Shopify POS firmware: extracting a root hash
An in-scope Shopify POS endpoint exposed the card reader's firmware bundles, which unpack via binwalk, a dd carve at 0x202024 and jffs2dump into a JFFS2 root filesystem containing a salted MD5 root hash.
iOS
iOS apps and the endpoints they quietly call. Here it was Shopify POS handing out firmware URLs.