recon-pools

RECON-POOLS — Sector-Specific Recon for Pool Service/Construction Company Sites

When to Use

Use when the target scope includes pool service, pool construction, hot tub, or spa company domains. These businesses share the same low-security posture as other SMB service providers but have unique characteristics: high-value photo galleries (pool builds before/after), booking systems for recurring service schedules, and payment portals for service contracts. Common findings: directory listing showing pools under construction with EXIF geolocation, debug log exposure, and booking system vulnerabilities.

Quick Reference

for t in $(cat pool-targets.txt); do
  echo "=== $t ==="
  curl -skI "https://$t/" | grep -iE "wordpress|php|wp-"
  curl -sk -o /dev/null -w "%{http_code}" "https://$t/wp-content/debug.log"
  curl -sk -o /dev/null -w "%{http_code}" "https://$t/wp-content/uploads/"
  curl -skI "https://$t/wp-json/wp/v2/users" -H "Origin: https://evil.com" | grep -i "access-control"
  echo "---"
done

Step-by-Step

Phase 1 — Domain Discovery

# Common patterns: <city>pools.com, <name>poolservice.com, <area>poolcleaning.com
curl -sk "https://crt.sh/?q=%25.$TARGET&output=json" | python3 -c "
import sys, json
try:
    data = json.load(sys.stdin)
    domains = sorted(set(d['name_value'] for d in data))
    for d in domains: print(d)
except: pass
" | tee pool-subdomains-$TARGET.txt

Phase 2 — WordPress Recon + Gallery Discovery

# Gallery directory listing (pool builds — high-value before/after photos)
for path in /wp-content/uploads/ /images/portfolio/ /galleries/ /our-work/ /pool-gallery/ /builds/; do
  body=$(curl -sk "https://$TARGET$path" 2>/dev/null)
  if echo "$body" | grep -q "Index of"; then
    echo "[!!!] DIRECTORY LISTING: $path"
    echo "$body" | grep -oP 'href="[^"]+\.(jpg|png|gif|mp4)' | head -20
  fi
done

# Debug log with service contract PII
curl -sk "https://$TARGET/wp-content/debug.log" -o /tmp/pool_debug.log 2>/dev/null
if [ -s /tmp/pool_debug.log ]; then
  grep -oP '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}' /tmp/pool_debug.log | sort -u | head -20
  grep -oP '(DB_PASSWORD|DB_USER|DB_NAME|API_KEY).{0,80}' /tmp/pool_debug.log | head -10
fi

# CORS on REST API
curl -skI "https://$TARGET/wp-json/wp/v2/users" -H "Origin: https://evil.com"

Phase 3 — Service Portal Recon

# Pool service companies often have client portals
for path in /portal /client-portal /my-account /login /schedule-service /service-request; do
  code=$(curl -sk -o /dev/null -w "%{http_code}" "https://$TARGET$path")
  [ "$code" != "404" ] && echo "[+] Portal endpoint: $path (HTTP $code)"
done

# Check for online payment systems
curl -sk "https://$TARGET/" | grep -oP 'stripe\.com|squareup\.com|paypal\.com|authorize\.net'

Attack Surface Signals

• CMS: WordPress (most common), some custom PHP
• Hosting: Shared hosting (GoDaddy, HostGator, SiteGround)
• Stack: PHP + MySQL, Pool build photo galleries, Service booking/portal, Online payment integration
• Typical findings: Directory listing of pool build photos with EXIF data, Debug log with customer PII, CORS credential reflection, XMLRPC open

Common Root Causes

1. Pool build photo galleries left open — no auth on before/after photos showing backyard layouts, EXIF data leaks homeowner addresses
2. Seasonal site neglect — sites built for summer season, ignored in off-season, plugin CVEs accumulate
3. Service portal without proper auth — client portals built with page builders, often have IDOR or weak auth

Bypass Techniques

• Pool build photo galleries often have sequential filenames (pool_001.jpg, pool_002.jpg) — iterate to find unlisted photos
• Service portal login pages may have default credentials (admin/password, user/user) for trial accounts
• Seasonal service pages (/summer-pool-care, /winterization) built in a hurry may have debug output enabled
• Pool construction project pages often have client names and addresses in URL slugs (/project-smith-residence)
• Google Maps API keys for service area pages are frequently unrestricted
• Check for /pool-gallery directories that list ALL photos including deleted ones

Real Examples

From cross-sector mass recon observation:

• A pool construction company had directory listing on /wp-content/uploads/ exposing 300+ pool build photos with EXIF geolocation data showing homeowners' backyard layouts and addresses
• A pool service company had debug.log containing customer service contracts with names, addresses, pool equipment serial numbers, and payment details
• Another pool company had a client portal at /portal that required no authentication — iterating user IDs returned full customer profiles including service history and billing info
• A hot tub retailer had a Google Maps API key on service-area pages with no referrer restriction — the key worked for any site, costing $200/day in API overage charges

Related Skills

• recon-smb-services — broader SMB recon methodology
• recon-landscaping — similar gallery-heavy profile
• hunt-wordpress — primary CMS for pool sites
• hunt-cors — CORS credential reflection
• hunt-source-leak — debug.log, config exposure