What it does: This endpoint is the entry point to our API. Whether you want to create a payment, login to your account, or change your address, a call will be made to this endpoint. If you Google N26 API you may find some un-officials wrapper to our API with examples of call that are used. You can also look at the request that are made to api.tech26.de when you connect to my.n26.comWhat to look for: We are generally interested in application logic bugs, privilege escalation, RCE.What it runs on: Our API is written in Java.What it does: This subdomain lets you access a client side interface that calls the API (api.tech26.de). It offers many of the services offered through the mobile application, but not all of them.What to look for: We are generally interested in XSS injection, sensitive data exposure, privilege escalation.What it runs on: Our web app is written in Javascript.
iOS & Android apps
What it does: N26 has two mobile applications: iOS & Android. These are the main frontend applications we have and they contain all the features for N26 users.What to look for: We are generally interested in security misconfigurations or usage of outdated/unsafe libraries.What it runs on: Our mobile apps are implemented in Android/Java and Swift.