Fingerprint booking platforms and test salon websites for exposed APIs and IDOR vulnerabilities.
npx skills add https://github.com/uphiago/recon-skills --skill recon-salons
Please help me install this Agent Skill. Skill: recon-salons Source: https://github.com/uphiago/recon-skills/tree/main/redteam/recon-salons Command: npx skills add https://github.com/uphiago/recon-skills --skill recon-salons
Salon, barbershop, nail salon, and spa businesses commonly use third-party booking platforms that frequently expose customer PII, unauthenticated APIs, and IDOR vulnerabilities that are often missed during standard web reconnaissance, leading to avoidable data breaches in the personal services sector.
Use the recon-salons skill to perform full sector-specific reconnaissance on a target salon or spa website, including booking platform detection and automated checks for exposed customer data and IDOR flaws.
High-intent search queries and answers about installing and using this skill.
Testing for IDOR vulnerabilities in salon booking platforms involves enumerating sequential appointment and staff schedule endpoints to identify exposed customer PII and unauthorized access flaws.
Common security flaws affecting spa and salon booking websites include unauthenticated API endpoint access, sequential IDOR vulnerabilities on appointment schedules, and exposed API keys in frontend code.
You can detect which booking platform a salon uses by fingerprinting common third-party services like Booksy, Vagaro, Square Appointments, Mindbody, Fresha, and StyleSeat during authorized reconnaissance.
Yes, this reconnaissance approach works with custom PHP and WordPress appointment scheduling implementations by applying unauthenticated API discovery and PII leakage testing to custom salon and spa websites.
You find exposed customer PII on personal services websites by testing unauthenticated booking API access and running automated checks for data leakage specific to salon, barbershop, and spa platforms.
Automated pentest recon for salon booking systems is limited to common platform fingerprints and standard IDOR or API exposure checks, requiring manual validation for complex custom PHP or WordPress implementations.
salmanabdurrahmanCrawl authenticated web applications and inspect DOM structures for security validation.
EntroVyxTest salon booking APIs for PII leakage, IDOR, and unauthenticated data exposure.
serkan-ozalMock API responses and intercept HTTP requests in browser automation.
uphiagoFingerprint gym platforms and enumerate booking APIs for security vulnerabilities.
