Full Api Access and Run All Functions via Starbucks App

Summary

When i tried to pentest the starbucks android app, i could not see the traffic between client and the server because of the SSL Pinning.

First, i wanted to SSL Unpinning then continue the testing, however, i released that developers forgot to add /MobileInbox/ path for the ssl validation. (i dont know they forgot or leave it like that)

Currently, I had a request thanks to forgotten/leaving a path for ssl validation. When i have a directory, always i check the sub or parent directory because of that I tried to reach this link directly on browser but i faced a basic http authentication pop-up. There must be a problem because i have an access with burp, then i check the HTTP Headers bingo! there was a Authorization-Token. I added this token automatically when i request a link then second bingo i have an access directly on browser.

Now try to digg sensitive things. I went to homepage and it directed me to /edgeapidoc/index/ . There was a link on that page which /swagger/docs/v1/ . I hoped that was the documents of the API usage. Yeapp that was the documentation of the API usage. I saw all methods of the app, first thing which came in my mind, am i eligible to use this all of things. yeap i was :)

I did not want to change anything on the server, because of that did not use any POST method. I just used almost all GET methods :D all of them were working such as, masked credit card values, api tokens, user informations etc.