LeakIX - Host freight.sunpay.com.tw

Domain freight.sunpay.com.tw

Germany

Akamai International B.V.

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 2.16.204.78
Domain: freight.sunpay.com.tw
Port: 443
URL: https://freight.sunpay.com.tw

First seen 2025-10-14 15:11
Last seen 2026-02-08 23:43
Open for 117 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd110a331ec008f9e891a462bfbc4df3cfaa364aac58aff1715
```
Public Swagger UI/API detected at path: /v2/api-docs - sample paths:
POST /FamilyCallBack/storeMapCallBack
POST /HiLifeCallBack/storeMapCallBack
POST /OkCallBack/storeMapCallBack
POST /SevenElevenCallBack/storeMapCallBack
POST /api/getCode
POST /api/getMerchantOrder
POST /api/sendStatus
POST /api/updateStore
POST /web/StoreMap
POST /web/printCode
```
  Found on 2026-02-08 23:43
Create report

Open service 2.16.204.78:443 · freight.sunpay.com.tw

2026-01-08 23:09

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Content-Language: zh-CN
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: *
Expires: Thu, 08 Jan 2026 23:09:22 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 08 Jan 2026 23:09:22 GMT
Content-Length: 8446
Connection: close

Page title: API docuemnt

<!DOCTYPE html>
<html lang="en">

<head>
    <title>API docuemnt</title>
    <meta charset="utf-8">
    <link href="../bootstrap-5.0.0/css/bootstrap.min.css" rel="stylesheet" type="text/css"/>
    <script src="../bootstrap-5.0.0/js/bootstrap.min.js"></script>
    <script src="../js/jquery-3.6.0.min.js"></script>
    <link rel="stylesheet" href="../jquery-ui/jquery-ui.css">
    <script src="../jquery-ui/jquery-ui.js"></script>
    <script src="../js/common.js"></script>
    <script src="../js/config.js"></script>
    <link href="../css/common.css" rel="stylesheet" type="text/css"/>
</head>
<style>
    .code {
        /*white-space: pre-wrap;*/
        /*word-wrap: break-word;*/
        /*overflow: auto;*/
        white-space: pre;
        font-family: monospace;
    }
</style>

<body>

<center>
    <h3>API測試(物流相關)</h3>

    <pre>呼叫API的時候都是使用&nbsp;Json&nbsp;格式<br></pre>
    <div class="accordion accordion-flush" id="accordionFlushExample">
        <table class="table" style="width: 1000px;">
            <tbody>

            </tbody>
        </table>
    </div>
    <form id="myform" action="" method="post" target="_bank">
        <input id="rsamsg" type="hidden" name="rsamsg" value="">
    </form>
</center>
</body>

</html>


<script>
    $(document).ready(function () {
        $('textarea').on('keyup keypress', function () {
            $(this).height(0);
            $(this).height(this.scrollHeight);
        });
    });

    $(function () {
        apiArray = [];
        //=============================================================================================
        api_info = new Object();
        api_info.api_name = "web/StoreMap";
        api_info.title = "<span style='color: red'>WEB</span>電子地圖";
        api_info.params = {
            "merchantID": 'M7082878301',
            "storeType": '1',
            "serviceType": '2',
            "merchantOrderID": getOrderID(),
            "returnUrl": 'https://appserv.playground.tw/doc/callback.php',
            "notifyUrl": 'https://appserv.playground.tw/callback_log',
            "device": 'pc',
        }
        api_info.apiDesc = "<span class='color_red'>請求參數:</span><br>";
        api_info.apiDesc += "merchantID         : 商戶號<br>";
        api_info.apiDesc += "storeType          : 超商類型 1:7-11 2:全家 3:萊爾富 4:OK<br>";
        api_info.apiDesc += "serviceType        : 1：取貨付款 2：取貨不付款<br>";
        api_info.apiDesc += "merchantOrderID    : 商戶訂單號<br>";
        api_info.apiDesc += "returnUrl          : 前端同步轉跳通知地址(<span class='color_red'>如不填寫，選完門市後將直接關閉畫面，只進行後端通知</span>)<br>";
        api_info.apiDesc += "notifyUrl          : 異步通知地址<br>";
        api_info.apiDesc += "device             : 使用裝置 pc OR mobile<br>";

        //回傳說明
        api_info.return = {};
        api_info.return.resultCode = '00';
        api_info.return.resultMessage = '';
        api_info.return.data = {
            "receiverStoreid": "171085(<span class='color_red'>收件人門市編號</span>)",
            "receiverStoreAddress": "台北市內湖區內湖路一段285巷65弄3號5號1樓(<span class='color_red'>收件人門市地址</span>)",
            "merchantOrderID": "TT0022123456(<span class='color_red'>商戶訂單號</span>)",
            "receiverStoreName": "西武門市(<span class='color_red'>收件人門市名稱</span>)"
        };
        apiArray.push(api_info);

        //=============================================================================================

        api_info = new Object();
        api_info.api_name = "api/getCode";
        api_info.title = "<span style='color: red'>API</span>背景要號";
        api_info.params = {
            "merchantID": 'M7082878301',
            "storeType": '4',
            "serviceType": '2',
            "merchantOrderID": getOrderID(),

Found 2026-01-08 by HttpPlugin

Create report

Open service 2.16.204.78:443 · freight.sunpay.com.tw

2026-01-01 22:51

HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Content-Language: zh-CN
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: *
Expires: Thu, 01 Jan 2026 22:51:51 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 01 Jan 2026 22:51:51 GMT
Content-Length: 8446
Connection: close

Page title: API docuemnt

<!DOCTYPE html>
<html lang="en">

<head>
    <title>API docuemnt</title>
    <meta charset="utf-8">
    <link href="../bootstrap-5.0.0/css/bootstrap.min.css" rel="stylesheet" type="text/css"/>
    <script src="../bootstrap-5.0.0/js/bootstrap.min.js"></script>
    <script src="../js/jquery-3.6.0.min.js"></script>
    <link rel="stylesheet" href="../jquery-ui/jquery-ui.css">
    <script src="../jquery-ui/jquery-ui.js"></script>
    <script src="../js/common.js"></script>
    <script src="../js/config.js"></script>
    <link href="../css/common.css" rel="stylesheet" type="text/css"/>
</head>
<style>
    .code {
        /*white-space: pre-wrap;*/
        /*word-wrap: break-word;*/
        /*overflow: auto;*/
        white-space: pre;
        font-family: monospace;
    }
</style>

<body>

<center>
    <h3>API測試(物流相關)</h3>

    <pre>呼叫API的時候都是使用&nbsp;Json&nbsp;格式<br></pre>
    <div class="accordion accordion-flush" id="accordionFlushExample">
        <table class="table" style="width: 1000px;">
            <tbody>

            </tbody>
        </table>
    </div>
    <form id="myform" action="" method="post" target="_bank">
        <input id="rsamsg" type="hidden" name="rsamsg" value="">
    </form>
</center>
</body>

</html>


<script>
    $(document).ready(function () {
        $('textarea').on('keyup keypress', function () {
            $(this).height(0);
            $(this).height(this.scrollHeight);
        });
    });

    $(function () {
        apiArray = [];
        //=============================================================================================
        api_info = new Object();
        api_info.api_name = "web/StoreMap";
        api_info.title = "<span style='color: red'>WEB</span>電子地圖";
        api_info.params = {
            "merchantID": 'M7082878301',
            "storeType": '1',
            "serviceType": '2',
            "merchantOrderID": getOrderID(),
            "returnUrl": 'https://appserv.playground.tw/doc/callback.php',
            "notifyUrl": 'https://appserv.playground.tw/callback_log',
            "device": 'pc',
        }
        api_info.apiDesc = "<span class='color_red'>請求參數:</span><br>";
        api_info.apiDesc += "merchantID         : 商戶號<br>";
        api_info.apiDesc += "storeType          : 超商類型 1:7-11 2:全家 3:萊爾富 4:OK<br>";
        api_info.apiDesc += "serviceType        : 1：取貨付款 2：取貨不付款<br>";
        api_info.apiDesc += "merchantOrderID    : 商戶訂單號<br>";
        api_info.apiDesc += "returnUrl          : 前端同步轉跳通知地址(<span class='color_red'>如不填寫，選完門市後將直接關閉畫面，只進行後端通知</span>)<br>";
        api_info.apiDesc += "notifyUrl          : 異步通知地址<br>";
        api_info.apiDesc += "device             : 使用裝置 pc OR mobile<br>";

        //回傳說明
        api_info.return = {};
        api_info.return.resultCode = '00';
        api_info.return.resultMessage = '';
        api_info.return.data = {
            "receiverStoreid": "171085(<span class='color_red'>收件人門市編號</span>)",
            "receiverStoreAddress": "台北市內湖區內湖路一段285巷65弄3號5號1樓(<span class='color_red'>收件人門市地址</span>)",
            "merchantOrderID": "TT0022123456(<span class='color_red'>商戶訂單號</span>)",
            "receiverStoreName": "西武門市(<span class='color_red'>收件人門市名稱</span>)"
        };
        apiArray.push(api_info);

        //=============================================================================================

        api_info = new Object();
        api_info.api_name = "api/getCode";
        api_info.title = "<span style='color: red'>API</span>背景要號";
        api_info.params = {
            "merchantID": 'M7082878301',
            "storeType": '4',
            "serviceType": '2',
            "merchantOrderID": getOrderID(),

Found 2026-01-01 by HttpPlugin