batch recon across US property management companies. Use when the target scope includes property management firms, apartment communities, rental agencies, real estate management, or HOA management company domains.

Sector-specific recon for roofing company websites — roof repair, replacement, inspection, storm damage. Typically WordPress or custom PHP on shared hosting with project galleries, insurance claim assistance pages, and estimate request forms.

Sector-specific recon for salon, barbershop, nail salon, and spa websites — common booking platforms include Booksy, Vagaro, Square Appointments, Mindbody, Fresha, and StyleSeat. Typically WordPress or custom PHP on shared hosting with online booking, service menus, and customer account portals.

Sector-specific recon for small business service provider websites — plumbers, HVAC, electricians, landscapers, roofers, painters, cleaners, contractors. Typically WordPress, Wix, Squarespace, or custom PHP on shared hosting with minimal security. These sites often have contact form PII leakage, debug log exposure, directory listing on uploads, outdated plugins, and weak authentication on admin panels. Use when the target scope includes local service businesses, trade contractors, or SMB service

Sector-specific recon for solar panel installer and renewable energy company websites.

Sector-specific recon for tree service company websites — arborist, tree removal, stump grinding, tree trimming. Common platforms include Arborgold, ArborNote, SingleOps, and Jobber for CRM/estimating; typically WordPress on shared hosting with photo galleries, service area pages, and free estimate forms.

Client-facing red-team deliverable format — codifies the Subject / Observations / Description / Impact / Recommendation / PoC structure used for external red-team engagements (not bug-bounty platform reports). Different audience, different tone, different cadence. Built from an authorized engagement deliverable where 14 findings were packaged into a 52KB MD + 2.2MB DOCX with 16 embedded screenshots. Use when the engagement is "external red team for an enterprise client" (not H1/Bugcrowd/Intigrit

Exploit public bucket Content-Type override for stored XSS on target origin.

Attack SAML SSO via XSW, signature strip, metadata extract.

Enumerate Hikvision ISAPI endpoints on SCADA and IoT web interfaces.

Pick sectors, compile targets, batch recon for campaigns.

Mass scan for exposed env files, backups, and git configs.

Hunt staging via crt.sh when production is WAF-hardened.

Launch stealth Chromium with C++ fingerprint patches for anti-bot bypass.

Map subdomains via crt.sh and subfinder at recon kickoff.

Detect and verify subdomain takeover via dangling CNAME to unclaimed services.

Spoof TLS ClientHello and JA4 fingerprints for browser impersonation.

Exploit unauthenticated multi-step API flows without credentials.

Discover hidden virtual hosts via Host header fuzzing and SSL certificate parsing.

Screenshot all live hosts for rapid visual triage and technology fingerprinting.

Sensitive file scanning, path traversal bypass, vHost enum, .env extract, log mining, Varnish detect

Proven attack chain combining CORS credential reflection on WordPress REST API with XMLRPC methods (system.multicall, wp.uploadFile) and open registration for full RCE. Built from field experience across 58-company mass recon where 5/7 deep targets had CORS credential reflection on WP REST API — including ecommerce-wine.com where the full chain was demonstrated end-to-end.

Hunt WP plugins via REST, exploit CVEs when version known.

Batch WP recon: users, CORS, XMLRPC, leaks across domains.

Scripts and workflows to batch-test popular WordPress plugin CVEs across hundreds of domains. Covers automated plugin detection, version extraction from readme.txt, CVE matching against a curated matrix of high-impact plugin vulnerabilities (ElementsKit, Revslider, WPDM, Gravity Forms, Contact Form 7, Jetpack, WP File Manager, GSpeech), and exploitation PoC generation. Use after initial WordPress detection recon — when you have a target list of WP domains and need to find which specific plugin C