recon-gyms

name	recon-gyms
description	Sector-specific recon for gym, fitness center, and health club websites — common platforms include Mindbody, Mariana Tek, ClubReady, Glofox, PushPress, and Wodify for scheduling/booking; typically WordPress or custom PHP on shared hosting with member portals, class schedules, and payment integration.
sources	field_recon, web_recon
report_count	5

RECON-GYMS — Gym/Fitness Center Recon

When to Use

Use when the target scope includes gyms, fitness centers, health clubs, CrossFit boxes, yoga studios, or boutique fitness studios. These businesses typically use third-party SaaS platforms for scheduling and payments (Mindbody, ClubReady, Mariana Tek) with a separate marketing website. The booking/scheduling APIs and member portals often have authentication and authorization gaps.

Quick Reference

• Common CMS: WordPress, custom PHP, Wix, Squarespace
• Common platforms: Mindbody, Mariana Tek, ClubReady, Glofox, PushPress, Wodify, Zen Planner, Vagaro
• Key endpoints: /schedule, /book, /classes, /membership, /pricing, /sign-in
• API surfaces: Mindbody API (v6), Mariana Tek API, ClubReady API
• Key findings: Booking API IDOR, member portal access without auth, payment processing misconfig, class capacity bypass

Step-by-Step

1. Platform Fingerprinting

   # Mindbody — look for /clientsite/ or mindbodyonline.com references
   curl -sk "https://$TARGET/" | grep -iE "mindbody|mbo|clientsite|mindbodyonline"
   # Mariana Tek — look for marianatek.com or /schedule/ paths
   curl -sk "https://$TARGET/schedule" | grep -i "mariana"
   # ClubReady — look for clubready.com
   curl -sk "https://$TARGET/" | grep -i "clubready"
   # Check booking page headers for platform signatures
   curl -skI "https://$TARGET/schedule" | grep -iE "server|x-powered-by"
   

2. Booking API Discovery

   # Mindbody API (v6) — staff/public endpoints
   curl -sk "https://api.mindbodyonline.com/public/v6/" -H "API-Key: test"
   curl -sk "https://$TARGET/clientsite/" | head -30
   # Mariana Tek API
   curl -sk "https://$TARGET.marianatek.com/api/" | head -20
   # Look for API keys in JS bundles
   curl -sk "https://$TARGET/" | grep -oP 'src="[^"]*\.js"' | while read js; do
     curl -sk "https://$TARGET/$(echo $js | sed 's/src="//;s/"//')" | grep -oP '(mindbody|mariana|clubready)_?api[^"'"'"']+' 2>/dev/null
   done
   

Attack Surface Signals

• Mindbody-powered booking at clientsite.mindbodyonline.com or embedded iframes
• Mariana Tek scheduling at schedule.[gym-name].com or [gym].marianatek.com
• Class capacity and booking APIs returning member PII
• Member portals on subdomains like members., portal., schedule., book.
• API keys in JS bundles for Mindbody/Mariana Tek integrations
• Payment webhook endpoints without HMAC validation

Common Root Causes

1. Booking API IDOR — Class schedule API returns member names, emails, phone numbers without auth
2. Free registration bypass — Membership registration accepts signup without payment step
3. Exposed API keys — Mindbody API keys and Mariana Tek keys hardcoded in JS bundles
4. Member portal no-auth access — Profile endpoints accessible with any session cookie or none
5. Payment webhook trust — Webhook endpoints accept fake success notifications

Related Skills

• hunt-idor — Booking/member IDOR is the most common finding in this sector
• hunt-api-misconfig — API key discovery in JS bundles, mass assignment on registration
• hunt-business-logic — Payment bypass, free-trial abuse, class capacity manipulation
• recon-smb-services — General SMB recon methodology
• hunt-source-leak — API key and secret discovery in JS bundles

Bypass Techniques

• Free trial registrations often accept fake payment details or payment_method: none in POST body
• Class schedule APIs frequently return data without any session cookie — test with empty Cookie: header
• Staff member IDs are often sequential integers — iterate /api/staff/1, /api/staff/2 etc.
• Gym check-in QR codes are sometimes static images that can be shared or replayed
• Booking widget iframes may bypass the main site's CSP, allowing clickjacking on embedded scheduling flows
• Test /api/classes?date=2026-01-01 for historical data leakage (member check-in patterns)

Real Examples

From cross-sector mass recon observation:

• A boutique fitness studio's Mindbody API key was hardcoded in app.js bundle, allowing full read access to the business's client database via api.mindbodyonline.com/public/v6/client/clients
• A CrossFit gym had class schedule API at /api/schedule returning member full names, email addresses, and check-in history without any authentication
• A yoga studio's Mariana Tek booking page allowed enumerating all appointments by incrementing numeric booking IDs — each returned client name, phone, and email
• A gym chain's member portal at members.target.com had no auth on profile endpoint — any session cookie (or none) returned the first member's profile