recon-salons

name	recon-salons
description	Sector-specific recon for salon, barbershop, nail salon, and spa websites — common booking platforms include Booksy, Vagaro, Square Appointments, Mindbody, Fresha, and StyleSeat. Typically WordPress or custom PHP on shared hosting with online booking, service menus, and customer account portals.
sources	field_recon, web_recon
report_count	5

RECON-SALONS — Salon/Barbershop Recon

When to Use

Use when the target scope includes hair salons, barbershops, nail salons, spas, waxing studios, or med-spas. These businesses rely heavily on third-party booking platforms that handle customer PII (names, phone numbers, email addresses). The booking API exposure, customer data leakage, and authentication gaps are common findings in this sector.

Quick Reference

• Common CMS: WordPress, custom PHP, Wix, Squarespace
• Common platforms: Booksy, Vagaro, Square Appointments, Mindbody, Fresha, StyleSeat, Timely
• Key endpoints: /book, /booking, /appointments, /services, /pricing, /staff
• API surfaces: Booksy API, Vagaro API, Square API, Mindbody API v6
• Key findings: Booking API exposing customer PII, appointment data without auth, staff schedule IDOR

Step-by-Step

1. Booking Platform Fingerprinting

   # Booksy — look for booksy.com or booksy pages
   curl -sk "https://$TARGET/" | grep -iE "booksy|book\.booksy\.com"
   # Vagaro — look for vagaro.com
   curl -sk "https://$TARGET/" | grep -i "vagaro"
   # Square Appointments — look for squareup.com or square.site
   curl -sk "https://$TARGET/" | grep -iE "squareup|square\.site"
   # Fresha — look for fresha.com
   curl -sk "https://$TARGET/" | grep -i "fresha"
   # StyleSeat — look for styleseat.com
   curl -sk "https://$TARGET/" | grep -i "styleseat"
   

2. Booking Page Recon

   # Find booking endpoints
   for path in "/book" "/booking" "/appointments" "/schedule" "/book-now" "/services" "/online-booking"; do
     code=$(curl -sk -o /dev/null -w "%{http_code}" "https://$TARGET$path")
     [ "$code" != "404" ] && echo "[+] Booking: $path ($code)"
   done
   # Extract API endpoints from booking page
   curl -sk "https://$TARGET/book" | grep -oE  |  -u
   curl -sk  | grep -oE  |  -u
   

Attack Surface Signals

• Embedded Booksy/Vagaro/Square booking widgets with API calls visible in network tab
• book.booksy.com, vagaro.com, square.site subdomain redirects
• Customer booking confirmation pages with PII in URL parameters
• Staff profiles with embedded schedule availability (IDOR on staff IDs)
• Testimonials/reviews with customer names, services, and dates
• API keys for booking platforms in JS bundles

Common Root Causes

1. Booking API without auth — Appointment data accessible with sequential IDs
2. Customer PII in URLs — Booking confirmation pages with name/phone in query parameters
3. Embedded API keys — Booksy/Vagaro/Square API keys in frontend code
4. Staff schedule enumeration — Staff member IDs are sequential and schedules are public
5. Review/testimonial PII — Customer names + service details in public gallery
6. Cancellation/modification without auth — Booking changes via booking ID only

Related Skills

• hunt-idor — Booking and customer IDOR is the primary finding in this sector
• recon-gyms — Overlapping sector (many platforms used by both)
• recon-smb-services — General SMB recon methodology
• hunt-api-misconfig — Booking API and key exposure
• hunt-source-leak — API keys in JS bundles

Bypass Techniques

• Booking platforms often expose appointment data via API endpoints with sequential numeric IDs — try /api/appointments/1, /2, /3
• Customer PII is frequently in URL parameters on booking confirmation pages — check for ?name=, ?phone=, ?email= in query strings
• Staff schedule APIs may return data without any session cookie — test with empty Cookie: header
• Some booking widgets pass business ID in a data-business-id attribute — this ID can be used to access other businesses' bookings
• Cancellation endpoints often require only a booking ID (no auth) — test /api/bookings/{id}/cancel
• Search for embedded API keys in JS bundles: grep -oP 'pk_(live|test)_[a-zA-Z0-9]{24,}' for Square/Stripe keys

Real Examples

From cross-sector mass recon observation:

• A salon chain using Booksy had appointment data accessible at /api/v2/business/{id}/appointments — incrementing the business ID revealed booking data for 40+ other salons
• A barbershop's Vagaro booking page passed customer full name and phone number in URL parameters on the confirmation page
• A med-spa had a Square Appointments integration with the public API key hardcoded in JS, exposing all appointment data for the business
• A nail salon's /api/staff endpoint returned all staff schedules without authentication, revealing working hours and personal contact info