PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Hacking Starbucks and Accessing Nearly 100 Million Customer Records

samcurry.net | blog | #bug-bounty | #access-control | #data-exposure | #api-security | #starbucks | #bff
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A Starbucks gift-card purchase tipped Sam Curry to suspicious /bff/proxy/ API calls; probing the backend-for-frontend routing ultimately exposed nearly 100 million customer records.
Published
Collected

Related coverage

blog · wiz.io
The Red Agent POV: Exploiting Broken Object-Level Authorization in an Airline GraphQL API
Part 2 of the Red Agent POV series: an autonomous BOLA exploit against an airline's GraphQL booking API used sequential IDs to read two years of passenger records and even modify live bookings.
blog · bugbunny.ai
Insecure Direct Object Reference: The Authorization Bug Hiding in Plain Sight
Insecure direct object reference: the app exposes an object ID but never checks ownership, tenant or role—one user reads another's data; fix with centralized object authorization and negative tests.
blog · labs.cognisys.group
The Golden Role How a Simple API Logic Flaw Unlocked an Entire SaaS Platform
In a true black-box assessment, the engagement begins with minimal information: a target URL and no prior knowledge of the application’s architecture, credentials, or codebase. During a recent engagement targeting a multi-tenant SaaS platform, our initial objective was to establish initial access through standard user provisioning.
blog · netspi.com
API Security Testing: The Overlooked Frontline in Application Penetration Testing
APIs expose backend logic and sensitive data directly; targeted API security testing uncovers broken authentication, excessive data exposure, and access control flaws that traditional pentests miss.
Medium · vulnerability · github.com
CVE-2026-84636: Apple iOS/macOS SCDynamicStore Wi-Fi SSID Info Disclosure PoC
Wi-Fi SSID data is strictly guarded as sensitive location telemetry on iOS. This PoC shows that third-party applications could bypass sandbox entitlement checks via SCDynamicStore to silently track user network environments and physical locations.
blog · samcurry.net
Hacking the World Poker Tour: Inside ClubWPT Gold’s Back Office
Sam Curry recounts breaching ClubWPT Gold's back office: a stray Chinese dev domain in the poker site's JavaScript led to an admin portal with broken auth exposing IDs, passports and transactions.
Back