---
description: >-
  This blog post is regarding the time when I hacked into Mumbai's Metro Booking
  System from ChatBot to SQLi and breaking encryption.
---

# Hacking Mumbai's Metro ChatBot and APIs for FUN 🤸🏻‍♂️

## BackStory

A few months ago, me and my friends were going for an event in Mumbai. While reaching to the metro station, I noticed one of my friend was using Mumbai's metro WhatsApp ChatBot which provided functionality to generate session codes and OTP for booking metro ticket.



<figure><img src="https://2817478997-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fkw6htGm9vTsiShhRVeX3%2Fuploads%2F0x8ZLKWETPPBJuHJu8zD%2Fimage.png?alt=media&#x26;token=07fbf27d-887a-4488-a170-b35fd5abe9b9" alt=""><figcaption><p>Mumbai Metro One WhatApp ChatBot</p></figcaption></figure>

I was curious how secure it was! So I tried to book a ticket myself and understand its flow. Flow goes this way:

* Ping [whatsapp bot](https://wa.me/+919670008889) to generate OTP/Link with session code.
* Traveler can use the link to book ticket or OTP at the ticketing counter.&#x20;
* When traveler clicks on the link they're asked about their source, destination, journey type, number of individuals, etc.

<figure><img src="https://2817478997-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fkw6htGm9vTsiShhRVeX3%2Fuploads%2F2ZKG2L3wGSaVyMXrbjXY%2Fimage.png?alt=media&#x26;token=7def406b-2899-412a-9ba3-4475b989742d" alt=""><figcaption><p>Web Booking System Interface</p></figcaption></figure>

* Once traveler has filled the required details, they can proceed with payment. They'll be redirected to payment gateway where they can pay using their desired payment option (Debit Card/Credit Card/UPI)

<figure><img src="https://2817478997-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fkw6htGm9vTsiShhRVeX3%2Fuploads%2FjydSE3K0hvGIwrq0bjDN%2Fimage.png?alt=media&#x26;token=c77167e9-cdfe-4eeb-a914-0f26717d13f4" alt="" width="375"><figcaption><p>Payment Gateway</p></figcaption></figure>

* After payment they'll be assigned a QR Code which can be used to enter and exit metro stations.

## What Can Go Wrong?

### Web Application Bad Practices

#### No Obfuscation on Client/Browser Side Source Code

Redirecting user to web application provided me an opportunity to reverse engineer their web application by reading their client side source code. It helped me to understand how their web application works what user inputs are needed to which endpoint.&#x20;

The Browser side code **wasn't obfuscated** so I was able to break their client side encryption which provided me to **forge checksum.**

PoC Code Link: [https://github.com/dmdhrumilmistry/hacking-mumbai-metro/](https://github.com/dmdhrumilmistry/hacking-mumbai-metro/) (This might not work now)

#### **Application Running in Debug Mode**

Since, Source code was readily available, I used jsluice to extract API endpoints and other urls.

I started fuzzing endpoints manually to in hope to generate tracebacks. I found out that the application was running in debug mode using laravel in the backend.

<figure><img src="https://2817478997-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fkw6htGm9vTsiShhRVeX3%2Fuploads%2Fl7nZ4Y4pTrBGYGlhOfEJ%2Fimage.png?alt=media&#x26;token=72af2c6d-6cf6-48f6-990b-5f4e42dca209" alt=""><figcaption><p>Metro Web Application running in debug mode</p></figcaption></figure>

<figure><img src="https://2817478997-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fkw6htGm9vTsiShhRVeX3%2Fuploads%2FBCDSCXVyLyLLrUVOM2fT%2Fimage.png?alt=media&#x26;token=ff2c40d1-e7f7-433a-ac50-b75e4db4c8b1" alt=""><figcaption><p>Backend Source Code Example 1</p></figcaption></figure>

Now I was able to read few parts of the backend source code. During which I found that there was no input validation and sanitization in the API. Most of the API endpoints are crashed were vulnerable to SQL Injection attack vector due to missing sanitization and input validation.&#x20;

<figure><img src="https://2817478997-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fkw6htGm9vTsiShhRVeX3%2Fuploads%2FIdiyRsFBQdRs8rtoCloy%2Fimage.png?alt=media&#x26;token=a70126c1-facf-4c53-903a-4db713348c03" alt=""><figcaption><p>Laravel Code in which `where` clause is used along with closure argument leading to SQLi</p></figcaption></figure>

In Laravel, the `where()` method is a helper method that constructs a simple where clause for an Eloquent query. When you use the `where()` method with a string argument, Laravel will automatically escape the string to prevent SQL injection attacks. However, when you use the `where()` method with a Closure argument, Laravel will not escape the Closure, which means that any unescaped user input passed to the Closure will be included in the SQL query as-is.

In above example code, the `where()` method is used with a Closure argument to construct a where clause that compares the `sale_or_no` column to the `order_id` variable. If the `order_id` variable is not properly sanitized and validated, an attacker can inject malicious SQL code into the variable, which can then be executed by the database server.

<figure><img src="https://2817478997-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fkw6htGm9vTsiShhRVeX3%2Fuploads%2FdLPkfVak6MMUfLG2YkUa%2Fimage.png?alt=media&#x26;token=370e9de3-1dfa-49cf-8786-7ccff7398b83" alt=""><figcaption><p>Laravel Queries from Debug Mode</p></figcaption></figure>

### Want to avoid such attacks in your apps?&#x20;

Checkout my project which automatically pentests your APIs using [OWASP OFFAT](https://github.com/OWASP/OFFAT) and fix security issues before they're deployed to production environment.

### How to avoid such mistakes?

* Never run any of your app in debug mode for production environments. It can leak so much information about the production environment.&#x20;
* Never ever trust user input data, always validate and sanitize their inputs.
* Always obfuscate/uglify code for client side applications.&#x20;

<figure><img src="https://2817478997-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fkw6htGm9vTsiShhRVeX3%2Fuploads%2FbfWbVkeFZdyxlMRF5hVy%2Fdisaster-girl.jpg?alt=media&#x26;token=8911e912-c7e9-4ad7-86c2-2d16e9199703" alt=""><figcaption><p>Metro Booking Web App Meme</p></figcaption></figure>

## Conclusion

We usually learn from our mistakes but let's learn from others mistakes as well. Let's sanitize user inputs each and every time, which will help us take one step towards creating robust and secure applications.
