lud1161/upi-recon-cli

UPI Reconnaissance tool

UPI Recon CLI

This tool doesn't work right now, as it depends on 3rd party APIs that aren't working the way they were.

A command line tool for reconnaissance using virtual payment address (VPA). This tool leverages the openness available with the UPI platform to find :

1. UPI ID and name associated with a mobile number
2. UPI ID and name associated with a gmail account
3. UPI ID and name associated with a vehicle registration number. Leveraging UPI id associated with a fastag.

This project is a golang port of upi-recon by @squeal.

Overview

                _    _ _____ _____   _____                         _____ _      _____ 
                | |  | |  __ \_   _| |  __ \                       / ____| |    |_   _|
                | |  | | |__) || |   | |__) |___  ___ ___  _ __   | |    | |      | |  
                | |  | |  ___/ | |   |  _  // _ \/ __/ _ \| '_ \  | |    | |      | |  
                | |__| | |    _| |_  | | \ \  __/ (_| (_) | | | | | |____| |____ _| |_ 
                \____/|_|   |_____| |_|  \_\___|\___\___/|_| |_|  \_____|______|_____|

                        #  Author: Aseem Shrey (@aseemshrey)
                        #  URL: https://github.com/LuD1161/upi-recon-cli
                        #  Website : https://aseemshrey.in
                        #  YouTube : https://www.youtube.com/c/HackingSimplifiedAS

Check virtual payment address corresponding to a mobile number, email address and get user's name as well.

Usage:
  upi-recon-cli PHONE_NUMBER [flags]
  upi-recon-cli [command]

Available Commands:
  checkAll    Check a particular number against all UPI identifiers.
  checkFastag Check Fast tag suffixes for vehicle registration number.
  checkGpay   Check gmail id corresponding to GPay suffixes.
  help        Help about any command

Flags:
  -h, --help            help for upi-recon-cli
  -t, --threads int     No of threads (default 100)
      --timeout int     Timeout for requests (default 15)
  -v, --version         version for upi-recon-cli

Use "upi-recon-cli [command] --help" for more information about a command.

Checking a Mobile number for the Owner's name and UPI IDs

./upi-recon-cli <MOBILE_NUMBER_HERE>

Checking a Vehicle Number for the Owner's name and UPI IDs

./upi-recon-cli checkFastag <VEHICLE_NUMBER>

Checking a Gmail ID for the Owner's name and UPI IDs

./upi-recon-cli checkGpay <GMAIL_ID>

Installation

1. Download the binaries for your platform from releases page.
2. Extract the tar.gz file. You'd find the following file strucuture inside the extracted folder :

.
├── LICENSE
├── README.md
├── data
│   ├── all_suffixes.txt
│   ├── fastag_suffixes.txt
│   ├── gpay_suffixes.txt
│   └── mobile_suffixes.txt
└── upi-recon-cli

1 directory, 7 files

3. That's it. You're ready to go 🎉🚀

Run with Gitpod

Click this button to run your project on Gitpod which comes pre-configured with the go environment you need 🔥

Acknowledgements

• Karan S (@squeal): authored upi-recon
• Srikanth L (@logic): contributed suffix files, introduced support for Google Pay & Fast tag addresses

🚀 About Me

This is Aseem. I'm a security engineer from India 🇮🇳.
I am always curious about learning and building new things. Teaching security stuff through my youtube channel. Ping me up for anything related to security 🙌

Disclaimer

Note: Unified Payment Interface ("UPI") Virtual Payment Addresses ("VPAs") do not carry a data security classification by virtue of their usage in practice, and should as such be considered to be public information, similar to how email addresses may be considered to be public information.

This tool allows users to 1) check the existence of UPI payment addresses, and 2) fetch associated information about the account holder, in an automated manner based on provided input. This functionality is already available (however, not in an automated fashion) through most UPI payment applications available on the Android and/or iOS platforms.

This tool is provided "AS IS" without any warranty of any kind, either expressed, implied, or statutory, to the extent permitted by applicable law.

upi-recon-cli's Issues

Add more API support

Since razorpay has started providing masked details for the user. We need to look for other APIs support to get the VPA details.
Some examples are :

1. cashfree.com
2. paytm

etc.

This is not an exhaustive list but a starting point.

This is how the razorpay api's output is masked right now :

Problem with command initializing

Hi Team,
I was trying to play around with the tool and came across an error while initializing the cli.

Am i doing something wrong here?

Do let me know, if you require any other details to recreate the problem.

no such file directory

Add output in JSON

Currently the tool prints the output in only a 'pretty' format.
Give the option to output in json.

Checked 115 unique VPAs. Found None ❌

Its showing this error for all the mobile numbers and email ids. (using live api key)

all banks handel upi are shown but no one is correct

5:38PM INF ✅ Customer Name : Verified | VPA : -------------@apl
5:38PM INF ✅ Customer Name : Verified | VPA : --------------@airtel
5:38PM INF ✅ Customer Name : Verified | VPA : -------------@aubank
5:38PM INF ✅ Customer Name : Verified | VPA : -------------@allbank
5:38PM INF ✅ Customer Name : Verified | VPA : ---------------@abfspay
5:38PM INF ✅ Customer Name : Verified | VPA : ------------------@AlBK
5:38PM INF ✅ Customer Name : Verified | VPA : -----------------@allahabadbank
5:38PM INF ✅ Customer Name : Verified | VPA : -------------------@Axl
5:38PM INF ✅ Customer Name : Verified | VPA : ----------------------@axis

Quality of life suggestion

Hey @LuD1161,
Can we add a status check for the API key?

Something like

resp, err := client.Do(req)

if resp.StatusCode == 401 {
	fmt.Println("[+] <blah blah blah> : "resp.Status)
	os.Exit(0)
}

Add silent mode in output

Add option to print only the output and nothing else, like no banner etc.