0xrsydn/research
1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
research/gopay-merchant-qris-gateway/sources.md

9.8 KiB
Raw Permalink Blame History

title description status category tags draft created updated
Sources — GoPay Merchant QRIS gateways Citation list for the merchant-gateway audit — pinned repos, capture reports, APK analyses, issue threads — with what each source evidenced and where each claim was verified. concluded technical
gopay
gobiz
sources
citations
true 2026-10-15 2026-10-15

Sources — GoPay Merchant QRIS gateways

Part of gopay-merchant-qris-gateway/index

Audit provenance: all three repos were cloned shallowly on 2026-10-15 and read at the commits below (git log -1); star/fork/license metadata captured the same day via GitHub API (gh api repos/<owner>/<repo>). Issue threads fetched via GitHub API 2026-10-15. No calls were made to any GoPay/GoBiz endpoint, no credentials were used, no traffic was captured by us — everything about live behavior is quoted from the sources' own documented captures. Repo URLs below are pinned to the audited commit SHA.

S1 — AlfinAI/QrisMerchantID (Python SDK + research knowledge base)

  • Repo (pinned): https://github.com/AlfinAI/QrisMerchantID/tree/ac1f2ba3c1d82910bc8a81e9f0b98d10c0ead36b — commit ac1f2ba3c1d82910bc8a81e9f0b98d10c0ead36b (main, 2026-10-10). MIT (LICENSE file); GitHub classifier reports "NOASSERTION". 12 ★ / 2 forks (2026-10-15).
  • Evidenced: the complete audit trail of the reverse-engineering work, capture-verified API shapes, the SDK whose code corroborates the mechanics (§ refs below), disclaimers and credits.

S2 — kavionn/gobiz-payment (Node.js library)

  • Repo (pinned): https://github.com/kavionn/gobiz-payment/tree/0bac129fefa09a3b723b68dd8f09e4b0e3899527 — commit 0bac129fefa09a3b723b68dd8f09e4b0e3899527 (main, 2026-09-07). MIT. 73 ★ / 29 forks (2026-10-15).
  • Core file read in full: gobiz.js — key anchors:
    • device header set: L71–L100 · password login: L102–L149 · OTP login: L158–L254
    • token validity probe: L292–L304 · merchant discovery: L256–L272
    • getHistory (analytics→journal fallback): L399–L467 · analytics: L469–L518 · journals: L520–L629
    • watcher: L632–L748 · singleton factory: L750–L763 · minor-unit ÷100: L407, L435, L678–L681
  • Evidenced: readable reference implementation of auth replay, feed normalization, watcher pattern; the §4 unit-handling comparison; curl-subprocess quirk (L107/124/174/226).

S3 — ahmadzakiyox/gopay-api-gateaway (Node.js service)

  • Repo (pinned): https://github.com/ahmadzakiyox/gopay-api-gateaway/tree/c753b8c23daf5ced58febe650bcd229b6b2b7dec — commit c753b8c23daf5ced58febe650bcd229b6b2b7dec (main, 2026-07-26). MIT. 233 ★ / 84 forks (2026-10-15).
  • Core file read in full: server.js — key anchors:
    • claim map + 24-h cleanup: L16–L53 · 6-h refresh cycle: L56–L69 · CRC16: L72–L85
    • generateDynamicQRIS (tag 54 + tag 01→12 + CRC): L88–L147 · token-status probe: L176–L204
    • /create-qris: L207–L252 · checkout page (5-min countdown, manual check, 8-s opt-in poll): L255–L481
    • verifyPayment (claim scoping; no unit conversion — see analysis §4): L566–L653 · public status: L656–L686 · /check-payment: L690–L727
  • Obfuscation evidence: login.js (425,457 B) and sessionManager.js (463,886 B) are javascript-obfuscator output (hex string-array, no readable endpoints; javascript-obfuscator in devDependencies); package.json checked for dependency list.
  • Evidenced: service architecture, claim-scoping design, RAM claim store, obfuscation red flag, third-party QR rendering (api.qrserver.com at L267/L272).

S4 — kavionn/gobiz-payment issue #3: "Gopay Merchant app not Gobiz? and what are the risks?"

  • Thread: https://github.com/kavionn/gobiz-payment/issues/3 (open; fetched 2026-10-15).
  • Evidenced [reported]: maintainer statement that GoPay Merchant transactions are visible on the GoBiz web for the same account ("ambil datanya dari web gobiz"); community suspension observations ("kena suspend / peningkatan transaksi"); the on-demand-poller suggestion and QMID author's participation.

S5 — GitHub API metadata (captured 2026-10-15)

  • gh api repos/ahmadzakiyox/gopay-api-gateaway, …/kavionn/gobiz-payment, …/AlfinAI/QrisMerchantID — stars, forks, license, created/pushed dates quoted in the repo cards.

S6 — QMID research/RESEARCH_GOPAY_SHOPEEPAY.md (flagship research doc, 2026-09-11, updated through §9.5)

  • Pinned: .../blob/ac1f2ba3c1d82910bc8a81e9f0b98d10c0ead36b/research/RESEARCH_GOPAY_SHOPEEPAY.md
  • Evidenced: ecosystem map (8+ repos); GoPay auth endpoint table (§2.1); data endpoints (§2.2); watcher pattern (§2.3); QRIS + anti-double-claim recipe (§2.4); gateway architecture pattern (§5); HAR verification results §9.1 (body/param shapes, 23-key tx object, minor units), §9.2 (corrections: login_type, X-AppVersion bump, split headers, journal headers), §9.3 (new endpoints: payouts, payable_detail, merchant detail), §9.4 (second capture, drift), §9.5 (email login verified live).

S7 — QMID research/REPORT_GOBIZ_OTP_2026-09-19.md (OTP regression analysis, HAR-based)

  • Pinned: .../blob/ac1f2ba3c1d82910bc8a81e9f0b98d10c0ead36b/research/REPORT_GOBIZ_OTP_2026-09-19.md
  • Evidenced: capture provenance (GOTO.har, 51 MB, 589 entries, Firefox); OTP request/response shapes + headers + rate limit (§3.1); token exchange + JWE sizes (§3.2); split-header finding (§3.3); root-cause ranking incl. phone-format + X-AppVersion gating (§4); credential-hygiene rules (preamble §5); email login second capture (§8); "mirror the browser, byte-for-byte" principle (§5).

S8 — QMID research/APK_GOPAY_MERCHANT_2.3.0_ANALYSIS.md (APK static analysis)

  • Pinned: .../blob/ac1f2ba3c1d82910bc8a81e9f0b98d10c0ead36b/research/APK_GOPAY_MERCHANT_2.3.0_ANALYSIS.md
  • Evidenced: APK identity/hashes (§1); permissions (§2); exported components (§3); anti-tamper + crypto inventory (§4); host inventory §5.1 + ~150 endpoint groups §5.2 (incl. unified-histories, transactions/charge/qris-link, qris/shared, raccoon WebSocket); §5.4 sister-app evidence (GoBiz relation, answering kavionn#3); honest static-only limits (§7, §12 reproducibility log).

S9 — QMID docs/APK_RESEARCH_REPRODUCTION_GUIDE.md (how the APK research was done)

  • Pinned: .../blob/ac1f2ba3c1d82910bc8a81e9f0b98d10c0ead36b/docs/APK_RESEARCH_REPRODUCTION_GUIDE.md
  • Evidenced: full repro pipeline (tooling, download patterns, hashing, apktool/androguard steps §3.1–§3.11); masking rule ("4 leading + 4 trailing chars + length" §3.9); secret-scan commands; ethics boundaries (§5).

S10 — QMID GoPay client docs + source (the capture-annotated SDK)

  • Docs pinned: .../tree/ac1f2ba3c1d82910bc8a81e9f0b98d10c0ead36b/docs/gopay/ (README.md, auth.md, qris.md, watcher.md, transactions.md, merchants.md, payouts.md).
  • Source pinned: .../tree/ac1f2ba3c1d82910bc8a81e9f0b98d10c0ead36b/src/qrismerchantid/gopay/ — read: constants.py (hosts, platform-v3.125.0-e1923971, journal headers), auth.py (OTP/password/refresh flows L56–L103, L105–L125), qris.py (TLV + CRC16 + inject_amount L51–L73), watcher.py (seed/poll/match L47–L82), money.py (minor units).
  • Evidenced: the SDK-side mechanics and defaults quoted in gopay-merchant-qris-gateway/analysis §3–§7; the tag-01 conservatism and its rationale (docs/gopay/qris.md); the anti-double-claim guidance.

S11 — QMID docs/SECURITY_DISCLOSURE.md (responsible disclosure)

  • Pinned: .../blob/ac1f2ba3c1d82910bc8a81e9f0b98d10c0ead36b/docs/SECURITY_DISCLOSURE.md
  • Evidenced: static-only method, 0-critical classification, masking/no-redistribution commitments, vendor contact + 7-day correction policy.

S12 — QMID reference/endpoints.csv + reference/hosts.csv

  • Pinned: .../tree/ac1f2ba3c1d82910bc8a81e9f0b98d10c0ead36b/reference/
  • Evidenced: 249-row endpoint inventory — all rows marked BELUM TERVERIFIKASI for runtime use (static strings only); host inventory incl. staging hosts, gopaymerchant.midtrans.com, raccoon wss.

S13 — QMID docs/ISSUE-1-RESPONSE.md (Oct 2026 drift fix)

  • Pinned: .../blob/ac1f2ba3c1d82910bc8a81e9f0b98d10c0ead36b/docs/ISSUE-1-RESPONSE.md
  • Evidenced: X-AppVersion v3.122→v3.125 bump; auth calls moved to portal.gofoodmerchant.co.id while data stays on api.gobiz.co.id; OTP length read from response.

S14 — kavionn/gobiz-payment issues #4, #7

  • https://github.com/kavionn/gobiz-payment/issues/4 (closed) — empty-history field report + maintainer response ("masih bisa"); https://github.com/kavionn/gobiz-payment/issues/7 (open) — OTP not arriving. Fetched 2026-10-15. Evidenced [reported]: real-world fragility profile.

S15 — QMID docs/KB_QRIS_MERCHANT_INDEX.md + reference/MANIFEST.md

  • Pinned: .../blob/ac1f2ba3c1d82910bc8a81e9f0b98d10c0ead36b/docs/KB_QRIS_MERCHANT_INDEX.md and .../blob/.../reference/MANIFEST.md
  • Evidenced: sister-app relation map; priority endpoint list for future work (raccoon wss, unified-histories); open research questions (signing, cross-app tokens, /v1/payments/search scope); artifact hashes + honest note that APK↔hash re-verification is pending (APKs deleted post-analysis).

Referenced but not audited (reported by S6 only)

warungerik/API-GOPAY-MERCHANT (user-tested per S6, not independently verified), namtxs/gopay-api (customer-side, 2024, possibly stale), alhifnywahid/merchantid, IbraDecode/gopaymerchant, ardianryan/qbiz-qrisdinamis, xirf/gobiz-merchant-sdk, azmi2409/gopay-merchant-qris-gateway, ahmadzakiyox/shoppepay-api-gateway. Treat as pointers for future audits, not evidence.