recon-automotive-dealers

name	recon-automotive-dealers
description	Sector-specific recon for car dealership and automotive retail websites — typically WordPress or custom PHP on shared hosting with inventory listings, financing applications, service booking, and OEM-branded portals. Built from a 20-target batch recon across US auto dealer networks where WordPress was the dominant platform. Use when the target scope includes car dealerships, auto retailer groups, automotive service centers, or OEM franchise dealer networks.
sources	field_recon, sector_mass_recon
report_count	20

RECON-AUTOMOTIVE-DEALERS — Sector-Specific Recon for Car Dealership Sites

When to Use

Use when the target scope includes car dealerships, auto retail groups, automotive service centers, or OEM franchise dealer network domains. These sites typically run WordPress on shared hosting with vehicle inventory management systems, VDP (Vehicle Detail Page) listings, financing applications (credit apps with SSN/income data), service scheduling, and OEM-branded dealer portals. Major dealer groups (AutoNation, Lithia, Sonic) use Cloudflare/WAF, but small/medium independent dealers are on shared hosting with minimal security. Common platforms include Dealer.com, DealerOn, CDK Global, Reynolds & Reynolds, and WordPress with inventory plugins.

Quick Reference

for t in $(cat dealership-targets.txt); do
  echo "=== $t ==="
  curl -skI "https://$t/" | grep -iE "wordpress|php|wp-"
  curl -sk -o /dev/null -w "%{http_code}" "https://$t/wp-json/wp/v2/users" -H "Origin: https://evil.com"
  curl -sk -o /dev/null -w "%{http_code}" "https://$t/xmlrpc.php"
  curl -sk -o /dev/null -w "%{http_code}" "https://$t/wp-content/debug.log"
  curl -sk -o /dev/null -w "%{http_code}" "https://$t/wp-content/uploads/"
  echo "---"
done

Step-by-Step

Phase 1 — Domain Discovery

# Common patterns: <dealership>cars.com, <brand>of<city>.com, <city>auto.com
# <name>motors.com, <name>auto-group.com, <name>automotive.com
# CDK/Dealer.com sites: d2.dealer.com, <name>.dealerdot.com, <name>.dealersites.com

# Find dealer domains via crt.sh
curl -sk "https://crt.sh/?q=%25.$TARGET&output=json" | python3 -c "
import sys, json
try:
    data = json.load(sys.stdin)
    domains = sorted(set(d['name_value'] for d in data))
    for d in domains: print(d)
except: pass
" | tee dealer-subdomains-$TARGET.txt

Phase 2 — WordPress Recon

# CORS credential reflection
curl -skI "https://$TARGET/wp-json/wp/v2/users" -H "Origin: https://evil.com"

# User enumeration
curl -sk "https://$TARGET/wp-json/wp/v2/users" | jq '.[] | {id, name, slug, email}'

# XMLRPC method enumeration
curl -sk -X POST "https://$TARGET/xmlrpc.php" -H "Content-Type: text/xml" \
  -d '<?xml version="1.0"?><methodCall><methodName>system.listMethods</methodName></methodCall>' | \
  python3 -c "
import sys, re
methods = re.findall(r'<string>([^<]+)</string>', sys.stdin.read())
dangerous = ['system.multicall', 'wp.uploadFile', 'pingback.ping']
for m in methods:
    if any(d in m for d in dangerous):
        print(f'  [!] DANGEROUS: {m}')
"

# Debug log
curl -sk "https://$TARGET/wp-content/debug.log" | head -30

Phase 3 — VDP (Vehicle Detail Page) & Inventory Recon

# Dealer.com / DealerOn inventory endpoints often leak stock data
for path in /api/inventory /api/vehicles /inventory.json /vdp/ /cars/ \
  /new-inventory /used-inventory /api/v1/vehicles /api/stock; do
  code=$(curl -sk -o /dev/null -w "%{http_code}" "https://$TARGET$path" 2>/dev/null)
  [ "$code" != "404" ] && [ -n "$code" ] && echo "[+] Inventory: $path (HTTP $code)"
done

# Check for VIN enumeration
curl -sk "https://$TARGET/api/vehicles?limit=100" | jq '.' 2>/dev/null | head -50

Phase 4 — Financing & Credit Application Recon

# Financing portals often contain PII-heavy credit applications
for path in /finance /financing /credit-application /apply /pre-approval \
  /credit-app /finance-application /payment-calculator /trade-in; do
  code=$(curl -sk -o /dev/null -w "%{http_code}" "https://$TARGET$path" 2>/dev/null)
  [ "$code" != "404" ] && echo "[+] Finance: $path (HTTP $code)"
done

# Check for unprotected credit application submissions
curl -sk "https://$TARGET/wp-content/uploads/credit-apps/" | grep -oP 'href="[^"]+\.(pdf|csv|xlsx|txt)"' | head -20

Phase 5 — Plugin Vulnerability Scan

for plugin in "elementor" "wordpress-seo" "contact-form-7" "gravityforms" \
  "woocommerce" "wpforms" "formidable" "revslider" "elementskit" \
  "advanced-custom-fields" "all-in-one-seo-pack" "sitepress-multilingual-cms"; do
  code=$(curl -sk -o /dev/null -w "%{http_code}" "https://$TARGET/wp-content/plugins/$plugin/readme.txt" 2>/dev/null)
  if [ "$code" != "404" ] && [ -n "$code" ]; then
    version=$(curl -sk "https://$TARGET/wp-content/plugins/$plugin/readme.txt" 2>/dev/null | grep -i "stable tag\|version" | head -1)
    echo "[+] Plugin: $plugin (HTTP $code) $version"
  fi
done

Attack Surface Signals

• CMS: WordPress (dominant), custom PHP for dealer groups
• Hosting: Shared hosting, CDK/Dealer.com SaaS, OEM-partner hosting
• Stack: PHP + MySQL, Vehicle inventory integrations, Financing APIs, Service scheduling
• Typical findings: CORS credential reflection on REST API, XMLRPC open, Debug log with PII, Directory listing on uploads, VIN enumeration via unauthenticated APIs

Common Root Causes

1. Dealer.com/CDK WordPress templates — cookie-cutter dealer sites with identical plugin sets across hundreds of dealerships
2. Financing portal PII storage — credit applications (SSN, income, address, DOB) stored in unprotected upload directories
3. Inventory API without auth — VDP stock data, VINs, and dealer cost information exposed
4. Multi-location dealer groups — same credentials across all locations, one breach = all sites compromised

Related Skills

• recon-smb-services — broader SMB recon methodology
• hunt-wordpress — primary CMS for small/medium dealers
• hunt-cors — CORS credential reflection on WP REST API
• hunt-source-leak — debug.log, config exposure, JS secret extraction
• hunt-business-logic — coupon/pricing manipulation in service booking
• hunt-subdomain — staging/dev dealer instances

Bypass Techniques

• Major dealer groups (AutoNation, Lithia, Sonic) use Cloudflare/WAF — find origin IP via historical DNS or SecurityTrails
• CDK/Dealer.com sites often have API endpoints at predictable paths — test /api/inventory, /api/vehicles
• Inventory APIs frequently have no rate limiting — VIN enumeration via sequential IDs
• Service booking portals often expose internal dealership contact data (service advisor names, email, phone)
• Credit application submissions may be stored as PDFs with sequential filenames in /wp-content/uploads/credit-apps/

Real Examples

From a 20-target batch recon across US auto dealer networks:

• Several independent dealership WordPress sites had CORS credential reflection on the WP REST API users endpoint — admin usernames and email addresses exposed cross-origin
• A used car dealership had XMLRPC with system.multicall available — 80+ methods including wp.uploadFile
• An auto service center had directory listing on /wp-content/uploads/ revealing service invoices with customer names, vehicle VINs, and payment details
• Debug.log exposure on a dealer WordPress site contained SQL queries with dealer inventory cost data and customer contact information