RECON-GYMS — Gym/Fitness Center Recon

When to Use

Use when the target scope includes gyms, fitness centers, health clubs, CrossFit boxes, yoga studios, or boutique fitness studios. These businesses typically use third-party SaaS platforms for scheduling and payments (Mindbody, ClubReady, Mariana Tek) with a separate marketing website. The booking/scheduling APIs and member portals often have authentication and authorization gaps.

Quick Reference

• Common CMS: WordPress, custom PHP, Wix, Squarespace
• Common platforms: Mindbody, Mariana Tek, ClubReady, Glofox, PushPress, Wodify, Zen Planner, Vagaro
• Key endpoints: /schedule, /book, /classes, /membership, /pricing, /sign-in
• API surfaces: Mindbody API (v6), Mariana Tek API, ClubReady API
• Key findings: Booking API IDOR, member portal access without auth, payment processing misconfig, class capacity bypass

Step-by-Step