recon-landscaping

RECON-LANDSCAPING — Sector-Specific Recon for Landscaping Company Sites

When to Use

Use when the target scope includes landscaping, lawn care, tree service, irrigation, or hardscaping company domains. These sites are characterized by WordPress on shared hosting with photo galleries of work, online booking/estimating features, and seasonal service page structures. Common vulnerabilities: directory listing on work photo galleries with EXIF data, exposed debug logs, CORS credential reflection, and booking plugin vulnerabilities.

Quick Reference

for t in $(cat landscaping-targets.txt); do
  echo "=== $t ==="
  curl -skI "https://$t/" | grep -iE "wordpress|php|wp-"
  curl -sk -o /dev/null -w "%{http_code}" "https://$t/wp-content/debug.log"
  curl -sk -o /dev/null -w "%{http_code}" "https://$t/wp-content/uploads/"
  curl -skI "https://$t/wp-json/wp/v2/users" -H "Origin: https://evil.com" | grep -i "access-control"
  echo "---"
done

Step-by-Step

Phase 1 — Domain Discovery

# Common naming: <city>landscaping.com, <name>lawncare.com, <area>treeservice.com
# crt.sh enumeration
curl -sk "https://crt.sh/?q=%25.$TARGET&output=json" | python3 -c "
import sys, json
try:
    data = json.load(sys.stdin)
    domains = sorted(set(d['name_value'] for d in data))
    for d in domains: print(d)
except: pass
" | tee landscaping-subdomains-$TARGET.txt

Phase 2 — WordPress Recon + Gallery Discovery

# CORS on REST API
curl -skI "https://$TARGET/wp-json/wp/v2/users" -H "Origin: https://evil.com"

# Gallery directory listing (landscaping companies heavily rely on before/after photos)
for path in /wp-content/uploads/ /images/gallery/ /galleries/ /portfolio/ /our-work/ /projects/; do
  body=$(curl -sk "https://$TARGET$path" 2>/dev/null)
  if echo "$body" | grep -q "Index of"; then
    echo "[!!!] DIRECTORY LISTING: $path"
    echo "$body" | grep -oP 'href="[^\"]+\.(jpg|png|gif|pdf)"' | head -20
  fi
done

# Debug log
curl -sk "https://$TARGET/wp-content/debug.log" -o /tmp/landscape_debug.log 2>/dev/null
if [ -s /tmp/landscape_debug.log ]; then
  echo "[!!!] Debug log found ($(wc -c < /tmp/landscape_debug.log) bytes)"
  grep -oP '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}' /tmp/landscape_debug.log | sort -u | head -20
  grep -oP '(DB_PASSWORD|DB_USER|DB_NAME|API_KEY).{0,80}' /tmp/landscape_debug.log | head -10
fi

Phase 3 — Plugin Scan (Landscaping-Specific)

for plugin in "bookly-responsive-appointment-booking-tool" "wpforms" \
  "formidable" "elementor" "wordpress-seo" "google-reviews" \
  "business-reviews-bundle" "strong-testimonials" "site-reviews" \
  "woocommerce" "woocommerce-bookings" "tablepress"; do
  code=$(curl -sk -o /dev/null -w "%{http_code}" "https://$TARGET/wp-content/plugins/$plugin/readme.txt")
  if [ "$code" != "404" ]; then
    version=$(curl -sk "https://$TARGET/wp-content/plugins/$plugin/readme.txt" | grep -i "stable tag\|version" | head -1)
    echo "[+] Plugin: $plugin ($code) $version"
  fi
done

Phase 4 — Booking & Estimate Tool Recon

for path in /book-appointment /schedule /booking /get-a-quote /estimate /free-estimate /quote; do
  code=$(curl -sk -o /dev/null -w "%{http_code}" "https://$TARGET$path")
  [ "$code" != "404" ] && echo "[+] Booking endpoint: $path (HTTP $code)"
done

# Webhook URLs in source (SSRF potential)
curl -sk "https://$TARGET/" | grep -oP 'https?://[^"\\x27]+(webhook|hook|callback|zapier|make\.com)' | sort -u

Phase 5 — Photo EXIF Analysis

curl -sk "https://$TARGET/" | grep -oP 'src="[^"]+\.(jpg|jpeg|png)"' | sed 's/src="//;s/"//' | \
  while read img; do
    curl -sk "https://$TARGET$img" -o /tmp/exif_check.jpg 2>/dev/null
    exiftool /tmp/exif_check.jpg 2>/dev/null | grep -iE "gps|latitude|longitude|camera|model|software|create|date" | head -5
  done

Attack Surface Signals

• CMS: WordPress (dominant), Wix, Squarespace
• Hosting: Shared hosting (GoDaddy, HostGator, SiteGround), rarely any WAF
• Stack: PHP + MySQL, Photo galleries (before/after), Booking/estimation plugins, Google Reviews badges
• Typical findings: Directory listing on uploads with EXIF data, Debug log with PII, CORS credential reflection, Booking plugin SSRF via webhook URLs, Outdated page builder plugins

Common Root Causes

1. Photo gallery directory listing — before/after photos stored in /wp-content/uploads/ with Indexes enabled, EXIF data leaks camera info, geolocation
2. DIY website builder — small landscaping company owner builds own site, no security knowledge
3. Seasonal business, seasonal maintenance — site built for spring rush, never updated through winter
4. Google Reviews badge — third-party JS with no SRI, introduces client-side injection surface
5. Estimate/quote forms — custom-coded PHP calculators with SQLi potential

Bypass Techniques

• Gallery images often have predictable URLs (IMG_0001.jpg, IMG_0002.jpg)
• Seasonal path structures: /uploads/spring-2024/, /uploads/fall-promo/
• Google dork: site:target.com inurl:wp-content/uploads filetype:jpg "before" OR "after"
• Staging subdomains: staging.target.com, dev.target.com

Real Examples

From cross-sector mass recon observation:

• A landscaping company had full directory listing on /wp-content/uploads/ exposing 500+ before/after photos with EXIF geolocation data revealing exact homeowner addresses
• Another landscaper had debug.log available with SQL queries containing customer names, addresses, and phone numbers from contact form submissions
• A lawn care company's Bookly booking plugin had webhook URLs pointing to Zapier — modifiable via CSRF, enabling SSRF to internal services
• A hardscaping company's Elementor page builder was outdated (CVE-2023-6851), allowing SQL injection through the booking form

Related Skills

• recon-smb-services — broader SMB recon methodology
• recon-churches — similar WordPress-on-shared-hosting profile
• hunt-wordpress — primary CMS for landscaping sites
• hunt-cors — CORS credential reflection
• hunt-source-leak — debug.log, config exposure
• hunt-file-upload — photo upload features, form submissions