recon-dentists

name	recon-dentists
description	Sector-specific recon for dentist, orthodontist, and dental practice websites — typically WordPress on shared hosting with online booking, patient portal integrations, and insurance verification pages. Common platforms include Dentrix Ascend, Eaglesoft, Open Dental, Curve Dental, and PatientConnect for practice management; typically WordPress or custom PHP on shared hosting with minimal security posture.
sources	field_recon, sector_mass_recon
report_count	12

Recon: Dental Practice Websites

Sector-specific recon for dentist, orthodontist, and dental practice websites.

When to Use

Use when the target scope includes dentist offices, dental clinics, orthodontic practices, oral surgery centers, or dental group practices. These sites typically handle protected health information (PHI), patient intake forms, and insurance verification data with minimal security investment.

Common sectors: dentistry, orthodontics, oral surgery, pediatric dentistry, periodontics, endodontics.

Quick Reference

Aspect	Typical Profile
CMS	WordPress (80%+), custom PHP, Squarespace
Hosting	Shared hosting (GoDaddy, HostGator, SiteGround)
Booking	Dentrix Ascend, Eaglesoft, Open Dental, Solutionreach
Patient Portal	PatientConnect, Lighthouse 360, RevenueWell
Common Plugins	WPForms, Gravity Forms, Elementor, Bookly
Top Findings	Debug log PII, CORS credential reflection, open registration, outdated plugins

Step-by-Step

Phase 1 — Domain Discovery

# Google dorks for dental practice websites
# site:*.com "dentist" "patient portal" - Use in Google search
# site:*.com "dental" "new patient" "online booking"

# crt.sh certificate search
curl -sk "https://crt.sh/?q=%25.dental%25&output=json" | jq -r '.[].name_value' | sort -u

# Find dental practice domains from sector lists
# Common naming patterns:
#   smilesforlife-dental.com, drsmithdental.com, citydentalgroup.com
#   northstardentistry.com, familydentalcare.com, dentistdowntown.com

Phase 2 — CMS Recon

# WordPress detection
curl -skI "https://$TARGET/" | grep -iE "x-powered-by.*php|set-cookie.*wordpress|set-cookie.*wp-"
curl -sk "https://$TARGET/" | grep -iE "generator.*WordPress|wp-content|wp-json|wp-includes"

# REST API user enumeration
curl -sk "https://$TARGET/wp-json/wp/v2/users" | python3 -m json.tool 2>/dev/null

# XMLRPC check
code=$(curl -sk -o /dev/null -w "%{http_code}" "https://$TARGET/xmlrpc.php")
[ "$code" = "200" ] && echo "[XMLRPC] $TARGET"

Phase 3 — Config Exposure

# Debug log — often contains PHI (patient names, phone numbers, emails)
curl -sk -o /dev/null -w "%{http_code}" "https://$TARGET/wp-content/debug.log"

# Common sensitive paths
for path in /.env /wp-config.php.bak /backup.sql /info.php /phpinfo.php; do
  code=$(curl -sk -o /dev/null -w "%{http_code}" "https://$TARGET$path")
  [ "$code" != "404" ] && echo "[$code] $TARGET$path"
done

Phase 4 — Plugin & Booking System Scan

for plugin in "gravityforms" "wpforms" "elementor" "bookly" "contact-form-7" "woocommerce"; do
  code=$(curl -sk -o /dev/null -w "%{http_code}" "https://$TARGET/wp-content/plugins/$plugin/readme.txt" 2>/dev/null)
  [ "$code" != "404" ] && [ -n "$code" ] && echo "[PLUGIN] $plugin (HTTP $code)"
done

Phase 5 — Attack Chains

# Chain A: Debug log PII + CORS -> PHI exposure
# Dental practice debug.log often contains patient intake form submissions
# including full name, DOB, phone, address, insurance ID, dental history notes

# Chain B: Open registration + outdated plugins -> RCE
# Many dental WP sites have open registration for "new patient forms"
# and outdated Gravity Forms / Contact Form 7 -> file upload bypass

# Chain C: Booking API IDOR -> Patient data
# Dentrix Ascend / PatientConnect APIs often use sequential patient IDs
# IDOR on appointment view -> full patient record

Attack Surface Signals

• Online booking forms with GPDR/privacy policy checkboxes
• "New Patient" registration pages
• Patient portal login pages (subdomain or /portal path)
• Insurance verification upload forms
• Treatment plan PDF generation
• Before/after photo galleries with EXIF data
• Contact forms submitting to email-to-SMTP gateways
• Online bill payment portals

Common Root Causes

1. Debug.log enabled on production — patient form submissions logged with full PII
2. CORS credential reflection on WP REST API — PHI exfiltratable cross-origin
3. Outdated booking plugins — critical CVEs in Gravity Forms, Contact Form 7
4. Open registration enabled — anyone creates account, then uploads webshell
5. Photo gallery directory listing — EXIF data contains GPS coordinates from dental office
6. Patient portal weak auth — simple passwords, no MFA, session tokens in URL

Bypass Techniques

Defense	Bypass
Cloudflare WAF	Find origin IP via Historical DNS / crt.sh
Booking system with rate limits	Slow enumeration (1 req/5s), rotate IP headers
Patient portal login	Test common credentials (admin/admin, password/password, demo/demo)
Contact form CAPTCHA	Find underlying form handler API endpoint
SSL/TLS on main site	Check subdomains without HTTPS (dev, staging, portal)

Real Examples

Dental practice patient portal with CORS credential reflection on /wp-json/wp/v2/users endpoint. Authenticated admin browsing while logged into WordPress would have their user list (including email addresses of patient-facing staff) exposed cross-origin. CORS headers allowed credentialed reads from any attacker origin.

Dentist office debug.log exposed patient intake form submissions including full name, DOB, phone, email, dental insurance ID, and medical history notes. The debug.log was world-readable at /wp-content/debug.log.

Related Skills

• hunt-wordpress — Primary CMS for most dental practices; XMLRPC, user enum, CORS reflection
• hunt-cors — CORS credential reflection on WP REST API is the most common high-value finding
• hunt-source-leak — Debug log exposure containing PHI from patient intake forms
• hunt-file-upload — Outdated booking plugins with file upload bypass → RCE
• hunt-idor — Sequential patient IDs in booking APIs
• hunt-brute-force — Weak auth on patient portals
• wp-plugin-automation — Batch CVE scanning for Gravity Forms, Contact Form 7
• hunt-lfi — PHP file inclusion in outdated booking plugins
• hunt-subdomain — Staging/dev subdomains with less hardened security
• recon-smb-services — SMB service sector methodology (dental practices are SMBs)