> Duckyhax: the checkout js bundle at cdn12.editmysite.com/js/site/checkout-app.js has all 16 database table definitions with every field name type validation rule index and foreign key > Duckyhax: tables found: commerce_model_order - primary key is owner_id site_id site_order_id, indexes on token_2 uuid_index order_status customer com_order_date orders_by_date, fields include site_order_id token order_type order_status order_total order_subtotal order_tax_total order_discount_total order_shipping_total order_tip_total order_gift_card_total order_delivery_fee_total order_service_charge_total order_balance_due_total refundable_amount order_notes site_customer_id parent_order_token open_order_id open_order_uuid created_date updated_date order_paid_date is_prepared_enabled has_preordering_items is_customer_address_required is_courier_delivery_enabled, relations to orderitem ordershipment orderbilling ordercoupon orderreward commerce_model_customer - primary key owner_id site_id site_customer_id, indexes uuid_index lastname email business, fields site_customer_id name_prefix name_first name_last name_suffix email business_name home_phone work_phone pickup_phone is_marketing_updates_subscribed square_customer_id uuid owner_id site_id created_date updated_date, relations to customeraddress and order commerce_model_customeraddress - primary key owner_id site_id site_customer_id site_customer_address_id, indexes uuid_index address address_name, fields site_customer_address_id site_customer_id label is_copy name_first name_last business_name street street2 postal_code city region country phone_country_code phone changedaddresscomponents latitude longitude full_buyer_location_info uuid owner_id site_id created_date updated_date commerce_model_product - primary key owner_id site_id site_product_id, indexes uuid_index manufacturer created_date updated_date com_product_average_rating, fields site_product_id site_link name short_description mli_price_inventory_generated site_shipping_box_id variation_type pickup_fulfillment_preferences_id delivery_fulfillment_preferences_id shipping_fulfillment_preferences_id dine_in_fulfillment_preferences_id seo_page_title seo_page_description published price_low_all_location, relations to shippingbox productmodifier productsku productimage productmediafile manufacturer productoption commerce_model_category - primary key owner_id site_id site_category_id, indexes uuid_index updated_at import_batch_id, fields site_category_id name shown_in_storefront site_link product_count published page_layout page_title page_description show_featured_products show_sub_categories children_collapsed hide_from_parent parent_category_id category_order square_category_id image_order permalink product_ids, relations to categoryimage commerce_model_orderitem - primary key owner_id site_id site_order_id site_order_item_id, indexes uuid_index owner_site_product owner_site_type_created, fields site_order_item_id site_order_id site_product_id site_product_sku_id name short_description current_price discounted_price product_url full_product_url image_info track_inventory sku_uuid quantity taxable paid prepared completed refunded cancelled product_type download_limit_type download_unique_id, relations to ordershipmenttoitem orderitemfile productskufile orderitemdiscount orderitemmodifierselection commerce_model_orderbilling - primary key owner_id site_id site_order_id site_order_billing_id, indexes uuid_index is_pending_capture_index, fields site_order_billing_id site_order_id refundable_amount is_pending_capture gateway site_payment_gateway_id site_customer_id site_customer_address_id full_name email phone business_name street street2 city region country postal_code uuid owner_id site_id created_date updated_date, relations to orderbillingtransaction > Duckyhax: commerce_model_ordershipment - primary key owner_id site_id site_order_id site_order_shipment_id, indexes uuid_index site_store_address_id shipping_label_purchase_batch_index, fields site_order_shipment_id site_order_id latest_fulfillment_eta type fulfillment_type site_customer_id site_customer_address_id shipping_provider site_shipping_provider_id shipping_provider_payment site_shipping_box_id max_items max_box_weight sync_with_square_failed weight weight_unit height width depth, relations to shippingbox ordershipmenttransaction shippingrate shippingmethod ordershipmenttoitem commerce_model_shippingrate - primary key owner_id site_id site_shipping_price_id, index uuid_index, fields site_shipping_price_id title country type minimum maximum price coupon_ids uuid owner_id site_id created_date updated_date, relations to shippingregionrate > Duckyhax: commerce_model_shippingbox - fields site_shipping_box_id name max_items max_box_weight weight height width depth weight_unit owner_id site_id commerce_model_ordercoupon - fields site_order_coupon_id site_order_id coupon_code discount_amount discount_type owner_id site_id commerce_model_orderreward - fields site_order_reward_id site_order_id reward_id discount_amount owner_id site_id commerce_model_authorizedpayments - fields gateway site_payment_gateway_id digital_wallets commerce_model_storedpayment - full schema in defaults only commerce_model_checkout - full schema in defaults only commerce_model_abtest - fields test_id test_name variant owner_id site_id commerce_model_log - full schema in defaults only > Duckyhax: api methods that touch the database found in the js: commerce_readone commerce_readmany commerce_readfulltext commerce_create commerce_update commerce_patch commerce_destroy commerce_getorders commerce_getorderbytoken commerce_getcurrentorder commerce_getprimaryorder commerce_getorderavailabilityandlocations commerce_getinventory commerce_getsquarestoreconfig commerce_generateproductlist commerce_generatemobileproductlist customeraccounts_getorders customeraccounts_getaccountdetails customeraccounts_getsessiondetails customeraccounts_emailexists customeraccounts_login customeraccounts_register customeraccounts_passwordreset customeraccounts_passwordupdate customeraccounts_validatesession > Duckyhax: live api endpoints: tyler-local-business.square.site/ajax/api/JsonRPC/Ocular - GET returns 200 with jsonrpc response, POST blocked by cloudflare waf tyler-local-business.square.site/ajax/api/JsonRPC/CustomerAccounts - GET returns 200 tyler-local-business.square.site/ajax/api/JsonRPC/Commerce - GET returns 405 tyler-local-business.square.site/ajax/api/v1/ping - GET returns 200 with unknown api interface message > Duckyhax: 14 products from sitemap - product ids 2 3 6 7 8 9 10 11 13 14 15 plus square item ids EJD6FW4CGZ4FB3H6EJX3QPDA C573W4BX5T67OWJURXNZYG6A CYBLBECKA5SPDV4UOA2DCK7V > Duckyhax: product urls: /product/12-pack-of-eggs/13 /product/18-pack/2 /product/6-pack-of-eggs/3 /product/babysitting-/EJD6FW4CGZ4FB3H6EJX3QPDA /product/chicks/15 /product/delivery-fee-for-bronson/C573W4BX5T67OWJURXNZYG6A /product/delivery-for-williston-/CYBLBECKA5SPDV4UOA2DCK7V /product/ducks/11 /product/easter-egg-chick/8 /product/egg-cartons-for-sale/6 /product/fertilized-eggs/14 /product/golden-laced-wyandotte-chick/9 /product/silkie-chicks/10 /product/white-leghorn-chick/7 > Duckyhax: store config - company tyler local company, currency usd, country us, store mode cart, square location id LKXNFM1NBW1M6, square test host 621826318316464170.square.site > Duckyhax: cart uuid - dbbc77b0-fdcf-11ed-9ad1-6dc5623e837a site section uuids - caf6beb0 caf72140 caf79650 caf75f40 caf7cc60 > Duckyhax: database relationships - orderitem ordershipment orderbilling ordercoupon orderreward, customer has many customeraddress order, product has many productsku productimage productmodifier productmediafile productoption, category has many categoryimage, orderitem has many orderitemdiscount orderitemmodifierselection ordershipmenttoitem, orderbilling has many orderbillingtransaction, ordershipment has many ordershipmenttransaction, shippingrate has many shippingregionrate payment fields in orderbilling table - gateway site_payment_gateway_id full_name email phone business_name street street2 city region country postal_code refundable_amount, payment gateway mcsquare with apple pay google pay cash app all enabled pii fields in customer table - name_first name_last email home_phone work_phone pickup_phone business_name square_customer_id, customeraddress table has name_first name_last street street2 postal_code city region country phone latitude longitude full_buyer_location_info, orderbilling table has full_name email phone street city region country postal_code > Duckyhax: and internal infrastructure leaked in headers - x-host grn148.sf2p.intern.weebly.net and grn64.sf2p.intern.weebly.net, x-revision bcace20d920302b5669326429e7dacb87dbec32d, sentry dsn 13e49d785d8d4f828038b6136f3b48ba@sentry.io