RECON-SMB-SERVICES — Sector-Specific Recon for Small Business Service Provider Sites

When to Use

Use when the target scope includes small business service provider domains — plumbers, HVAC, electricians, landscapers, roofers, painters, carpet cleaners, pest control, movers, contractors. These are characterized by:

• Low-budget web presence — DIY site builders, $10/month shared hosting, no security team
• Contact-form dependency — leads come through site forms, stored in plugin upload dirs or emailed
• Photo galleries of work — before/after photos with EXIF data (geolocation, device info)
• Estimation/quote tools — often custom-coded calculators with injection potential
• Review/SEO plugins — Google Reviews, Yelp, BBB badges — third-party JS injection surface
• Booking/scheduling tools — embedded Calendly, Acuity, Bookly — SSRF surface via webhook URLs

Quick Reference

Pattern catalog: See references/wave9-pattern-catalog.md — 25 attack patterns (P-01 through P-25), 8 CORS bypass variations, 18 WordPress abuse patterns, 12 sector-specific attack matrices with hit rates and top targets, drop-in browser PoC HTML, and highest-yield command sequences.