Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reverse-engineering the Starbucks ordering API

blog.tendigi.com

Post reply on HN
Print view View original

151–157 of 157 posts

Re: Reverse-engineering the Starbucks ordering API

#151

Post by bluesign »

merty wrote: post #149
bluesign wrote: post #115

Earlier quoted context omitted.

From my experience, for certificate pinning, fastest option is to search for existing certificate/fingerprint, and try to replace it with charles’/mitmproxie’s Edit: oh another trick usually works is to change transport to HTTP from HTTPS, just changing endpoint to something you control and changing it to http (with little hex editing the endpoint), and reverse proxy with mitmproxy/charles to the target, you can spee…

For the edit: If the endpoint works on HTTP that is. We no longer allow HTTP connections to our API servers for instance.

Nope you should change endpoint to charles/mitmproxy, then reverse proxy to https endpoint.

So basically for app endpoint will be charles/mitmproxy machine, then from there, you will make https request to real API server

Re: Reverse-engineering the Starbucks ordering API

#152

Post by webfreak7 »

nailer wrote: post #105

From: https://github.com/tendigi/starbucks > Once you've obtained your client_id, client_secret I'd like to use this module. Question for author: what's the fastest way to get a CLIENT_ID and CLIENT_SECRET?

I'm wondering the same thing. Is there any way to do this?

Re: Reverse-engineering the Starbucks ordering API

#153

Post by coworkerblues »

Rjevski wrote: post #145
coworkerblues wrote: post #136

Earlier quoted context omitted.

I would rather contact them anonymously first, also I don't understand exactly how Tor would help me with this.

Tor will help you by hiding your identity so they will be in a dead end when they sue and try to find you. And yes of course you can also use Tor to contact them anonymously before disclosing.

Besides telling me to use tor (which I know in general what it is), is there a guide I can use ? (i.e. how to send / recv anonymous email on tor from a non tor address ?) or something ???

Re: Reverse-engineering the Starbucks ordering API

#154

Post by coworkerblues »

shinolajla1 wrote: post #141
coworkerblues wrote: post #135

Earlier quoted context omitted.

I don't want to contact them in a way that they can trace me, since I'm pretty sure that they will try to covert up / threat me (I would hope that someone there already knows this is an issue....).

Starbucks has a bug bounty program, and they do actually pay out. https://www.starbucks.com/whitehat

Nice (altough the URL does not work) unfortunately in our startup nation there are 0 programs like this :(

Re: Reverse-engineering the Starbucks ordering API

#155

Post by Rjevski »

coworkerblues wrote: post #153
Rjevski wrote: post #145

Earlier quoted context omitted.

Tor will help you by hiding your identity so they will be in a dead end when they sue and try to find you. And yes of course you can also use Tor to contact them anonymously before disclosing.

Besides telling me to use tor (which I know in general what it is), is there a guide I can use ? (i.e. how to send / recv anonymous email on tor from a non tor address ?) or something ???

Use the following to get a live OS with Tor preinstalled: https://tails.boum.org

Once you're in there you can just use the Tor browser to create an email account at any email provider (make sure you give them fake details though) and send your email.

Re: Reverse-engineering the Starbucks ordering API

#156

Post by coworkerblues »

Rjevski wrote: post #155
coworkerblues wrote: post #153

Earlier quoted context omitted.

Besides telling me to use tor (which I know in general what it is), is there a guide I can use ? (i.e. how to send / recv anonymous email on tor from a non tor address ?) or something ???

Use the following to get a live OS with Tor preinstalled: https://tails.boum.org Once you're in there you can just use the Tor browser to create an email account at any email provider (make sure you give them fake details though) and send your email.

Which email provider allow opening an account from a known tor exit node ?

Re: Reverse-engineering the Starbucks ordering API

#157

Post by jsjohnst »

torstenvl wrote: post #69
rconti wrote: post #41

Excellent writeup. I have to take issue with the "Starbucks app is great" line, though. I think I've had more problems with it (on iOS) than any other app. It's the only app that (for a period of many months if not a year) was regularly unable to find my location. Even if I opened up Maps or some other location enabled app and found my location before launching Starbucks, it would just bomb out. Overall the app seems…

Agreed. The app has definitely sent a different order than was on screen before; until recently it refused to work with Apple Pay unless your Apple Pay address matched character-for-character what your bank had on file (if one used # and one used APT, or one used VA and one used Virginia, it would fail), and we've lost the ability to customize orders as much as we used to (e.g. you can no longer order a flat white wi…

Was the card an Amex by chance? Visa and MC only use the numerical digits in address and the zip code for AVS checks.
Post reply on HN