Remotely unlocking electric scooters — Henri Emategui

Note: to protect the company, I swapped out anything that could point back to it for fake examples. The domain electricscootercompany.com.br, the app package, and the user details (slug, name, and email) are all made up. None of it matches the real company. It started with a news article. A company had just dropped a bunch of electric scooters in my city. Most people saw a new way to get around town. I saw a fleet of internet-connected devices running on a backend nobody had poked at yet. First I needed two things: which company this was, and how the service worked for a normal user. The name was right there in the article, and a quick Google got me to their site, which laid out the flow: open the app on your phone; scan the scooter's QR Code; pay to unlock the vehicle; ride. That's the happy path for any user. I wanted to see what was going on behind it. Step 1: Recon I started by mapping everything tied to electricscootercompany.com.br.

Subdomain enumeration pulled up a bunch, including: www app api privacidade privacidade2 dev membro vouchers planos validate painel Not all of those were real apps.