recon-moving-companies

RECON-MOVING-COMPANIES — Sector-Specific Recon for Moving and Relocation Company Sites

When to Use

Use when the target scope includes moving companies, relocation services, long-distance movers, local moving companies, or storage-in-transit providers. These sites typically run WordPress on shared hosting with online quote request forms that collect detailed customer PII (current/pending addresses, inventory lists, moving dates, contact info), booking/estimation portals, customer account areas for tracking shipments, and third-party moving CRM integrations. Major national chains (United Van Lines, Mayflower, Atlas, North American, Two Men and a Truck) dominate the space but most regional movers use shared hosting. Common platforms include MovePoint, OTRS, MovingPro, and WordPress with form plugins for quote collection.

Quick Reference

for t in $(cat moving-targets.txt); do
  echo "=== $t ==="
  curl -skI "https://$t/" | grep -iE "wordpress|php|wp-"
  curl -sk -o /dev/null -w "%{http_code}" "https://$t/wp-content/debug.log"
  curl -sk -o /dev/null -w "%{http_code}" "https://$t/wp-content/uploads/"
  curl -skI "https://$t/wp-json/wp/v2/users" -H "Origin: https://evil.com" | grep -i "access-control"
  echo "---"
done

Step-by-Step

Phase 1 — Domain Discovery

# Common patterns: <name>moving.com, <name>movers.com, <name>relocation.com
# <city>movers.net, <area>movingcompany.com, <name>vanlines.com
# Franchise: two-men-and-a-truck-<city>.com, college-hunks-<city>.com

# Find via crt.sh
curl -sk "https://crt.sh/?q=%25.$TARGET&output=json" | python3 -c "
import sys, json
try:
    data = json.load(sys.stdin)
    domains = sorted(set(d['name_value'] for d in data))
    for d in domains: print(d)
except: pass
" | tee moving-subdomains-$TARGET.txt

Phase 2 — Quote Form & PII Discovery (Highest Priority)

# Moving quote forms collect: current address, destination, inventory, move date, phone, email
# These submissions are often stored as CSV/PDF exports in upload directories

for path in /wp-content/uploads/wpforms/ /wp-content/uploads/formidable/ \
  /wp-content/uploads/fluentform/ /wp-content/uploads/gravity_forms/ \
  /wp-content/uploads/cf7_uploads/; do
  body=$(curl -sk "https://$TARGET$path" 2>/dev/null)
  if echo "$body" | grep -q "Index of"; then
    echo "[!!!] DIR LISTING: $path"
    echo "$body" | grep -oP 'href="[^"]+\.(csv|xlsx|txt|pdf)"' | head -20
  fi
done

# Quote request endpoints
for path in /get-quote /free-quote /quote /moving-quote /request-quote \
  /estimate /moving-estimate /online-quote; do
  code=$(curl -sk -o /dev/null -w "%{http_code}" "https://$TARGET$path" 2>/dev/null)
  [ "$code" != "404" ] && echo "[+] Quote: $path (HTTP $code)"
done

Phase 3 — WordPress Standard Recon

# CORS credential reflection on WP REST API
curl -skI "https://$TARGET/wp-json/wp/v2/users" -H "Origin: https://evil.com"

# User enumeration
curl -sk "https://$TARGET/wp-json/wp/v2/users" | jq '.[] | {id, name, slug}'

# REST API namespace enumeration
curl -sk "https://$TARGET/wp-json/" | python3 -c "
import sys, json
try:
    d = json.load(sys.stdin)
    for ns in d.get('namespaces', []):
        print(f'  {ns}')
except: pass
"

# XMLRPC check
code=$(curl -sk -o /dev/null -w "%{http_code}" "https://$TARGET/xmlrpc.php")
[ "$code" = "200" ] && echo "[XMLRPC] Active"

# Debug log
curl -sk "https://$TARGET/wp-content/debug.log" -o /tmp/moving_debug.log 2>/dev/null
if [ -s /tmp/moving_debug.log ]; then
  grep -oP '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}' /tmp/moving_debug.log | sort -u | head -20
  grep -oP '(current|new|destination|pickup).{0,50}' /tmp/moving_debug.log | head -10
fi

Phase 4 — CRM & Tracking Portal Recon

# Moving companies often use CRM portals for shipment tracking
for path in /track /tracking /customer /portal /login /my-account \
  /account /dashboard /shipment /my-move /order-status; do
  code=$(curl -sk -o /dev/null -w "%{http_code}" "https://$TARGET$path" 2>/dev/null)
  [ "$code" != "404" ] && echo "[+] Portal: $path (HTTP $code)"
done

# Check for CRM integrations in page source
curl -sk "https://$TARGET/" | grep -iE "movepoint|otrs|movingpro|moveware|NaVis|moveit" | head -10

Phase 5 — Plugin Vulnerability Scan

for plugin in "wpforms" "formidable" "gravityforms" "fluentform" "contact-form-7" \
  "elementor" "wordpress-seo" "woocommerce" "tablepress" "jetpack"; do
  code=$(curl -sk -o /dev/null -w "%{http_code}" "https://$TARGET/wp-content/plugins/$plugin/readme.txt" 2>/dev/null)
  if [ "$code" != "404" ] && [ -n "$code" ]; then
    echo "[+] Plugin: $plugin (HTTP $code)"
  fi
done

Attack Surface Signals

• CMS: WordPress (dominant), some custom PHP franchise sites
• Hosting: Shared hosting (GoDaddy, HostGator), national chains on enterprise hosting
• Stack: PHP + MySQL, Quote request forms, Customer portals, Shipment tracking
• Typical findings: Quote form PII in debug log, Directory listing exposing customer CSV exports, CORS credential reflection, XMLRPC open

Common Root Causes

1. Quote form data persistence — moving quote submissions stored as CSV/PDF files in upload directories with no access control
2. Debug log with PII — contact form entries (name, address, phone, email, inventory list) logged by WP_DEBUG
3. CRM portal weak auth — customer tracking portals with default credentials or sequential booking numbers
4. Franchise cookie-cutter sites — franchise moving companies use identical templates with same plugins and vulnerabilities

Related Skills

• recon-smb-services — broader SMB recon methodology
• hunt-wordpress — primary CMS for most moving companies
• hunt-cors — CORS credential reflection on WP REST API
• hunt-source-leak — debug.log, config exposure, form submission data
• hunt-idor — sequential booking IDs in tracking portals
• hunt-subdomain — staging/dev franchise sites

Bypass Techniques

• Moving quote forms often submit to email-to-SMTP gateways — look for email headers in debug.log revealing server paths
• CSV exports of quote data may be named by date (/wp-content/uploads/wpforms/2026/06/export.csv)
• Customer tracking portals often use sequential booking numbers — iterate to find other customers' moves
• Franchise sites (Two Men and a Truck, College Hunks) use consistent URL patterns across locations
• Interstate moving companies collect more PII (current address, destination, inventory) than local movers — higher data exposure impact

Real Examples

From an 18-target batch recon across US moving companies:

• A regional moving company had debug.log exposed at /wp-content/debug.log containing quote request submissions with customer names, current and new addresses, phone numbers, and estimated move dates
• A national moving franchise site had XMLRPC with system.multicall available — capable of 1000x brute force amplification for credential attacks
• A local mover's WordPress site had directory listing on /wp-content/uploads/ revealing customer move inventory PDFs and signed service agreements