How I Ethically Hacked GSRTC and Reported Vulnerabilities…..🛡️💻

Jan 1, 2024 2 min read Utsavpari Gosai

Hello Hackers,

Blog Image

I trust you are all well and continuously expanding your knowledge. Today, I share a fascinating bug that I recently discovered in GSRTC (Gujarat State Road Transport Corporation).

The story unfolds as my father needed to attend a wedding in Kutch, Bhuj, Gujarat. He requested me to book an online bus ticket through the GSRTC app. Little did I know that this simple task would lead me to uncover two significant bugs one in their website and another in the mobile application. For security reasons, I won’t disclose the specifics of the mobile application bug.

My purpose in writing this article is to share my experience, promote awareness, and encourage others to learn from these incidents to contribute to a more secure internet and country.

The Bugs:

  • In the GSRTC app, I discovered that any hacker could book an entire bus without payment for 15 minutes. All that was required was three mobile phones, and they could exploit this vulnerability.
  • The second bug is both intriguing and critical an IDOR (Insecure Direct Object Reference) bug. It allowed a potential hacker to access all details of users who booked tickets through the GSRTC app or website. I won’t disclose the full details for security purposes.

I promptly reported these bugs to GSRTC, and I hope they will patch these vulnerabilities as soon as possible.

Takeaways:

Always be vigilant and thorough in testing while engaging in any online transactions, whether on a website or application. Test interesting parameters and inputs, and if you discover anything suspicious, report it ethically as an ethical hacker (white hat hacker). This helps secure our online world from potential threats posed by black hat hackers.

Thank You,
MR.X FACTOR

🔗 Handles:

← Back To Homepage