recon-bakeries

name	recon-bakeries
description	Sector-specific recon for bakery, pastry shop, and cake shop websites — typically WordPress on shared hosting with e-commerce (WooCommerce, Shopify), online ordering for cakes/pastries, catering pages, and store locators. Common platforms include EatStreet, Toast POS, Upserve, and Slice for online ordering.
sources	field_recon, web_recon
report_count	4

RECON-BAKERIES — Sector-Specific Recon for Bakeries & Pastry Shop Sites

When to Use

Use when the target scope includes bakeries, pastry shops, cake shops, donut shops, or dessert company domains. These small businesses typically run e-commerce sites for cake/pastry ordering with custom order forms for special occasions (weddings, birthdays), catering menus, and store locators. Common vulnerabilities: e-commerce API exposure (WooCommerce/Shopify), custom order form injection, coupon code enumeration, exposed delivery addresses in order tracking, and CSV export leakage of customer orders.

Quick Reference

• Common CMS: WordPress/WooCommerce (dominant), Shopify, Squarespace
• Common platforms: WooCommerce, Shopify, EatStreet, Toast POS, Slice, Upserve
• Key endpoints: /shop, /order, /cake, /catering, /menu, /delivery, /store-locator
• Key findings: WooCommerce API exposure, coupon code enumeration, custom order form injection, order data CSV export

Step-by-Step

1. Platform Fingerprinting

   # WooCommerce detection
   curl -sk "https://$TARGET/wp-json/wc/v3/" | head -5
   # Shopify detection
   curl -sk "https://$TARGET/products.json" | jq '.' 2>/dev/null | head -5
   # EatStreet/Toast detection
   curl -sk "https://$TARGET/" | grep -iE "eatstreet|toast\.tab|slice|order\.here"
   

2. E-Commerce API Recon

   # WooCommerce — test for unauthenticated access
   for path in "/wp-json/wc/v3/products" "/wp-json/wc/v3/orders" "/wp-json/wc/v3/customers" "/wp-json/wc/v3/coupons"; do
     result=$(curl -sk -o /tmp/wc_test -w "%{http_code}" "https://$TARGET$path")
     [ "$result" != "404" ] && echo "[+] WC: $path ($result)"
   done
   # Shopify
   curl -sk "https://$TARGET/collections.json" | jq '.collections | length'
   curl -sk "https://$TARGET/products.json?limit=250" | jq '.products | length'
   

3. Custom Order Form Recon

   # Cake/pastry order forms often have custom fields
   curl -sk "https:///order-cake" | grep -oE  |  -u
   curl -sk  | grep -oE  |  -5
   
   curl -sk  |  -20
   

Attack Surface Signals

• Online ordering for cakes/pastries with custom forms
• WooCommerce REST API endpoints (/wp-json/wc/v3/)
• Shopify storefront at [name].myshopify.com
• Catering menus and wholesale order pages
• Store locator with location details and manager contact info
• Custom cake/pastry order forms with free-text fields

Common Root Causes

1. Exposed WooCommerce API — Customer orders and PII accessible via REST API
2. Custom form injection — Cake order forms with free-text fields (message, instructions) lacking sanitization
3. Coupon code brute-force — No rate limiting on discount code validation endpoints
4. Store locator data leakage — API returns manager emails, phone numbers without auth
5. Delivery address exposure — Order tracking pages accessible without auth exposing customer addresses

Related Skills

• recon-mattress-stores — Similar e-commerce/financing patterns
• recon-smb-services — General SMB recon methodology
• hunt-wordpress — WordPress/WooCommerce vulnerability hunting
• hunt-api-misconfig — Exposed e-commerce APIs
• hunt-business-logic — Coupon/pricing manipulation in checkout flows
• hunt-source-leak — API keys in JS bundles

Bypass Techniques

• WooCommerce orders endpoint at /wp-json/wc/v3/orders often exposes customer data without auth — test with ?per_page=100
• Custom cake order forms often POST to unprotected PHP scripts — test for SQLi in message/instructions fields
• Store locator APIs at /api/locations may return internal manager data without auth
• Google Maps API keys on store locator pages are frequently unrestricted
• Check for /wp-content/uploads/ directory listing containing order-related PDFs or images