skills.rest
EntroVyx
EntroVyxCOMMUNITY
Explore all skills by this author →
GitHub

recon-salons

Test salon booking APIs for PII leakage, IDOR, and unauthenticated data exposure.

3|1|Updated Jul 2, 2026
Search Tags:#api#pii#booking#idor#recon#offsec
One-click install
npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill recon-salons-entrovyx
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: recon-salons
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/redteam/recon-salons
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill recon-salons-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the lack of specialized reconnaissance for the beauty and wellness sector, where misconfigured third-party booking platforms often expose sensitive customer PII and staff schedules.

Core Features & Use Cases

  • Platform Fingerprinting: Automatically identifies the use of Booksy, Vagaro, Square, and other common booking services.
  • API Vulnerability Assessment: Tests booking endpoints for IDOR, unauthenticated data access, and PII leakage.
  • Use Case: When auditing a local salon chain, use this skill to identify exposed booking APIs that allow unauthorized access to customer appointment history and staff contact details.

Quick Start

Use the recon-salons skill to perform a full security assessment on the target domain example-salon.com.

Frequently Asked Questions about recon-salons

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What booking platforms can I fingerprint during a salon security assessment?▼

Testing salon booking APIs for PII leakage and IDOR involves targeting common web endpoints to detect unauthenticated data exposure and unauthorized access to customer appointment history using curl and jq.

How do I find unauthenticated data exposure on spa and barbershop booking endpoints?▼

Finding unauthenticated data exposure on spa and barbershop booking endpoints requires sending HTTP requests via curl and parsing JSON responses with jq to identify accessible staff schedules and customer PII.

Do I need curl and jq to perform recon on salon booking platforms?▼

Finding unauthenticated data exposure on spa and barbershop booking endpoints requires sending HTTP requests via curl and parsing JSON responses with jq to identify accessible staff schedules and customer PII.

What is the best way to detect IDOR vulnerabilities in beauty and wellness booking systems?▼

Yes, you need curl and jq installed in your environment to execute the HTTP requests and parse the JSON responses required for security analysis of salon booking platforms.

Can I audit a local salon chain for exposed third-party booking platform vulnerabilities?▼

The best way to detect IDOR vulnerabilities in beauty and wellness booking systems is to target booking APIs systematically, testing for unauthorized access to customer appointment history and staff contact details.

Related Skills

Explore More Software Engineering Skills→
iani-kuliiani-kuli

huggingface-tool-builder

Creates reusable CLI tools for Hugging Face Hub API workflows with chaining and piping support.

Community
Intermediate
uphiagouphiago
1.1k

recon-salons

Fingerprint booking platforms and test salon websites for exposed APIs and IDOR vulnerabilities.

Community
Intermediate
dougwithseismicdougwithseismic

mitm-start

Start the MITM proxy in headless mode and export HTTP/HTTPS proxy environment variables.

Community
Basic
mvanhornmvanhorn
1.9k

pp-nvd

Search NVD for CVE data by keyword, CVE ID, or CPE name.

Community
Intermediate